Fingerprinting

Browser fingerprinting is the act of using technical measures, typically delivered through JavaScript code, to attempt to assign a unique identifier to a particular web browser. This identifier is based on various properties of the computer system or device that is running the browser. When the browser fingerprint can be tied to a particular user, it provides a way to track users across the Internet without first obtaining their explicit consent.

Video Lecture

Overview

Advertisers and other entities can utilize various techniques to try to identify and track a web browser, even if the user disables cookies and blocks web beacons. One widely used technique is called browser fingerprinting, and it is a non-consensual way for a website to assign a unique identifier to a browser. This technique is non-consensual since the user is normally not notified of the fingerprinting, and any browser settings to avoid the assignment of a unique identifier (in particular, disabling or rejecting cookies) is ignored. Marketing companies have been quietly deploying these capabilities against unsuspecting users,¹ while the purveyors of fingerprinting technology try to spin the approach as a tool for fighting fraud and improving security.²

Installed Fonts

As part of the standard Document Object Model (DOM), browsers expose JavaScript methods for loading fonts into a web page.³ By loading a font and then measuring the size of the resulting text, JavaScript functions can determine whether or not the browser used the requested font. If a font isn’t available on the user’s system, then the browser will substitute a different font, which has different measurements.⁴ If a website tries a sufficiently large number of candidate fonts, it can systematically determine which fonts are installed on the user’s system.

Since fonts tend to accumulate somewhat randomly as software is installed and removed over the service life of a computer, it is likely that two computers owned by two different people will have different fonts. While there will be some users with the same font selection across the Internet (particularly those who have not installed anything beyond the default software that came with the computer), this piece of information generally contributes at least a few bits of entropy to the overall fingerprint of a browser.

Canvas Fingerprinting

The HTML5 canvas element is designed to allow web applications to draw graphics on a page.⁵ Web pages can draw arbitrary lines, shapes, colors, and text on a canvas using JavaScript to interact with the browser Document Object Model (DOM). One of the methods available to JavaScript code is toDataURL(), which creates a base64-encoded image file with a snapshot of the current state of the canvas.⁶ This method may be supplemented with other DOM methods to determine more properties of the canvas and browser, many of which will vary from system to system due to variations in computer and software configuration.⁷

One way to implement canvas fingerprinting is to combine it with font fingerprinting and render various fonts onto the canvas. The fingerprinting script then calls the toDataURL() method of the DOM object associated with the canvas. A hash, or short fingerprint, of the resulting canvas data is then computed. This hash can provide at least 10 bits of entropy toward a fingerprint.⁸

WebGL

WebGL is an open standard for creating low-level 3D graphics using a combination of JavaScript and the HTML5 canvas element.⁹ The JavaScript DOM API for WebGL implements an interface that is close to the OpenGL ES 2.0 specificiation.¹⁰ Since this API (application programming interface) works at a fairly low level, underlying details about the graphics card and driver stack on the computer may be read or guessed by JavaScript code.

It is fairly straightforward for a fingerprinter that already uses the canvas element to add support for WebGL fingerprinting. This abuse of WebGL presents both a privacy and a security concern. On the privacy side, the WebGL fingerprint adds over 5 bits of entropy to the standard 2D canvas fingerprinting techniques.¹¹ In terms of security, there are possible vulnerabilities in WebGL that could allow malicious code to execute on the system’s graphics processing unit (GPU).¹²

Web Audio API

Another API exposed to JavaScript by the browser DOM is the Web Audio API.¹³ This API provides websites with the ability to generate and manipulate sound, which can be used for improving the user experience. However, it also provides mechanisms by which the generated sound can be sampled and analyzed, which permits fingerprinting.

Since different computers have different sound hardware, and different browsers and sound systems perform different transformations on audio streams, unique features of individual systems can be detected from JavaScript code. Published workarounds even exist to compute relatively stable fingerprints for privacy-focused browsers.¹⁴

Other Data Exposed by JavaScript

Various other pieces of data can be obtained via JavaScript methods, including the number of CPU cores available on the system¹⁵ and the user agent provided by the browser.¹⁶ This information can be used as a way to increase the entropy of the browser fingerprint, even if only slightly. However, each little piece of fingerprint information, even if it only adds 1 or 2 bits of entropy, contributes toward identifying the user of a browser.

The Irony of “Do Not Track”

Finally, newer browsers (as of 2022) typically implement a feature called “Do Not Track,” which causes the browser to send a “DNT” header with each request it makes. Unfortunately, the use of this header was never mandated by law for website operators, so most sites did not respect the user’s request not to track them.¹⁷ Since most users never enabled Do Not Track, the presence of the DNT header adds a bit of entropy to the browser fingerprint, completely defeating its purpose. For this reason, Apple removed the feature altogether from the Safari browser.¹⁸

A newer standard is Global Privacy Control (GPC), which is intended to notify website operators that users do not want their data to be sold.¹⁹ The California Attorney General has instructed businesses that are subject to the California Consumer Privacy Act to respect the GPC header as an expression of the user’s instructions not to sell their personal data.²⁰

References and Further Reading

• Nick Nikiforakis and Gnes Acar. “Browser Fingerprinting and the Online-Tracking Arms Race.” IEEE Spectrum. July 25, 2014.
• Electronic Frontier Foundation. Cover Your Tracks.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.