Cookie is a thing of the past: Fingerprinting knows who you are

When cookies were created in the days of a more innocent web, their primary goal was to store small pieces of data on the user's computer to provide usability benefits. Preserving the cookie allowed, for example, keeping the user authenticated for a longer time on certain sites or retaining visit settings. Unfortunately, cookies began to pose both security and privacy issues, with websites and ad networks using the feature to track users through their browsing, often without their consent or even knowledge.

Decades of debates and warnings passed before the concept of cookies received due attention from regulatory bodies. If today many sites ask users whether they want to accept cookies, it is due to legislative efforts by global forces, such as the European Union. The effectiveness of these protection mechanisms may be questionable, but the fact is that the problem generated by cookies is more or less widely known, and companies that abuse the tool can face legal consequences.

This is where Web Fingerprinting comes into play…

What is Web Fingerprinting?

Web fingerprinting, also known as browser fingerprinting, is a relatively new digital tracking technique that goes beyond cookies and allows the identification and tracking of individuals based on unique characteristics of their browser and device. Unlike cookies, which can be easily blocked or deleted, web fingerprinting explores information such as screen resolution, operating system, browser version, installed plugins, language settings, and other attributes like installed font characters on the user's computer. These are characteristics that usually do not change frequently and can be captured without the user's knowledge or consent. Thus, it's possible to create a kind of "fingerprint" unique to that configuration and device.

This fingerprint can be used to identify the individual in a way that even using the conventional Privacy mode of a browser or a VPN cannot conceal. This identification is particularly concerning because it doesn't require the installation of any software or user consent, making it difficult to detect and evade.

Commercially, the practice has reached a mature state: fingerprint.com claims 99.5% accuracy in identifying users with its API in a persistent manner that can last "months or years, even when browsers are updated." Clearing the browser's cache and data has no effect, and the generated "fingerprint" continues to be loaded in different sessions.

How Does Web Fingerprinting Work?

Web fingerprinting is based on a combination of information collected through the user's browser. When a user visits a website, the JavaScript code on the site can collect various information about the browser and the device being used.

In 2021, a team of security researchers from Bundeswehr University Munich conducted an experiment to identify which information can be used in creating web fingerprints. About 40 different types of data were found.

Some of this data is crucial for the user's own experience on a particular site. For example, knowing the browser's language allows a site to appear in the user's preferred language, and information about the time zone is necessary to display the correct time. In contrast, there are data that are irrelevant to the usage context and are certainly used for the sole purpose of gathering the browser's fingerprint. This may include the amount of device memory or a list of plugins installed in your browser, for example.

All this information can then be combined into a unique fingerprint that can be used to track the user across different sites and sessions. According to the results of the Bundeswehr University Munich research, among the top 10,000 sites (ranked by Alexa), the majority of them – nearly 57% – request 7 to 15 different parameters from the user's configuration.

A non-intrusive self-test can be performed on this dedicated page of the Electronic Frontier Foundation. The page uses the fingerprinting services API and lists all identified elements, with technical and detailed explanations for each. It can be surprising to discover how much data a web page, without any installation, can absorb from your device.

Nothing prevents the fingerprinting technique from being combined with other methods, such as cookies or FLoC. Additionally, there is always the risk of data sharing with third parties, such as advertising companies and marketing agencies, to facilitate the creation of detailed user profiles with specific interests, behaviors, and preferences.

Risks of Web Fingerprinting

Privacy Invasion: Web fingerprinting severely compromises user privacy, allowing third parties to collect personal information without the individual's knowledge or consent. The ability to create detailed user profiles can lead to the exposure of sensitive and intimate information, such as consumption habits, political orientation, religious beliefs, and even health issues.
Loss of Anonymity: The browser's fingerprint can be used to correlate activities on different sites, even if the user tries to remain anonymous. Thus, the notion of browsing anonymously on the web is threatened.
Targeted Ads and Segmentation Practices: Advertising companies and advertisers use web fingerprinting to target users with highly personalized ads. This can lead to a sense of privacy invasion, as users may constantly encounter ads reflecting their most recent activities and interests.
Security Threats: The browser's fingerprint can also be exploited by cybercriminals for malicious purposes. They can use this information to create more targeted phishing attacks or engage in fraudulent activities on behalf of the user, compromising their digital security.
Violation of Human Rights and Freedom of Expression: In some countries, web fingerprinting has been used to track political dissidents and activists, putting their freedom and security at risk.

Mitigating Web Fingerprinting Risks

While certain data are impossible to conceal during browsing or useful for the user's experience, it is possible to impact recognition tools and complicate the process with some measures. The conscious user can choose to use:

Privacy-Enhanced Browsers: Some browsers offer privacy protection features, such as tracking blockers and fingerprint protection, like Firefox and Safari.
Tracking Blocking Extensions: Install browser extensions that block tracking and reduce the effectiveness of web fingerprinting, such as Privacy Badger.
VPN (Virtual Private Network): Using a VPN can hide your IP address and make tracking based on this information more difficult.

Conclusion

Web fingerprinting is a real threat to online privacy, allowing third parties to collect personal information without the user's knowledge or consent. This invasive technology poses significant risks to the privacy, security, and freedom of individuals on the web. It is essential for users to be aware of the risks associated with web fingerprinting and take measures to protect their privacy.

However, there is currently no 100% effective technological solution against the practice. Therefore, it is crucial for governments and companies to play a role in protecting user privacy by regulating the use of web fingerprinting and implementing more ethical practices for data collection and usage. Only with joint efforts will it be possible to ensure a safer and more privacy-respecting web for everyone.

eduaardofranco / github-blog