Browser Fingerprinting: A survey

1 INTRODUCTION

• The web’s growing diversity of devices and evolving browser technologies make fingerprinting possible, while its roots in the web’s origins preclude a simple patch.Source: §1 · p. 1

1.1 Definition

• Browser fingerprinting collects device information through browser APIs and HTTP headers to build a device fingerprint, without storing an identifier in the browser.The fingerprint can span hardware, operating system, browser, and configuration; most APIs are freely accessible to JavaScript.Source: §1.1 · p. 1
• The survey excludes identification through smartphone apps, network-packet structure, IP addresses, and geolocation, focusing on information available through a web browser.The paper notes that IP address and geolocation can complement a fingerprint but are outside its focus.Source: §1.1 · p. 2

1.2 Contributions

• The paper aims to provide newcomers an accessible entry point and foundations for future research by identifying unresolved challenges.Source: §1.2 · p. 2
• Its contributions include surveying fingerprint uniqueness and adoption, reviewing research and industry uses, classifying defenses and their trade-offs, and discussing current challenges.Source: §1.2 · p. 2

1.3 Organization

• The paper organizes its discussion into browser history, fingerprinting research, defenses, uses and challenges, and a conclusion.Source: §1.3 · p. 2

2 A BRIEF HISTORY OF WEB BROWSERS

• The web began with a device-agnostic goal, but browsers and platforms did not uniformly support evolving additions, sometimes implementing only subsets or proprietary features.This incompatibility led to “Best viewed with X” banners.Source: §2.1 · pp. 2–3

2.1 Indicating browser limitations with the user-agent header

• The User-Agent request header was introduced to prevent incompatibility by declaring browser name, version, and sometimes platform, but copied compatibility strings made it complex.The example header includes strings for other layout engines as well as the relevant platform and browser version.Source: §2.1 · p. 3

2.2 Bridging the gap between web browsers and native software applications

• JavaScript’s addition to Netscape Navigator made pages dynamic, and browser integration with the platform exposed environmental information such as the device timezone.The language was standardized as ECMAScript in 1997.Source: §2.2 · p. 3

2.3 The development of modern APIs

• Modern browsers became rich multimedia platforms as standards added APIs for graphics and audio, communications, positioning, and performance, alongside browser extensions.Examples include Canvas, WebGL, Web Audio, WebRTC, Geolocation, and WebAssembly.Source: §2.3 · pp. 3–4

3 BROWSER FINGERPRINTING

• The section frames its survey around where browser fingerprinting stems from, how effective it is, how techniques are evaluated, and how widespread it is online.Source: §3 · p. 4
• Its stated aim is a thorough survey of research in the domain, including a summary of current techniques.Source: §3 · p. 4
• The survey’s questions include both the origins of fingerprinting and its adoption across the web.Source: §3 · p. 4

3.1 Discovery of browser fingerprinting

• 96.23% of 1,328 clients were uniquely identified in Mayer’s experiment using navigator, screen, plugins, and MIME types.Mayer cautioned that the small study did not support a more general conclusion.Source: §3.1 · p. 4
• 83.6% of 470,161 Panopticlick fingerprints were unique, rising to 94.2% when users had Flash or Java enabled; the study established fingerprinting at large scale.The additional plugins provided device information; a device with an uncommon configuration could be identified online.Source: §3.1 · p. 4
• Panopticlick collected 470,161 fingerprints over two weeks, providing a more precise picture of web device diversity than Mayer’s smaller experiment.Source: §3.1 · p. 4

