The Effectiveness of a Browser Fingerprint as a Tool for Tracking

Browser fingerprints are derived using information collected about the configuration of a users computer. The permutations are sufficiently distinct that they can be used as a tool for tracking.  Fingerprints, unlike cookies, are more difficult for a user to influence because they cannot be deleted.

The aim of this research was to ascertain whether techniques could be identified to reduce the effectiveness of a fingerprint for tracking. A literary review identified attribute collection techniques and a way to rank them, based on their contribution towards the effectiveness of a fingerprint. This revealed that, as updates were applied to computers, fingerprint attributes changed naturally over time. Researchers pointed out that this had required them to develop algorithms to detect a returning browser fingerprint. This suggests that, in introducing legitimate but unexpected changes, the fingerprint could be more difficult to recognise; thus making it less effective for tracking.

Experiments were designed, using the algorithms as inspiration, to understand if changes could be applied to the fingerprint attribute, without effecting the operation of the browser, and reducing the likelihood of it being recognised as a returning browser. When testing to understand the impact on the operation of the browser, four Internet sites were selected and the highest failure rate observed was 18.7%. To understand if the techniques could be used to alter the fingerprint, tests were conducted. Three out of the four Internet fingerprint sites observed a change for 50% of the tests. One of the sites had the capability to detect a returning browser and in 16.1% of the tests the certainty of a match was reduced to less than 90%. Experiments were then conducted to test the hypothesis, that the match certainty could be reduced by changing multiple attribute elements at the same time. Findings revealed that changing two elements consistently achieved a match certainty of 95%, reducing to less than 85% for six attribute elements.

The research conducted demonstrates that there is potential for techniques to manipulate the fingerprint by altering the attributes and reducing its effectiveness for tracking. However, these findings must be taken in context. The scope of the research was limited by the time available, therefore only the four most popular browsers were used and Internet hosted sites were used as laboratory instruments. This implies that there is an opportunity for further research to expand the scope and build on the experiments that were conducted, as I have outlined in the conclusion.

Download PDF

© Mick Vaites 2018