DOCSLIB.ORG

Browser Fingerprint Coding Methods Increasing the Effectiveness of User Identification in the Web Traffic

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Browser Fingerprint Coding Methods Increasing the Effectiveness of User Identification in the Web Traffic JAISCR, 2020, Vol. 10, No. 4, pp. 243 – 253 10.2478/jaiscr-2020-0016 BROWSER FINGERPRINT CODING METHODS INCREASING THE EFFECTIVENESS OF USER IDENTIFICATION IN THE WEB TRAFFIC 1, 2 3 Marcin Gabryel ∗, Konrad Grzanek , Yoichi Hayashi 1Department of Computer Engineering, Czestochowa University of Technology, al. Armii Krajowej 36, 42-200 Cze¸stochowa, Poland 2Information Technology Institute, University of Social Sciences, 90 - 113 Lodz Clark University, Worcester, MA 01610, USA 3Department of Computer Science, Meiji University, Japan ∗E-mail: [email protected] Submitted: 14th October 2019; Accepted: 29th April 2020 Abstract Web-based browser fingerprint (or device fingerprint) is a tool used to identify and track user activity in web traffic. It is also used to identify computers that are abusing online advertising and also to prevent credit card fraud. A device fingerprint is created by extract- ing multiple parameter values from a browser API (e.g. operating system type or browser version). The acquired parameter values are then used to create a hash using the hash func- tion. The disadvantage of using this method is too high susceptibility to small, normally occurring changes (e.g. when changing the browser version number or screen resolution). Minor changes in the input values generate a completely different fingerprint hash, mak- ing it impossible to find similar ones in the database. On the other hand, omitting these unstable values when creating a hash, significantly limits the ability of the fingerprint to distinguish between devices. This weak point is commonly exploited by fraudsters who knowingly evade this form of protection by deliberately changing the value of device pa- rameters. The paper presents methods that significantly limit this type of activity. New algorithms for coding and comparing fingerprints are presented, in which the values of parameters with low stability and low entropy are especially taken into account. The fin- gerprint generation methods are based on popular Minhash, the LSH, and autoencoder methods. The effectiveness of coding and comparing each of the presented methods was also examined in comparison with the currently used hash generation method. Authentic data of the devices and browsers of users visiting 186 different websites were collected for the research. Keywords: browser fingerprint, device fingerprint, LSH algorithm, autoencoder 1 Introduction By collecting information about the user, the pages they visit, or their planned purchases, it is possi- The process of identifying the users and their ble to develop a useful profile, for example, when behavior on the Internet is rather commonplace. 244 Marcin Gabryel, Konrad Grzanek, Yoichi Hayashi communicating advertising content to them. The once the browser version is changed, the same user mechanism for user identification is that of storing will be recognized as two different persons. a unique identifier in a cookie on their device [1]. The aim of this paper is to propose new meth- This type of method is widely criticized for the pos- ods of encoding fingerprint browser features and sibility of privacy violation. This problem has been a method of comparing them, taking into account noticed by the European Parliament and for several changes in the values of these features. The paper years now, information about the use of cookies has presents a research project showing the dynamics of had to be placed on websites [2]. However, despite changes taking place in the fingerprint during sub- the obvious need for privacy, unambiguous identi- sequent visits of a given user to the website. The fication of the device or the browser is extremely features will be divided into a group of stable pa- helpful in ensuring security and preventing abusive rameters and a group of unstable ones. This knowl- practices on the Internet. Numerous fraudulent ac- edge will be used to develop two new methods of tivities include credit card payment scams [3], ar- comparing fingerprints: tificial generation of Internet traffic, the so-called abusive traffic [4], generating click fraud [5, 6] or – a new method of hash generation using the Min- automating the collection of web site contents [7]. Hash technique compatible with the LSH algo- Based on various reports [8, 9], losses due to fraud rithm, in online advertising alone can range from 6.5 to 19 billion dollars. Fraud prevention is primarily about – a dedicated neural network with an auto-encoder identifying the perpetrator and blocking their ac- structure to encode the abovementioned two tions. Unfortunately, the HTTP protocol used on groups of fingerprint features. the Internet only allows the user to be identified by The encoding effectiveness of both methods the imperfect cookie mechanism. It is very easy will be experimentally tested using the data ob- to get around it by removing or ignoring cookies. tained over a period of 3 months from 186 different Other methods, such as trying to eliminate fraud by websites. blocking IP