3.2.2 Adding new attributes.

• Canvas and WebGL rendering expose device differences; canvas studies reported 50 renderings among 300 samples and 50 distinct WebGL renders among 270 samples.Online canvas scripts also exploit fallback fonts to increase device differences. AudioContext fingerprinting was found on only a very small number of websites.Source: §3.2.2 · pp. 5–6
• Cao et al. uniquely identified more than 99% of 1,903 tested devices using 31 WebGL rendering tasks.The tasks tested selected computer-graphics parameters to extract device features.Source: §3.2.2 · p. 6
• Gulyás et al. found 39.29% of 7,643 Chrome users unique from detected extensions, with 485 carefully chosen extensions achieving the same uniqueness.Their study involved 16,393 participants and detected 16,743 Chrome extensions.Source: §3.2.2 · p. 6
• Extension fingerprinting uses accessible resources, page side effects, or timing; detected extension bloat appeared in 5.7% of 58,034 extensions, and 61% of those with bloat were uniquely identifiable.In a separate study, 9% of the 10,000 most popular Chrome extensions produced detectable DOM changes on any domain, and 16.6% on popular domains.Source: §3.2.2 · pp. 6–7
• JavaScript-engine and CSS differences can identify browser versions or families, while font rendering and system properties provide further device-specific signals.Muzanni et al. derived a minimal test suite from more than 150 browser and operating-system combinations; Fifield et al. reduced glyph tests to 43 characters while retaining their reported identification result.Source: §3.2.2 · p. 7
• Mowery et al. detected browser and version with 79.8% accuracy using 39 JavaScript tests, but the full suite took 190.8 seconds.Benchmark readings can fluctuate because of background processes, complicating interpretation; GPU tests can also distinguish devices [102].Source: §3.2.2 · pp. 7–8
• Battery Status readings can support short-term cross-site identification and battery-capacity inference, prompting some browser vendors to remove the API or spoof its information.The API exposes charging status, level, and remaining charge or discharge time.Source: §3.2.2 · p. 8
• Fingerprint evolution varies by device and use: FP-Stalker tracked devices for 51.8 days on average, and 26% for more than 100 days.At least one fingerprint change appeared in 45.52% of devices after one day, while some took several weeks to change.Source: §3.2.2 · pp. 8–9

3.3.1 Evaluating fingerprinting techniques.

• Entropy quantifies identifying information in a fingerprint; higher entropy means greater uniqueness and identifiability.Shannon entropy is measured in bits with b = 2, and each bit halves an event’s probability.Source: §3.3.1 · p. 9
• Normalized Shannon entropy enables comparisons across differently sized datasets by relating attribute uniqueness to the maximum entropy for the dataset.Anonymity sets show how devices sharing identical values cluster and can compare protection with and without a defense.Source: §3.3.1 · p. 9

3.3.2 Large scale studies.

• AmIUnique found plugins and fonts had ceded prominence to canvas fingerprinting, while HTTP headers and canvas helped identify mobile browsers.The study also found generic HTTP headers or removing plugins reduced desktop fingerprint uniqueness by 36%.Source: §3.3.2 · p. 10
• 33.6% of fingerprints were unique in Hiding in the Crowd, versus 83.6% in Panopticlick and 89.4% in AmIUnique.The studies also reported 18.5% unique mobile fingerprints in Hiding in the Crowd, compared with 81% in AmIUnique.Source: §3.3.2 · p. 10
• Hiding in the Crowd attributed its lower uniqueness rate to a much larger dataset from a commercial site targeting a more global audience.The study found desktop uniqueness arose mostly from combinations of attributes, while mobile devices presented attributes with unique values.Source: §3.3.2 · p. 10

Adoption studies

• Earlier studies found 40 of the Alexa top 10,000 sites using three companies’ scripts, 404 of one million using JavaScript font probing, and 5,542 of 100,000 using canvas fingerprinting.The Cookieless Monster study searched for scripts from BlueCava, Iovation, and ThreatMetrix; later studies intercepted browser calls or properties.Source: §3.4 · p. 11
• 14,371 of one million sites performed canvas fingerprinting, compared with 3,250 for canvas font, 715 for WebRTC, and 67 for AudioContext.OpenWPM instrumented many JavaScript objects and built detection criteria for known techniques.Source: §3.4 · p. 12
• 6,876 of the top Majestic 10,000 websites (68.8%) were classified as fingerprinting under a definition counting any one of 17 attributes in browser-sent payloads.84.5% of those sites were third parties, and the authors identified 284 usable attributes.Source: §3.4 · p. 12

Challenges in measuring adoption

• Fingerprinting detection is difficult because accessing device attributes or making many Canvas calls can also support legitimate page behavior.Similar script content can serve different purposes, so classification rules can produce widely differing adoption estimates.Source: §3.4 · pp. 12–13

Detecting fingerprinting scripts

• Researchers use clues including access to device-specific APIs, repeated calls, aggregation, hashing, ID creation, and sending data remotely.No single clue is conclusive: repeated API calls may reflect ordinary use or probing, and scripts may be minified or obfuscated.Source: §3.4 · p. 13

Challenges in measuring adoption

• Fingerprinting scripts may be hard to identify because obfuscation can conceal their purpose, and many are not blocked by popular privacy tools.The number of actors may therefore be higher than large crawls report.Source: §3.4 · pp. 13–14

