Is browser fingerprinting a viable technique for identifying anonymous users?

Question

Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? What if you incorporate biometric data like mouse gestures or typing patterns?

The other day I ran into the Panopticlick experiment EFF is running on browser fingerprints.

Of course I immediately thought of the privacy repercussions and how it could be used for evil. But on the other hand, this could be used for great good and, at the very least, it's a tempting problem to work on.

While researching the topic I found a few companies using browser fingerprinting to attack fraud. And after sending out a few emails I can confirm at least one major dating site is using browser fingerprinting as but one mechanism to detect fake accounts. (Note: They have found it's not unique enough to act as an identity when scaling up to millions of users. But, my programmer brain doesn't want to believe them).

Here is one company using browser fingerprints for fraud detection and prevention:
http://www.bluecava.com/

Here is a pretty comprehensive list of stuff you can use as unique identifiers in a browser:
http://browserspy.dk/

Answer 1

First, I don't think it's realistic to expect users to have JavaScript disabled on the modern web. So let's take a look at what Panopticlick can gather through JavaScript alone, along with the uniqueness score of my particular browser:

• User Agent (1 in 4,184)
• HTTP_ACCEPT Headers (1 in 14)
• Browser Plugin Details (1 in 1.8 million)
• Time Zone (1 in 24)
• Screen Size and Color Depth (1 in 1,700)
• System Fonts (1 in 11)
• Cookies Enabled? (1 in 1.3)
• Limited SuperCookie test (1 in 2)

The standouts for uniqueness are clearly User Agent and Browser Plugins. Remember that these items are used together to form a browser fingerprint, so they are more than as strong as the individual scores. The cumulative uniqueness here is: 4,184 x 14 x 1.8 million x 24 x 1,700 x 11 x 1.3 x 2 aka a REALLY BIG NUMBER. That's ... pretty unique.

I have Flash disabled at the moment, with "click to activate". Enabling Flash adds:

• System Fonts (1 in 374k)

Flash provides the second most unique detectable element, but given the enormous number even the default JavaScript detection in Panopticlick produces, I'm not sure Flash is necessary for this sort of browser fingerprinting to work. Just JavaScript being enabled is enough.

Browser fingerprinting is merely a part of the story, though. Consider the sum of what all we can detect from anonymous users, because it can all work together to fingerprint anonymous users. How difficult is it to gather and use the detected data?

1. Browser detail sniffing, as shown above (easy)
2. IP Address, which has a known level of reliability with pros and cons (easy)
3. User behavior patterns such as usage (time of day), typing, mouse or finger movements, word use (hard, some server side, some client side)

One thing I worry about with browser sniffing alone is how trivially easy it is for users to switch browsers. There are at least four great and free browser alternatives on most platforms: Chrome, Opera, Firefox, Safari. So to break the browser sniffing, or at least interrupt it, you could switch browsers frequently.

It's worth mentioning so-called SuperCookies here since they can actually work, in some cases, even if you switch browsers and even if JavaScript, HTML 5 Local Storage, and Flash are disabled.

A privacy researcher has revealed the evil genius behind a for-profit web analytics service capable of following users across more than 500 sites, even when all cookie storage was disabled and sites were viewed using a browser's privacy mode.

(If you're curious, the TL;DR version is that they do this by exploiting obscure principles of the ETag header.)

Anyway, getting back to browser sniffing -- there are two somewhat inconvenient things users can do to defeat this:

1. Constantly switch browsers.
2. Always browse with JavaScript and Flash disabled.

However, if the user doesn't know that their browser settings are being sniffed and used as part of the method to fingerprint them, I highly doubt they would necessarily go to the trouble of doing these two things. It's work.

Based on the above data, I believe browser sniffing can help identify the typical anonymous internet user -- but it is only effective in combination with the other things we typically detect from anonymous internet users like IP Address.

Answer 2

Browser fingerprinting relies on a very heterogeneous browser/device-ecosystem. One thing to consider is that we are moving towards a more and more homogenous ecosystem as more and more surfing is done on smartphones and tablets/pads which tend to be a lot less fragmented in this sense. IPhones/iPads will for instance all look essentially identical.

Answer 3

Is browser fingerprinting a sufficient method for uniquely identifying anonymous users?

No, at best it can uniquely identity a Computer. There is no way it can differentiate between 2 new (and like) computers on the same network (Same IP) with out a cookie\session.

What if you incorporate biometric data like mouse gestures or typing patterns?