numbers of devices, do not give the ex- pected results. One public IP number can be used This paper is organized as follows. Section by multiple users simultaneously. An IP number 2 briefly discusses the related work highlighting can also be assigned dynamically. Connections via the proposed methods: issues connected with the proxy servers or VPN are also common. Hence, browser fingerprint, its practical applications and the best solution is to identify the user with the so- the possibilities offered by neural networks with the called browser fingerprint [10]. autoencoder structure for data encoding. Then, in Section 3, the definition of the browser fingerprint A browser fingerprint is a set of information is given, the characteristics of the features selected about a given browser, device, operating system and for its creation are assessed and their changes over environmental and location settings of the user [11]. time are analyzed. Section 4 discusses the proposed Due to a great variety of this information, finger- algorithms for comparing browser fingerprints. The print can be treated as a unique identifier. Unfortu- research tests showing their effectiveness are pre- nately, the values of the parameters collected may sented in Section 5. Section 6 concludes the paper change over time. This happens when updating the and offers suggestions for future work. browser or operating system version, resizing the screen, installing a new plugin, etc. Once a finger- print has been obtained, on average, it remains valid 2 Related works for several days [12]. That is why developing a way of comparing fingerprints taking into account the In paper [13], it was noticed for the first time changes occurring in them poses a rather demand- that there is a high likelihood of identifying the user ing challenge. Using hash functions to encode and through using various parameters extracted from search for a fingerprint is no longer relevant, as hash the browser being used. However, the scale of the functions generate completely different hash values research at that time remained rather limited. Only for minor input changes, which is particularly un- in the next study [10], where the research was con- desirable in the case of fingerprinting. For example, ducted on a larger number of users, was it shown Marcin Gabryel, Konrad Grzanek, Yoichi Hayashi BROWSER FINGERPRINT CODING METHODS . 245 communicating advertising content to them. The once the browser version is changed, the same user that fingerprinting can become a unique identifier. Methods of detecting fraud on the Internet with mechanism for user identification is that of storing will be recognized as two different persons. Works on browser or device fingerprinting usually the use of deep learning neural networks are also a unique identifier in a cookie on their device [1]. The aim of this paper is to propose new meth- contain comprehensive information on specific fea- one of the subjects of many academic papers. In This type of method is widely criticized for the pos- ods of encoding fingerprint browser features and tures comprising the fingerprint [3, 10, 11, 12, 14]. paper [21], the authors present a method of detect- sibility of privacy violation. This problem has been a method of comparing them, taking into account The studies also focus on the analysis of stability ing credit card fraud. The main contribution of their noticed by the European Parliament and for several changes in the values of these features. The paper of particular parameters [3, 12], examining differ- work is the development of a fraud detection sys- years now, information about the use of cookies has presents a research project showing the dynamics of ent types of browsers [11, 12] or applied security tem that employs a deep learning architecture to- had to be placed on websites [2]. However, despite changes taking place in the fingerprint during sub- features limiting the possibility of obtaining finger- gether with an advanced feature engineering pro- the obvious need for privacy, unambiguous identi- sequent visits of a given user to the website. The print features [12]. There are also analyses of creat- cess based on homogeneity-oriented behavior anal- fication of the device or the browser is extremely features will be divided into a group of stable pa- ing unique fingerprints over the years [15]. Despite ysis. In [22], an ensemble neural network adapted helpful in ensuring security and preventing abusive rameters and a group of unstable ones. This knowl- many recent changes in browsers, browser finger- as a hacking detection system to protect the com- practices on the Internet. Numerous fraudulent ac- edge will be used to develop two new methods of printing is still effective in user identification. The puter system against cyber-attacks is presented. The tivities include credit card payment scams [3], ar- comparing fingerprints: possibilities of creating cross-browser fingerprints presented ensemble neural network consists of an tificial generation of Internet traffic, the so-called when one user uses several browsers on one device autoencoder, a deep belief neural network, a deep abusive traffic [4], generating click fraud [5, 6] or – a new method of hash generation using the Min- are also investigated [16].
Load more

Recommended publications
  • Mining of Massive Datasets
    Mining of Massive Datasets Anand Rajaraman Kosmix, Inc. Jeffrey D. Ullman Stanford Univ. Copyright c 2010, 2011 Anand Rajaraman and Jeffrey D. Ullman ii Preface This book evolved from material developed over several years by Anand Raja- raman and Jeff Ullman for a one-quarter course at Stanford. The course CS345A, titled “Web Mining,” was designed as an advanced graduate course, although it has become accessible and interesting to advanced undergraduates. What the Book Is About At the highest level of description, this book is about data mining. However, it focuses on data mining of very large amounts of data, that is, data so large it does not fit in main memory. Because of the emphasis on size, many of our examples are about the Web or data derived from the Web. Further, the book takes an algorithmic point of view: data mining is about applying algorithms to data, rather than using data to “train” a machine-learning engine of some sort. The principal topics covered are: 1. Distributed file systems and map-reduce as a tool for creating parallel algorithms that succeed on very large amounts of data. 2. Similarity search, including the key techniques of minhashing and locality- sensitive hashing. 3. Data-stream processing and specialized algorithms for dealing with data that arrives so fast it must be processed immediately or lost. 4. The technology of search engines, including Google’s PageRank, link-spam detection, and the hubs-and-authorities approach. 5. Frequent-itemset mining, including association rules, market-baskets, the A-Priori Algorithm and its improvements. 6.
    [Show full text]
  • Linux Administrators Security Guide LASG - 0.1.1
    Linux Administrators Security Guide LASG - 0.1.1 By Kurt Seifried ([email protected]) copyright 1999, All rights reserved. Available at: https://www.seifried.org/lasg/. This document is free for most non commercial uses, the license follows the table of contents, please read it if you have any concerns. If you have any questions email [email protected]. A mailing list is available, send an email to [email protected], with "subscribe lasg-announce" in the body (no quotes) and you will be automatically added. 1 Table of contents License Preface Forward by the author Contributing What this guide is and isn't How to determine what to secure and how to secure it Safe installation of Linux Choosing your install media It ain't over 'til... General concepts, server verses workstations, etc Physical / Boot security Physical access The computer BIOS LILO The Linux kernel Upgrading and compiling the kernel Kernel versions Administrative tools Access Telnet SSH LSH REXEC NSH Slush SSL Telnet Fsh secsh Local YaST sudo Super Remote Webmin Linuxconf COAS 2 System Files /etc/passwd /etc/shadow /etc/groups /etc/gshadow /etc/login.defs /etc/shells /etc/securetty Log files and other forms of monitoring General log security sysklogd / klogd secure-syslog next generation syslog Log monitoring logcheck colorlogs WOTS swatch Kernel logging auditd Shell logging bash Shadow passwords Cracking passwords John the ripper Crack Saltine cracker VCU PAM Software Management RPM dpkg tarballs / tgz Checking file integrity RPM dpkg PGP MD5 Automatic
    [Show full text]
  • Iclab: a Global, Longitudinal Internet Censorship Measurement Platform
