The fingerprint dilemma

Browser fingerprinting

Websites can recognise a browser without using cookies. A website can collect information exposed by the browser such as the type of computer, operating system, browser version, installed fonts, language, screen resolution, graphics hardware, time zone and many other technical details.

This information is not necessarily unique on its own, but combined it can assemble a browser fingerprint which can be used to recognise that same browser again.

There are two general approaches to reducing browser fingerprinting - and they can be combined to different degrees.

Approach 1 - Standardisation

This approach makes every browser environment identical.

Every session starts from the same operating system, browser, installed fonts, language, screen resolution and configuration.

A complete copy of one virtual computer should look like every other copy.

Producing identical browser fingerprints across different physical devices is technically possible.

This means that even though different physical devices are used, the virtual computers are identical, as are their browser fingerprints.

Having the same browser fingerprint means it is no longer possible to distinguish one user from another within that shared browser environment.

On the other hand, the fingerprint can be traced back to that same shared environment.

You can read more and try the experiment yourself here:

Data collection – Beyond cookies

Approach 2 - Randomisation

Instead of making browsers identical, one could take the opposite approach and randomly change some of the information available about the browser's characteristics.

This means that the resulting fingerprints do not reflect the true characteristics of the browser.

At first glance, this appears to solve the problem.

Which fingerprint are we actually measuring?

The dilemma

Fingerprints — the information that is collected — vary between different fingerprinting systems.

Different browser characteristics are collected for different purposes. Hence, public testing sites, advertising platforms, fraud detection systems and analytics providers may all observe different signals.

They may also combine this with IP addresses, cookies, account information and browsing behaviour.

A public fingerprinting test can therefore prove only one thing: its own measurement changed. It cannot prove what another fingerprinting system observes.

Randomisation also creates a problem. If browsers randomise only a known set of characteristics, trackers can reduce the importance of those characteristics and instead rely on values that remain stable.

The real question then becomes not whether values change, but whether the values that matter to the tracker change.

Because tracking systems generally do not publish exactly how they identify users, this is difficult to verify.

Measuring fingerprint protection

To evaluate how well masked a fingerprint is, we would have to start with a browser environment that is identical.

This standardisation should first be verified using several independent fingerprinting tests. Randomisation can then be enabled. Then we would check:

• Which characteristics remain identical?
• Which characteristics are randomised?
• Which fingerprinting tests are affected?
• Which tests still report the same fingerprint?
• Are we changing information that actually matters?

This turns fingerprint protection into something that can be evaluated experimentally instead of assumed.

What can be proven?

We have demonstrated that identical browser environments can produce the same observable fingerprint across different physical devices.

We have also demonstrated that selected browser characteristics change when they are randomised.

What remains much more difficult is demonstrating that those changes prevent recognition by unknown fingerprinting systems using unknown combinations of signals.

The challenge is therefore not only to change a browser fingerprint, but to demonstrate that the change actually prevents identification.

Conclusion

The first problem is preventing identification.

The second is demonstrating that identification has actually been prevented.

The first problem has received considerable attention. The second has received remarkably little.

If this reasoning is flawed or overlooks important previous work, I would genuinely appreciate your feedback: info@encuro.se.

Try the tests yourself

No single fingerprinting test tells the whole story. These tools expose different parts of the information available to websites: