Browser
Fingerprint
Part 1
Am I an anonymous user actually?
What if I told you
that somebody permanently track you
through your browser
There's no privacy?
Who can be interested?
These who want to
track you
Data brokers
Advertising
DoubleClick, ComScore, cXense
Google AdSense
Site Analytics
Google Analytics, Yandex metrika
Social Networks
Facebook, Google Plus
etc
See for yourself
who are tracking you
Ghostery browser extension
Let's check who are tracking on
www.bbc.com
Ligthbeam Firefox add-on
Websites connected
via doubleclick.net
Trackography
Let's visit russian website www.aif.ru
Wonderland and I show you how deep the rabbit-hole goes.
Disqus Comments
Decrease from 105 network requests to 16 after widget removing
google-analytics.com
connect.facebook.net
accounts.google.com
bluekai.com
crwdcntrl.net
exelator.com
doubleclick.net
tag.apxlv.net
adnxs.com
adsymptotic.com
rlcdn.com
adbrn.com
nexac.com
tapad.com
liadm.com
pippio.com
sohern.com
demdex.net
bidswitch.net
agkn.com
mathtag.com
Tracker list
...
There are Big Brothers
dealing with Big Data
The reality
Anonymous user is created own profile by tracking
The Problem
How do track companies can identify me via my browser?
Once you will login to websites or your email or use social media with your real profile
But what about
Browser fingerprint
?
Part 2
What the heck is
browser fingerprint
The capability of a site to identify or re-identify a visiting user, user agent or device via configuration settings or other observable characteristics.
Browser fingerprinting
With browser fingerprinting
Sites attempting
- to identify users on devices previously used for fraud
- to establish a unique visitor count
- to profile the behaviour of unregistered users
- to link the visits of users when they are both registered and unregistered and identify the user when visiting the site without authenticating
Advertising networks attempting
- to establish a unique click-through count
- to profile users to increase ad relevance
With browser fingerprinting
Fingerprinting types
Based on characteristics observable in the contents of Web requests, without the use of any code executed on the client.
Passive fingerprint
Examples of implementations
Fingerprinting types
HTTP Request Headers
Passive fingerprint
- Accept
- Accept-Encoding
- Accept-Language
- Connection
- Host
- User-Agent
- Version
- etc
Source Address from IP Headers
+
Passive
fingerprint schema
Fingerprint Surface
* Hash of the sum of identified feature functions' results
JavaScript code or other code on the local client to observe additional characteristics about the browser.
Active fingerprint
Examples of implementations
Fingerprinting types
Possible browser characteristics
Active fingerprint
- Cookies enabled
- Timezone
- Browser plugin list
- Screen color depth
- Screen resolution
- Support for Do Not Track
- Support for local storage
- Support for session storage
- User agent name
- etc
Active
fingerprint schema
Fingerprint Surface
* Hash of the sum of identified feature functions' results
Allows re-identification of a user or inferences about a user in the same way that HTTP cookies allow state management for the stateless HTTP protocol
Cookie-like fingerprint
Examples of implementations
Fingerprinting types
Cookie-like
fingerprint schema
* N - number of discovered storages
Fingerprint surface
The set of observable characteristics that can be used in concert to identify a user, user agent or device or correlate its activity.
Fingerprint surface
- User configuration
- Device characteristics
- Environmental characteristics
- Operating System Vendor and Version Differences
- User Behaviour
- Browser Vendor and Version Differences
Data sources
- entropy
- detectability
- persistence
- availability
- scope
Each identified feature based on the following factors
Fingerprint surface
Fingerprint surface
navigator.userAgent
As an example of identify feature
| Factor | Value |
|---|---|
| entropy | 10 bits * |
| detectability | ✓ |
| persistence | Until update |
| availability | ✓ |
| scope | Cross origin |
Entopy
How distinguishing is this new surface?