    ICLab: A Global, Longitudinal Internet Censorship Measurement Platform Arian Akhavan Niaki∗y Shinyoung Cho∗yz Zachary Weinberg∗x Nguyen Phong Hoangz Abbas Razaghpanahz Nicolas Christinx Phillipa Gilly yUniversity of Massachusetts, Amherst zStony Brook University xCarnegie Mellon University {arian, shicho, phillipa}@cs.umass.edu {shicho, nghoang, arazaghpanah}@cs.stonybrook.edu {zackw, nicolasc}@cmu.edu Abstract—Researchers have studied Internet censorship for remains elusive. We highlight three key challenges that must nearly as long as attempts to censor contents have taken place. be addressed to make progress in this space: Most studies have however been limited to a short period of time and/or a few countries; the few exceptions have traded off detail Challenge 1: Access to Vantage Points. With few ex- for breadth of coverage. Collecting enough data for a compre- ceptions,1 measuring Internet censorship requires access to hensive, global, longitudinal perspective remains challenging. “vantage point” hosts within the region of interest. In this work, we present ICLab, an Internet measurement The simplest way to obtain vantage points is to recruit platform specialized for censorship research. It achieves a new balance between breadth of coverage and detail of measurements, volunteers [37], [43], [73], [80]. Volunteers can run software by using commercial VPNs as vantage points distributed around that performs arbitrary network measurements from each the world. ICLab has been operated continuously since late vantage point, but recruiting more than a few volunteers per 2016. It can currently detect DNS manipulation and TCP packet country and retaining them for long periods is difficult. Further, injection, and overt “block pages” however they are delivered.
    [Show full text]
  • Introduction to Linux and Using CSC Environment Efficiently
    Introduction to Linux and Using CSC Environment Efficiently Introduction UNIX A slow-pace course for absolute UNIX beginners February 10th, 2014 Lecturers (in alphabetical order): Tomasz Malkiewicz Atte Sillanpää Thomas Zwinger Program 09:45 – 10:00 Morning coffee + registration 10:00 – 10:15 Introduction to the course (whereabouts, etc.) 10:15 – 10:45 What is UNIX/Linux: history and basic concepts (multi-user, multi-tasking, multi-processor) 10:45 – 11:15 Linux on my own computer: native installation, dual-boot, virtual appliances 11:15 – 11:45 A first glimpse of the shell: simple navigation, listing, creating/removing files and directories 11:45 – 12:45 lunch 12:45 – 13:00 Text editors: vi and emacs 13:00 – 13:45 File permissions: concepts of users and groups, changing permissions/groups 13:45 – 14:15 Job management: scripts and executables, suspending/killing jobs, monitoring, foreground/background 14:15 – 14:30 coffee break 14:30 – 15:00 Setup of your system: environment variables, aliases, rc-files 15:00 – 15:30 A second look at the shell: finding files and contents, remote operations, text-utils, changing shells 15:30 – 17:00 Troubleshooter: Interactive session to deal with open questions and specific problems Program All topics are presented with interactive demonstrations Additionally, exercises to each of the sections will be provided The Troubleshooter section is meant for personal interaction and is (with a time- limit to 17:00) kept in an open end style Practicalities Keep the name tag visible Lunch is served in the same building.