4 DEFENSE TECHNIQUES

• No defense can prevent fingerprinting while keeping the richness of a modern browser, so protection requires balancing privacy and usability.NoScript and Tor Browser are cited as examples of strong protection that can come at a usability cost.Source: §4 · p. 14
• A defense can lose effectiveness when modified attributes do not match, making users more visible to trackers.Browsers change and new APIs appear frequently, so a solution may become ineffective within months.Source: §4 · p. 14

4.1.1 Modifying the content of fingerprints.

• Changing fingerprint values or increasing their diversity aims to undermine the stability third parties use to link fingerprints to a device.The section describes both randomized values and pre-defined replacements as ways to make collected fingerprints different and unstable.Source: §4.1.1 · pp. 14, 16
• DCB varies browser configurations, PriVaricator uses conditional randomization policies, and Blink assembles coherent sets of real components.PriVaricator’s policies specify attribute changes and when they apply; Blink’s real components avoid mismatches between attributes.Source: §4.1.1 · pp. 16–17
• CloakX diversifies extension behavior and resource paths, while Canvas and AudioContext defenses can introduce noise into rendered outputs.Canvas Defender modifies pixel RGB values after rendering, whereas DCB modifies canvas rendering functions and maintains consistency within a browsing session.Source: §4.1.1 · p. 17
• FPRandom targets canvas, AudioContext, and JavaScript-property-order fingerprinting by adding browser non-determinism to reduce fingerprintable behaviors.The authors modified Firefox’s source code for these targets.Source: §4.1.1 · p. 17
• Attribute mismatches can make users more visible, and FP-Scanner can detect modifications and sometimes reveal the original value; detection alone does not establish easier tracking.Browser evolution and overlooked details also make these defenses difficult to maintain and can render implementations ineffective.Source: §4.1.1 · pp. 16–18

4.1.2 Changing browsers.

• Switching browsers may decorrelate browsing profiles, but OS- and hardware-specific attributes can still identify a device across browsers.The cited studies used fonts, timezone, screen resolution, and WebGL tasks; both datasets were described as relatively small.Source: §4.1.2 · p. 18
• Cross-browser fingerprinting can identify devices from OS and hardware data, although real-world deployment may be constrained by execution time.The cited studies used 989 users and 1,903 users, respectively, and the authors call for larger-scale evaluation.Source: §4.1.2 · p. 18

4.2.1 The Tor Browser.

• Tor Browser blocks Canvas and WebGL, removes plugins, standardizes fonts, and modifies user-agent and HTTP headers to reduce fingerprint differences.Its design document lists 24 modifications, including these measures.Source: §4.2.1 · p. 18
• 3.67% of the top 1,000 Alexa sites blocked or degraded service to Tor users, whose browser can be distinguished using its user-agent, screen resolution, and known exit-node IP addresses.The cited study reports this browsing-experience impact; the passage also notes that an unusual screen resolution may distinguish a user.Source: §4.2.1 · p. 19
• Tor Browser’s uniform fingerprint strategy aims to make users share one fingerprint, but deviations from the common default can make users more visible.Its known fingerprint and remaining differences, including screen resolution and operating system, can distinguish users from the broader Tor pool.Source: §4.2.1 · pp. 18–19
• Firefox’s fingerprinting resistance incorporates Tor-like changes, including blocking Canvas and modifying user-agent, timezone, and screen resolution.The resistance can be activated with the privacy.resistFingerprinting flag, and its development was ongoing in the paper’s account.Source: §4.2.1 · p. 19

4.2.2 UniGL.

• UniGL attributes WebGL rendering differences to floating-point operations across graphics layers and redefines GLSL/WebGL operations to make rendering uniform.Devices running UniGL expose the same WebGL fingerprint for a given rendering task.Source: §4.2.2 · p. 20
• UniGL achieves software-only uniformity that can be deployed without modifying or updating hardware.The approach identifies the source of rendering discrepancies and removes those differences in software.Source: §4.2.2 · p. 20