How bits are need
for identifying by surface
Panopticlick Experiment
| Variable | Entropy (bits) |
|---|---|
| user agent plugins fonts video supercookies http accept timezone cookies enabled |
10.0 15.4 13.9 4.83 2.12 6.09 3.04 0.353 |
Entropy of various pieces of browser information
Active fingerprint
Success of browser fingerprinting is
Frequency Distribution
Not only identified features factors
Part 3
Fingerprint techniques
Active fingerprint
techniques
* Not trivial and interesting
Canvas Fingerprint
const canvas = document.createElement('canvas')
const context = canvas.getContext('2d')
context.fillText(..)
context.fillRect(..)
context.fillStyle(..)
canvas.toDataURL()It is consistent, high-entropy, transparent to user, readily obtainable
The same text can be rendered in different ways on different computers depending on the operating system, font library, graphics card, graphics driver and the browser.
WebGL Fingerprint
The same idea and dependencies as in canvas fingerprint
aliased line width range; aliased point size range; alpha bits; antialiasing; blue bits; depth bits; green bits; max anisotropy; max combined texture image units; max cube map texture size; max fragment uniform vectors; max render buffer size; max texture image units; max texture size; max varying vectors; max vertex attribs; max vertex texture image units; max vertex uniform vectors; and etc.
Fingerprint can collect WebGL constants also
WebGL Fingerprint
Client-side Rendering Tasks for the Purpose of Fingerprinting
Approach can successfully identify 99.24%
Audio Fingerprint
Audio signals processed on different machines or browsers may have slight differences due to hardware or software differences between the machine
Using the window.AudioContext API to fingerprint does not collect sound played or recorded by your machine.
Battery Fingerprint
Number of possible identifiers - 3,592,980
The fix was quickly implemented and deployed by Mozilla engineers in response to bug report
Group of researchers presented an analysis of Battery Status API as implemented by Firefox on GNU/Linux in 2015
The high precision battery level readings provided by Firefox can lead to an unexpected fingerprinting surface: the detection of battery capacity.
Cookie-like
techniques
HTTP Cache Auth
https://name:value@host
Deprecated
Backend dependent
ETag HTTP header
Backend and HTTP Cookies dependent
Set value
Get value
- Save cookies value on client side
- Send request with name value in URL and cookies to backend
- Response ETag header with value
1. Send request to backend
2. Resonse from backend
2.1 Return 304 HTTP Status if IF-NONE-MATCH is set in headers
2.2 Return 200 HTTP status if HTTP cookies not set
PNG Image
Set value
Get value
- Save cookies value on client side
- Send request with name value in URL and cookies to backend
- Response encoded PNG
1. Send request with value in URL to backend
2. Request PNG Image
2.1 Return 304 HTTP Status if value is set in cookies
2.2 Return 200 HTTP Status with encoded value in PNG if value is not set in HTTP Cookies
Backend and HTTP Cookies dependent
History leaks
based techniques
Cookie-like
CSS History
Jeremiah Grossman, August 2006
Deprecated
link:visited + window.getComputedStyle
Attempt for getting pixel color from converted html to Canvas is preveneted
Pixel Perfect Timing Attacks
Paul Stone, July 2013
Deprecated
window.requestAnimationFrame + calculate time between frames drawing
History Sniffing Timing Attack
Timing Attacks with SVG Filters
CSS + SVG Filters + Reading pixels
Browser storage
based techniques
Cookie-like
First version of specification. April 2009
OpenDatabase
This specification is no longer
in active maintenance
Flash LSO
Local Shared Object
W3C Recommendation 28 October 2014
HTML5 Storages
HTTPS
based techniques
Cookie-like
HTTP Strict Transport Security
Backend dependent
The release of version 34.0 of Firefox seems to have changed. Unlike Google Chrome, Firefox has chosen to prefer privacy over security and no longer carries HSTS over to private windows.
Allows a website to indicate that it should always be accessed using a secure connection
http(s)://name-[0-4096].domain.com/?(SET/DEL)
HPKP
HTTP Public Key Pinning
Server: One of these hashes must be in the TLS cert chain you receive from me.
Browser: DOPE!! NEXT TIME I SEE YOU I WILL CHECK IT BEFORE I WRECK IT
RFC 7469
Supercookie schema: fake backup pins
- https://example.com sets a unique backup pin for each user + includeSubdomains + report-uri.
- <img src=“https://bad.example.com”> serves a chain that deliberately fails pin validation.
- A validation failure report is sent which includes a unique cached backup pin!
Part 4
How unique is your web browser?
Panopticlick
Is your browser safe against tracking?
Panopticlick Experiment
User can be tracked by common browser characteristics
over a million different browser-instances
83.6% had completely unique fingerprints (entropy: 18.1 bits, or more)
94.2% of “typical desktop browsers” were unique (entropy: 18.8 bits, or more)
Panopticlick Experiment
The Paradox of Fingerprintable Privacy Enhancing Technologies
Panopticlick 2017
| Browser Characteristic | Entropy (bits) | Each browser with this value |
|---|---|---|
| Hash of canvas fingerprint Screen Size and Color Depth Browser Plugin Details Time Zone DNT Header Enabled? HTTP_ACCEPT Headers Hash of WebGL fingerprint Language System Fonts Platform User Agent |
7.47 4.6 7.88 0.77 2.12 14.35 4.83 5.78 4.95 2.99 9.18 |
177.31 24.19 236.12 108.76 1.7 20830.13 28.43 55.12 30.98 7.93 579.31 |
Panopticlick does not measure all forms of tracking and protection
~480k browser are tested
* Result of fingerprint test for my browser. The July of 2017
Am I Unique
Yes! And you can be tracked!
Has shares some goals with panoticlick
but provides a number of novelties
We are now over 400,000 fingerprints
Princeton Web Transparency & Accountability Project
Built on top of Firefox, with automation provided by Selenium. It includes several hooks for data collection, including a proxy, a Firefox extension, and access to Flash cookies
Academic researchers, developers, public advocates, and others with expertise in online privacy all could advance our progress towards providing accurate web privacy information and best practices for the public.
Problem of time delay
between new fingerprint technique
and mitigation
Part 5
Fingerprinting mitigation
Naive paranoiac reaction
- Block advertising
- Block tracking scripts
- Block websites, blacklist
- Disable all scripts
Extensions. More extensions
Developers already know
about browser fingerprinting
Tor Browser
As an example of browser with design against fingerprint tecniques
Specific Fingerprinting Defenses in the Tor Browser:
Plugins; HTML5 Canvas Image Extraction; Fonts; Monitor, Widget, and OS Desktop Resolution; Display Media information; WebGL; MediaDevices API; MIME Types; User Agent and HTTP Headers; Locale Fingerprinting; Timezone and Clock Offset; HSTS and HPKP supercookies; and etc.
Tor Browser
getClientRects fingerprinting
technique
Mitigating Browser Fingerprinting
in Web Specifications
W3C Draft
W3C Editor's Draft 11 May 2017
* First version of W3C draft was created on March of 2013
Mitigation Practices
- Weighing increased fingerprinting surface
- Standardization
- Detectability
- Clearing all local state
- Do Not Track
From W3C Editor's Draft
- HTTP Strict Transport Security (HSTS) Pinning
- TLS Session Resumption Identifiers/Tickets
Browser private mode
Clear cookies and storages
Effective for cookies-like fingerprints except
Do Not Track
The Do Not Track header was originally proposed in 2009 by researchers Christopher Soghoian, Sid Stamm, and Dan Kaminsky
Based on web services trust and reputation
Fingerprinting mitigation
Fingerprinting mitigation
- Decreased fingerprinting surface
- Increased anonymity set
- Detectable fingerprinting
- Clearable local state
levels of success
Conclusions
Browser fingerprint problem
Arms and armor fighting
New web features bring new fingerprinting techniques
Privacy
The Web Never Forgets