Secret trackingWeb sites secretly track users without relying on cookies
Device fingerprinting, also known as browser fingerprinting, is the practice of collecting properties of PCs, smartphones, and tablets to identify and track users. For the vast majority of browsers, the combination of these properties is unique, and thus functions as a “fingerprint” that can be used to track users without relying on cookies. Researchers have discovered that 145 of the Internet’s 10,000 top Web sites use device fingerprinting to track users without their knowledge or consent.
This is the first comprehensive effort to measure the prevalence of device fingerprinting on the Internet. The team of KU Leuven-iMinds researchers analyzed the Internet’s top 10,000 Web sites and discovered that 145 of them (almost 1.5 percent) use Flash-based fingerprinting. Some Flash objects included questionable techniques such as revealing a user’s original IP address when visiting a Web site through a third party (a so-called proxy).
Do Not Track
The researchers identified a total of sixteen new providers of device fingerprinting, only one of which had been identified in prior research. In another surprising finding, the researchers found that users are tracked by these device fingerprinting technologies even if they explicitly request not to be tracked by enabling the Do Not Track (DNT) HTTP header.
The researchers also evaluated Tor Browser and Firegloves, two privacy-enhancing tools offering fingerprinting resistance. New vulnerabilities — some of which give access to users’ identity — were identified.
The release notes that device fingerprinting can be used for various security-related tasks, including fraud detection, protection against account hijacking, and anti-bot and anti-scraping services. It is also being used, however, for analytics and marketing purposes via fingerprinting scripts hidden in advertising banners and Web widgets.
To detect Web sites using device fingerprinting technologies, the researchers developed a tool called FPDetective. The tool crawls and analyses Web sites for suspicious scripts. This tool will be freely available at FPDetective Web site for other researchers to use and build upon.
The findings will be presented at the 20th ACM Conference on Computer and Communications Security, Berlin, 4-8 November 2013.
— Read more in Gunes Acar et al., “FPDetective: Dusting the Web for Fingerprinters” (paper to be presented at the 20th ACM Conference on Computer and Communications Security, Berlin, 4-8 November 2013)