    [Show full text]
  • Analysis and Evaluation of Email Security
    Al-Azhar University – Gaza Deanship of Postgraduate Studies Faculty of Engineering & Information Technology Master of Computing and Information System Analysis and Evaluation of Email Security Prepared by Mohammed Ahmed Maher Mahmoud Al-Nakhal Supervised by Dr. Ihab Salah Al-Dein Zaqout A Thesis submitted in partial fulfillment of the requirements for the degree of Master of Computing and Information Systems 2018 جامعةةةةةةةةةة ةةةةةةةةةة – غةةةةةةةةةة عمةةةةةةةةةاا لعل اةةةةةةةةةا لع ةةةةةةةةةا ك هلنعا وتكنولوج ا ملع وما ماجسةةةاحل بواةةةم وعلةةةت ملع ومةةةا حتليل وتقييم أمن الربيد اﻹلكرتوني إعداد الباحث حممد أمحد ماهر حممود النخال إشراف الدكتور/ إيهاب صﻻح الدين زقوت قدمت هذه الرسالة استكماﻻً لمتطلبات الحصول على درجة الماجستير في الحوسبة ونظم المعلومات من كلية الهندسة وتكنولوجيا المعلومات – جامعة اﻷزهر – غزة 2018 قَالُوا سُبْحَانَكَ لَا عِلْمَ لَنَا إِلَّا مَا عَلَّمْتَنَا إِنَّكَ أَنْتَ الْعَلِيمُ الْحَكِيمُ صدق اهلل العظيم سورة البقرة ) آية 32( i Dedication To my parents who take my hands and walk me among the ports of life, what is clear in their paths. Thanks to them and hope from Almighty Allah to keep them for me and extend in their age ... To my loving, forgiving and supportive wife who created the atmosphere for me to complete this work. To my brother Mahmoud and sisters Dema and Dania …... To the martyrs of Palestine who fought for the sake of Almighty Allah. ii Acknowledgment The prophet Mohammad (Peace Be Upon Him) says, “He who does not thank people, does not thank Allah “. Completing and issuing such dissertation would not have been possible without the help and support of the people who ably guided this dissertation through the whole process.
    [Show full text]
  • Vmlogin Virtual Multi-Login Browser Instruction Ver
    VMLogin virtual multi-login browser Instruction Ver 1.0 Skype: [email protected] Telegram1: Vmlogin Telegram2: vmlogin_us System Requirements Hardware requirements RAM: 4GB recommended; 1GB available disk space Effective GPU Supported operating systems Although VMLogin supports x86 (32-bit) systems, we recommend using VMLogin on x64 (64-bit) systems. OS supported by VMLogin Windows 10 Windows Server 2016 Windows 7 Windows 8 Software install Users can download the latest software installation package from the official website: vmlogin.us. The version used in this manual is 1.0.3.8. We can start the software installation package program, and the interface for selecting the installation language will be displayed: User can select the software language he likes, and can also change the language in the settings after installation. Currently supports Simplified Chinese and English. After the user select the language, enter the interface for selecting the installation directory: Here is generally installed by default, press the "Next" button, if the user customizes the installation directory, please pay attention to the directory permissions, the current user can edit. Generally, you need to create a desktop shortcut for convenient, we click the "Next" button to continue by default here. At this point we can click the "Install" button to install. We need to wait for the installation progress to complete. At this step, the software installation is complete. Software function 1. Start Software When we start the software, we will see the login interface. New users need to create a new account to log in. 2. Create Account To register as a new user, you need to use email as your account, set a password, and register.
    [Show full text]
  • Device Fingerprinting for Augmenting Web Authentication: Classification and Analysis of Methods
    Device Fingerprinting for Augmenting Web Authentication: Classification and Analysis of Methods Furkan Alaca P.C. van Oorschot School of Computer Science Carleton University, Ottawa, Canada ABSTRACT ing habits [21,2]. In addition, a number of commercial Device fingerprinting is commonly used for tracking users. fraud detection services [38, 57] employ browser-based de- We explore device fingerprinting but in the specific context vice fingerprinting to identify fraudulent transactions. Large of use for augmenting authentication, providing a state-of- web services can mitigate insecure passwords in part by the-art view and analysis. We summarize and classify 29 using server-side intelligence in the authentication process available methods and their properties; define attack models with \multidimensional" authentication [14], wherein con- relevant to augmenting passwords for user authentication; ventional passwords are augmented by multiple implicit sig- and qualitatively compare them based on stability, repeata- nals collected from the user's device without requiring user bility, resource use, client passiveness, difficulty of spoofing, intervention. We explore the applicability of various finger- and distinguishability offered. printing techniques to strengthening web authentication and evaluate them based on the security benefits they provide. CCS Concepts We aim to identify techniques that can improve security, while being ideally invisible to users and compatible with •Security and privacy ! Authentication; Web appli- existing web browsers, thereby imposing zero cost on us- cation security; ability and deployability. We identify and classify 29 available device fingerprint- Keywords ing mechanisms, primarily browser-based and known, but Device fingerprinting, multi-dimensional authentication, pass- including several network-based methods and others not in words, comparative analysis, comparative criteria the literature; identify and assess their properties suitable for application to augment user authentication; define a se- 1.
