User tracking on the web via cross-browser fingerprinting

Authors:
Károly Boda;Ádám Máté Földes;Gábor György Gulyás;Sándor Imre
Affiliations:
Department of Telecommunications, Budapest University of Technology and Economics, Budapest, Hungary;Department of Telecommunications, Budapest University of Technology and Economics, Budapest, Hungary;Department of Telecommunications, Budapest University of Technology and Economics, Budapest, Hungary;Department of Telecommunications, Budapest University of Technology and Economics, Budapest, Hungary
Venue:
NordSec'11 Proceedings of the 16th Nordic conference on Information Security Technology for Applications
Year:
2011

Citing 4
Cited 1

A Practical Attack to De-anonymize Social Network Users

SP '10 Proceedings of the 2010 IEEE Symposium on Security and Privacy
How unique is your web browser?

PETS'10 Proceedings of the 10th international conference on Privacy enhancing technologies
BlogCrypt: Private Content Publishing on the Web

SECURWARE '10 Proceedings of the 2010 Fourth International Conference on Emerging Security Information, Systems and Technologies
I Still Know What You Visited Last Summer: Leaking Browsing History via User Interaction and Side Channel Attacks

SP '11 Proceedings of the 2011 IEEE Symposium on Security and Privacy

Dynamic enforcement of knowledge-based security policies using probabilistic abstract interpretation

Journal of Computer Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

The techniques of tracking users through their web browsers have greatly evolved since the birth of the World Wide Web, posing an increasingly significant privacy risk. An important branch of these methods, called fingerprinting, is getting more and more attention, because it does not rely on client-side information storage, in contrast to cookie-like techniques. In this paper, we propose a new, browser-independent fingerprinting method. We have tested it on a data set of almost a thousand records, collected through a publicly accessible test website. We have shown that a part of the IP address, the availability of a specific font set, the time zone, and the screen resolution are enough to uniquely identify most users of the five most popular web browsers, and that user agent strings are fairly effective but fragile identifiers of a browser instance.