Browser Fingerprinting

Cookies are easy to delete and easy to block. Fingerprinting was built for the case where they are not.

How it works

A script on a page can read a long list of mostly stable properties of your browser and machine, and combine them into a short string. The inputs include:

• screen dimensions, colour depth, and available fonts
• installed browser plugins and their versions
• time zone, system language, and locale formatting
• graphics rendering details, exposed through the canvas and WebGL APIs
• hardware concurrency, device memory, and battery status
• touch capability and the maximum number of touch points

Each is individually unremarkable. Concatenated, they produce a value that is stable enough to recognise a returning device.

Why blocking is hard

• It needs no storage. Nothing is written to your device, so clearing cookies and site data does nothing.
• It is a script, not a request. A content blocker can stop known third-party requests. Fingerprinting code frequently runs from the first-party origin, where blocking it breaks the site.
• It is a strong signal in aggregate. A site does not need a stable fingerprint. Combining many weak signals over many visits identifies a device reliably, which is why changes are deliberately made slowly.

What resists it

Uniformity across the population. The strongest defence is being unremarkable: a browser configuration that matches the most common one. This is the approach Firefox implements in privacy.resistFingerprinting, which pins the reported values to a standard set and refuses site-specific overrides. The cost is a small number of sites that misbehave.

Isolation. Reducing the number of distinct identifiers, partitioning storage, and resisting linkable cross-site identifiers all break the aggregation step.

The strongest option: Tor Browser. It fixes the values to what a mainstream browser looks like and gives every user the same values, so there is no long tail to single out. It is the only approach that makes a device genuinely unremarkable rather than merely unusual. See what Tor is.

Measuring it

Cover Your Tracks runs a standard test in your browser and reports how many of the known fingerprinting tests your configuration survives. It is a snapshot of a test suite, not a proof of anything, but it is a useful comparison between configurations.

Sources

• Cover Your Tracks — EFF’s ongoing survey of fingerprinting defences in real browsers.
• Browser Fingerprinting: A Survey — Laperdrix, Bielova, Baudry and Avoine, ACM Transactions on the Web 14(2), article 8, 2020. The survey reference for what the technique is and how it has been measured.
• Mozilla wiki: Fingerprinting — how the resistFingerprinting preference is implemented and what it costs.
• W3C Privacy Principles — the current standards work on reducing identifying information in web requests.