FPFlow: Detect and Prevent Browser Fingerprinting with Dynamic Taint Analysis

Tianyi Li,Xinhui Han,Xiaofeng Zheng,Kaiwen Shen

doi:10.1007/978-981-16-9229-1_4

Abstract

AbstractBrowser fingerprinting is a practical user tracking technology widely adopted by many real-world websites to potentially track users’ browsing behaviors. By collecting information such as screen resolution, user agent, and WebGL rendered data, the tracker can generate a unique identifier for users without their knowledge, leading to a severe violation of user privacy. Therefore, an effective detection and defense technology for browser fingerprinting is needed to protect user privacy. In this paper, we proposed FPFlow, a dynamic JavaScript taint analysis framework to detect and prevent browser fingerprinting. FPFlow monitors the whole process of browser fingerprinting, including collecting information, generating fingerprinting, and sending it to the remote server. We evaluated FPFlow on TRANCO top 10,000 websites. Our experiments showed that our framework could effectively detect browser fingerprints. We found 66.6% of the websites performing fingerprinting and revealed how browser fingerprinting is applied in real-world websites. We also showed that FPFlow could prevent browser fingerprinting with an acceptable overhead.

Highlights

Browser fingerprinting [21] is an online user tracking technique that collects a vector of browser-specific information, such as user agent, screen resolution, and installed browser fonts, etc., to uniquely identify the target browser
We found 66.6% of the websites transmitting browser fingerprinting, which leads to potential browser fingerprinting based tracking
We found that Fetch, SendBeacon, and WebSocket are widely used in fingerprinting scripts, which is not mentioned in previous browser fingerprinting research

Summary

Introduction

Browser fingerprinting [21] is an online user tracking technique that collects a vector of browser-specific information, such as user agent, screen resolution, and installed browser fonts, etc., to uniquely identify the target browser. Previous studies [15,22] showed that the uniqueness of browser fingerprint could be as high as 89.4%. When combining hardware features by performing rendering tasks with HTML Canvas API and WebGL, browser fingerprint can even track users across browsers. Cao et al [12] showed that they could uniquely identify more than 99% of 1,903 devices with 31 WebGL rendering tasks. Browser fingerprinting is widely used in several scenarios, such as personalized content and targeted advertising. Since browser fingerprinting is stateless (does not rely on client-side storage of identifiers), it is hard to detect and mitigate. Even the private mode of browsers cannot prevent browser fingerprinting

Methods

Results

Discussion

Conclusion