4.3 Decreasing the surface of browser APIs

• Disabling JavaScript broadly can leave the web static and break logins, while NoScript’s whitelist can be difficult to manage and may lead users to authorize fingerprinting scripts.Users may struggle to distinguish scripts needed for correct page display from unwanted third-party scripts.Source: §4.3 · p. 20
• Curated-list blockers can leave users exposed while newly detected scripts await identification and blocking.The passage describes Adblock Plus, Ghostery, uBlock Origin, and Disconnect as examples of this approach.Source: §4.3 · p. 20
• Cliqz’s approach uses collective reports to treat commonly reported data elements as safe when they cannot uniquely identify a user or group.Users report unsafe elements to a central server, where sufficiently repeated values are considered safe.Source: §4.3 · p. 20
• Privacy Badger builds blocking rules locally as users browse, but its heuristics can be overly aggressive and leave websites unresponsive.Its blocked-script list is specific to each extension instance.Source: §4.3 · p. 20
• Latex Gloves restricts extension-resource access through whitelists and rewrites manifests to limit where extensions run, but users must maintain the whitelists.The restrictions address probing and revelation attacks.Source: §4.3 · pp. 20–21
• Disabling browser functions or APIs, including Canvas and WebGL, prevents scripts from collecting values through those interfaces.The section gives CanvasBlocker, Tor Browser, and Brave as examples.Source: §4.3 · p. 21

4.4 Summary

• No defense is ultimate because browser fingerprinting is rooted in web evolution, and privacy protections must balance privacy with usability.A misstep can render a protective solution useless.Source: §4.4 · p. 21
• For 24 of 26 evaluated anti-fingerprinting tools, protection was so marginal that it made almost no difference, while a more popular tool may help users blend into a larger pool.The evaluation cautions that not all defenses perform equally.Source: §4.4 · p. 21
• Browser vendors were introducing fingerprinting protections, but the survey says the impact of these defenses remained hard to assess amid continuing web evolution.The passage cites developments by Brave, Apple, Mozilla, and Google.Source: §4.4 · p. 21

5.1.1 Web Tracking.

• Silent fingerprint collection across websites can correlate users’ activity across sessions, identify devices without cookies or IP addresses, and help regenerate deleted cookies when paired with a fixed IP.VPNs mask IP addresses but do not change browser information.Source: §5.1.1 · p. 22

5.1.2 Identifying device vulnerabilities.

• Attackers can cross-reference installed components with vulnerability databases to target devices; malicious ads have used fingerprinting to select vulnerable devices for exploit kits.The authors also describe fingerprinting as a way to identify outdated components so administrators can deploy patches quickly.Source: §5.1.2 · p. 22, §5.1.3 · p. 22

5.1.4 Bot and fraud prevention.

• Fingerprint consistency checks can help detect bots and fraud, while fingerprint-based login checks can reinforce accounts but must account for device changes.Canvas-based challenge-response proposals are described as additions to multi-factor authentication, not standalone authentication.Source: §5.1.4 · p. 23, §5.1.5 · pp. 23–24

5.1.5 Augmented authentication.

• Research on constructive uses of fingerprinting is described as extremely thin, limiting the evidence base for its security benefits.The section discusses patching, fraud prevention, and augmented authentication as positive uses.Source: §5.1.3 · p. 22, §5.1.5 · pp. 23–24, §5.1.4 · p. 23

5.2.1 Arms-race between new fingerprinting methods and protection mechanisms.

• The tracking debate is unsettled: browser defenses are expanding while ad-industry initiatives offer competing directions, and researchers must inform defensive decisions without promoting aggressive use.The authors argue that studying fingerprinting can reveal threats and support defenses, while cautioning against making the technology more effective for attackers.Source: §5.2.1 · pp. 24–25

5.2.2 How to effectively measure uniqueness of fingerprints?

• Uniqueness estimates may vary with the population studied, and long data-collection periods can make comparisons unreliable as browsers and APIs change.The paper notes limited study of dataset-size effects and says fingerprint tracking may be more nuanced than current reports suggest.Source: §5.2.2 · p. 25

5.2.3 How to detect fingerprinting and measure its adoption?

• Researchers cannot reliably count fingerprinting sites from API access alone because similar script behavior may serve benign functions or identify devices; dynamic information-flow analysis is needed.Source: §5.2.3 · p. 25

5.2.4 A constant need to monitor for security and privacy issues of new browser APIs.

• Fingerprinting changes as browser APIs are added, modified, or removed, while legal compliance is hard to verify because both fingerprinting activity and its purpose are difficult to detect.The cited European guidance distinguishes tracking and profiling from certain security and authentication uses when determining consent requirements.Source: §5.2.4 · p. 25, §5.2.5 · p. 26

• Browser diversity gave rise to fingerprinting, which collects information about a device’s configuration and composition.Source: §6 · p. 26
• Fingerprinting has real-world implications for businesses, research, regulation, and people who rely on confidential communications.The authors note that browser APIs, including the Battery API, can raise privacy concerns.Source: §6 · pp. 26–27
• The survey finds many open challenges and presents a basis for further study, while noting that fingerprinting-based solutions may improve online security.Source: §6 · p. 27