Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting

By Nick Nikiforakis, A. Kapravelos, Wouter Joosen, Christopher Krügel, Frank Piessens, Giovanni Vigna. IEEE Symposium on Security and Privacy, 2013

504 citations recorded by the source corpus.

The web has become an essential part of our society and is currently the main medium of information delivery. Billions of users browse the web on a daily basis, and there are single websites that have reached over one billion user accounts. In this environment, the ability to track users and their online habits can be very lucrative for advertising companies, yet very intrusive for the privacy of users. In this paper, we examine how web-based device fingerprinting currently works on the Internet. By analyzing the code of three popular browser-fingerprinting code providers, we reveal the techniques that allow websites to track users without the need of client-side identifiers. Among these techniques, we show how current commercial fingerprinting approaches use questionable practices, such as the circumvention of HTTP proxies to discover a user's real IP address and the installation of intrusive browser plugins. At the same time, we show how fragile the browser ecosystem is against fingerprinting through the use of novel browser-identifying techniques. With so many different vendors involved in browser development, we demonstrate how one can use diversions in the browsers' implementation to distinguish successfully not only the browser-family, but also specific major and minor versions. Browser extensions that help users spoof the user-agent of their browsers are also evaluated. We show that current commercial approaches can bypass the extensions, and, in addition, take advantage of their shortcomings by using them as additional fingerprinting features.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/8def6612f19323144d4bfa06accc05dd0601656b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

AccelPrint: Imperfections of Accelerometers Make Smartphones Trackable (2014, background): “Commercial advertising companies, such as BlueCava and Iovation, have already started to identify devices and link users based on browser configuration, screen resolution [47], etc.”
Online Tracking: A 1-million-site Measurement and Analysis (2016, background): “New ﬁngerprinting techniques are continually discovered [25, 31, 14], and are subsequently used to track users on the web [29, 2, 1].”
The Long-Standing Privacy Debate: Mobile Websites vs Mobile Apps (2017, background): “[41, 14, 2, 28, 6, 15], when some of them propose also countermeasures [27, 42, 40].”
FPDetective: dusting the web for fingerprinters (2013, methodology): “In general, while these methods have not yet been encountered in deployed fingerprinting products [18], they could potentially be used to increase the accuracy of the gathered fingerprints.”