    [Show full text]
  • Threatmetrix Whitepaper
    Smart Device Identification for Cloud-Based Fraud Prevention Alisdair Faulkner Chief Products Officer White Paper: Smart Device Identification for Cloud-Based Fraud Prevention Contents Basic Device Identification is no longer enough ........ 3 Times have changed but your Device ID hasn’t .......................................................................... 3 Cookies are Obsolete .................................................................................................................. 5 Device Fingerprints Smudge and Fraudsters Wear Gloves ........................................................ 6 Compromised Devices are Commodities .................................................................................... 7 Smart Device Identification Requirements .................................................................................. 8 Smart versus Basic Device Identification Comparison ................................................................ 9 ThreatMetrix Smart Device Identification ................. 11 Identify Fraudsters and Authenticate Customers ...................................................................... 11 Cookieless Device Fingerprinting .............................................................................................. 12 IP, Browser and Packet Fingerprint Interrogation ..................................................................... 13 Real-time complex attribute matching and confidence scoring ................................................. 15 Man-In-The-Middle/Hidden Proxy
    [Show full text]
  • Latexsample-Thesis
    INTEGRAL ESTIMATION IN QUANTUM PHYSICS by Jane Doe A dissertation submitted to the faculty of The University of Utah in partial fulfillment of the requirements for the degree of Doctor of Philosophy Department of Mathematics The University of Utah May 2016 Copyright c Jane Doe 2016 All Rights Reserved The University of Utah Graduate School STATEMENT OF DISSERTATION APPROVAL The dissertation of Jane Doe has been approved by the following supervisory committee members: Cornelius L´anczos , Chair(s) 17 Feb 2016 Date Approved Hans Bethe , Member 17 Feb 2016 Date Approved Niels Bohr , Member 17 Feb 2016 Date Approved Max Born , Member 17 Feb 2016 Date Approved Paul A. M. Dirac , Member 17 Feb 2016 Date Approved by Petrus Marcus Aurelius Featherstone-Hough , Chair/Dean of the Department/College/School of Mathematics and by Alice B. Toklas , Dean of The Graduate School. ABSTRACT Blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah. Blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah. Blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah. Blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah. Blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah. Blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah. Blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah. Blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah.
    [Show full text]
  • Web-Based Fingerprinting Techniques
    Web-based Fingerprinting Techniques V´ıtor Bernardo and Dulce Domingos LaSIGE, Faculdade de Ciencias,ˆ Universidade de Lisboa, Lisboa, Portugal Keywords: Browser Fingerprinting, Cross-browser Fingerprinting, Device Fingerprinting, Privacy, Fingerprint. Abstract: The concept of device fingerprinting is based in the assumption that each electronic device holds a unique set of physical and/or logical features that others can capture and use to differentiate it from the whole. Web-based fingerprinting, a particular case of device fingerprinting, allows website owners to differentiate devices based on the set of information that browsers transmit. Depending on the techniques being used, a website can track a device based on its browser features (browser fingerprinting) or based on system settings (cross-browser fingerprinting). The latter allows identification of the device even when more than one browser is used. Several different works have introduced new techniques over the last years proving that fingerprinting can be done in multiple ways, but there is not a consolidated work gathering all of them. The current work identifies known web-based fingerprinting techniques, categorizing them as which ones are browser and which are cross-browser and showing real examples of the data that can be captured with each technique. The study is synthesized in a taxonomy, which provides a clear separation between techniques, making it easier to identify the threats to security and privacy inherent to each one. 1 INTRODUCTION far more upsetting than simple cookies. In most cases, web-based fingerprinting is used to Device fingerprinting is based on the assumption that track users activity in sites and bind a device finger- no two devices are exactly alike and that profiles can print to a user profile (together with its preferences, be created by capturing the emanation patterns sent tastes and interests).