This doesn't seem realistic. This would have to be coded almost entirely in JavaScript as "bio-metric data" is all client side. The user can just shut it off. Also what will your "bio-metric data" look like for a Perl Script?

---

That being said, using these kind of tactics to fight fraud is a good idea, It doesn't have to be a 100%.. any decrease in fraud is good, even if its just a 5% improvement.

The fight against fraud is an incremental one, there is no single bullet solution to fight fraud, don't even bother looking for one.

---

EDIT: To reply to the Comments Below (and because it is very relevant), the fact that fingerprinting treats different profiles is, in My beliefs, a net NEGATIVE*. This is something that a malicious user will use to fool the fingerprinting mechanism, the fact that the user has control over all the variables used in fingerprinting is a serous flaw in and of itself.

*Which is why I say at best it can Identify a single computer, because that is BETTER then identifying a single Account on a Computer. If you can do both, that is great.

Answer 4

I would agree with @vincentcr, but would add one more environment to consider: the corporate network.

Here you are likely to find many dozens or hundreds of (potential) users with the exact same browser, plugins, fonts etc. The additional factors @vincentcr suggests also fail here - IP addresses are likely to be the same if the users are behind a corporate firewall, as are the users' reported locations.

Even with mouse gestures and typing patterns factored in, I doubt if these techniques could be used to identify unique users with any form of security, and if you wanted user accounts to be able to survive the user changing browsers, you would have to back it up with a more traditional authentication system anyway.

Though as others have said, it may be somewhat useful in detecting spambots and the like. For example, the WordPress plugin "Bad Behaviour" analyses HTTP headers (amongst other factors) in an attempt to detect spambots.

Answer 5

Even if there are a huge number of combinations, they are not all distributed evenly.

Think how many people on, say, a macbook, will just use the stock configuration. Or those who never install any plugin: I suspect those are the majority of users.

And at the extreme end, you have the fastest growing segment of devices: mobile phone and tablet users, especially iPhones and iPads, where you are reduced to only two variables: make, and version number.

So it might be a good heuristic when combined with other factors (such as ip address or location when available), but not much more than that.

Answer 6

Using browser fingerprinting you can identify an individual user on the web, and the only drawback is that you need to make javascript compulsory for every user.

It work on two principles:

1. Detect the browser fingerprint based on 8 parameters
2. Detect if someone has changed his fingerprint by changing any parameter.

The success of fingerprinting depends upon the second principle; to detect if someone has changed the fingerprint.

For more info just try the available code. You need to develop your own algorithm to detect a returning user because the algorithm used by https://panopticlick.eff.org/ is not 100% efficient right now.

Answer 7

Some browsers can also be identified via HSTS Supercookies.

This is where you can embed a page with requests to random sets of secure and non secure resources for each visitor, then monitor the pattern of their requests on a returning visit. If each resource is requested in the same pattern, then you can use that information to identify the user.

These are particularly useful for identifying iPhone / iPads which would otherwise have more of a generic browser fingerprint. This approach is not so useful for Internet Explorer where HSTS is not supported.

This article explains the approach; http://www.radicalresearch.co.uk/lab/hstssupercookies/

This article provides a good example of how to leverage HSTS Supercookies to identify users; https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-browser-dilemma-how-hsts-supercookies-make-you-choose-between-privacy-or-security/

Answer 8

Javascript is not mandatory a there are many other parameters to sniff from PHP. That said, 99% of the user have JS so why bother

Can fingerprinting provide a unique-enough identification ? I believe so. And so says www.visitor-intelligence.com with its successive screening philosophy . Think about it.

Your personal private galaxy is not as large as our whole planet.

How many tall, brown hair, blue eyes girl with a French accent walks in your street ? On a planet scale, millions. But I bet she would be pretty unique in your street (or visiting your shop).

Unless you live in Champs Elysees. Then look closer. Is she slim and walks like a model ? Does she wear an expensive handbag ? All right, she is totally unique now :-)

Looking purely at headers is wrong because it includes the version number of browser and more very variable parameters.

We are now at Chrome 27 and Firefox 21. We are updating browsers version without even noticing.

Now, looking at full plugin list is also quite wrong. Try that : install firefox, install acrobat reader, then install Chrome. I bet acrobat reader won't show in your Chrome plugin list :-)

So... Bottom line is : if you look for a decent identification sytem for a standard-size shop, then fingerprinting is way enough, and even more stable than cookies (I personally delete all my cookies almost every day).

Just my 2 cents