    [Show full text]
  • The Elephant in the Background: a Quantitative Approach to Empower Users Against Web Browser Fingerprinting
    The Elephant in the Background: A Quantitative Approach to Empower Users Against Web Browser Fingerprinting Anonymous Abstract—Tracking users is a ubiquitous practice in the web Furthermore, other researchers have concentrated their ef- today. User activity is recorded on a large scale and analyzed forts on creating new fingerprinting techniques, e.g. by using by various actors to create personalized products, forecast future canvas [24] and audio objects [30] or via CSS [37]. Others behavior, and prevent online fraud. While so far HTTP cookies have significantly improved known techniques with machine have been the weapon of choice, new and more pervasive learning [42] or by extracting fingerprinting features more techniques such as browser fingerprinting are gaining traction. passively via extension activity tracking [36]. Hence, in this paper, we describe how users can be empowered against JavaScript fingerprinting by showing them when, how, The sheer diversity of fingerprinting techniques available and who is tracking them. To this end, we conduct a systematic analysis of various JavaScript fingerprinting tools. Based on this to us begs the question of which techniques are really being analysis, we design and develop FPMON: a light-weight and used and which ones are not? So far, large scale studies have comprehensive fingerprinting monitor that measures and rates only uncovered specific instances of fingerprinting and these JavaScript fingerprinting activity on any given website in real- are over 5-10 years old [1,2]. In particular, we currently lack time. Using FPMON, we evaluate the Alexa 10k most popular a comprehensive view of fingerprinting activity on the web websites to i) study the pervasiveness of JavaScript fingerprinting; today.
    [Show full text]
  • Browser Extension and Login-Leak Experiment
    BROWSER EXTENSION AND LOGIN-LEAK EXPERIMENT IPEN 2017, Vienna Joint work with Nataliia Bielova, Claude Castelluccia Gábor György Gulyás Privatics Team, INRIA http://gulyas.info // @GulyasGG USER TRACKING ON THE WEB 17-06-09 © Gábor György Gulyás 2 The „de-facto” busniess model of the web Advertiser ID=967 User Apples on sale! ID=967 cnn.com 17-06-09 © Gábor György Gulyás 3 Storing the identifier on the client side • Cookies • E-tags – Flash • Last-mod timestamps – HTML5 • HTTP authentication • Caching in files of • HTTP 301 redirect – JavaScript • HSTS caches – CSS – Images (pixel-level) … 17-06-09 © Gábor György Gulyás 4 Browser fingerprinting appears (2010-2012) [3] http://panopticlick.eff.org https://fingerprint.pet-portal.eu • Browser fingerprint • Cross-browser fingp. – Flash/Java required – Device fingerprint (for 95% uniqueness) – No plugins, just JS – Browser dependent – Concept appears later in the wild 17-06-09 © Gábor György Gulyás 5 Fingerprinting penetration (2013-2016) 2013: Alexa TOP 10k. • 20 pages deep • 0,4% adoption (40 sites) • Skype.com, porn and dating • 3 804 less popular sites are tracked Nickiforakis et al.: Cookieless monster: Exploring the ecosystem of web-based device fingerprinting (2013) 2016: Alexa TOP 1M. S. Englehardt, A. Narayanan: Online tracking: A 1-illion-site measurement and analysis (2016) 17-06-09 © Gábor György Gulyás 6 Behavioral fingerprinting You are what you install to you computer? Fonts are good indicators of what is installed. Boda et al.: User Tracking on the Web via Cross-Browser Fingerprinting (2011) Google.com Youtube.com Facebook.com Baidu.com The list of the sites you have Yahoo.com Wikipedia.org visited also describe you well.
    [Show full text]