Recently, I read an article about device fingerprinting, which argues that we’re in the post-tracking-cookie era.  They’re no longer needed, because every browser can be fingerprinted with 100% accuracy.  And the article put this to the test:

From now on, I’ll call you Gentle Orca.

Try refreshing the page. Clear the cookies. Connect to a VPN.

You’re still the Gentle Orca.

Now open it on your phone or some other device and your nickname will be different and just as consistent.

Is it different in incognito? Good. But it’s always the same? Bad news.

And indeed, that works.

There’s an EFF page which allows you to test your device fingerprinting.  I tried Chome, Firefox, and Safari on my Macbook Pro and all of them scored 18.47 bits of identifying information.  According to the tests, “Your browser fingerprint appears to be unique among the 362,288 tested in the past 45 days.”

Is that really unique globally?  I was somewhat surprised.  First, here’s what contributed to that score:

In my case, I’m using very common hardware which is uniform across all models.  Every Macbook Pro has the same System Fonts, for example.  I checked and my score for Chrome, Firefox, and Safari was exactly the same.

The information theory idea is that while there are millions of people who have the same time zone, time zone offset, fonts, etc., it’s the combination of all these things that makes it possible to identify.

The EFF has a page on this, which explains.  After establishing that 33 bits of entropy is needed for identification:

So for instance, if we know someone’s birthday, and we know their ZIP code is 40203, we have 8.51 + 23.81 = 32.32 bits; that’s almost, but perhaps not quite, enough to know who they are: there might be a couple of people who share those characteristics. Add in their gender, that’s 33.32 bits, and we can probably say exactly who the person is.

Ironically, I’m a perfect counter-example to this idea.  When I attended university, I lived next door to a friend who had the exact same birthday in the exact same year.  We were born hours apart, albeit 2,000 miles distant.  However, she was female, so gender would take us over the 33-bit barrier.  So it’s proved…except…I later found that someone I worked with at the U had the same birthday.  He was male.  So there we have a same zip code + same birthday + same gender collision.

Indeed, there were probably more.  In a population of 100,000 people (and there are 20 zip codes in the USA with >= 100,000 people), we’d expect birthdays and genders to be evenly distributed.  So 100,000 / (365 x 2) = 137 pairs in a zip code.

But let’s assume that the EFF page was a little sloppy with their terminology and “birthday” (which to most people means “January 15”) also should include birth year (“January 15, 1980”).  In that case, zip code + full birthday + gender did uniquely identify my friend and I.

However…I don’t know the birth year of the male co-worker.  But it may very well have been the same as mine.  Consider we’re talking about a university town with a large population of students and recent ex-students.  In a large public university, it wouldn’t be unusual for many overlapping birthdays to occur because birth years are going to be the same, and birthdays and genders are random.  In a class of 10,000 students, you’d expect to have 13.7 such identical birthday/gender pairs (and they’d all be sharing the same zip code).

It seems like either 33 bits is a little too low, or perhaps the entropy measurement for zip code + birthday + gender is incorrect.

But for browsers, there’s more factors.  A lot more.  As you can see above, 21 factors went into fingerprinting my browser, and that’s using some EFF test script, not whatever Google’s fleet of PhDs dreamed up.  Conceptually, you can see how the possible population is pared down.  Oh, you have a Mac – that cuts out every Windows and Linux and iOS and Android browser on the planet.  Oh, you’re running. Chrome…slice off every Firefox and Safari user.  Your language is en-us, and you’re in this time zone, and your device has this much memory, and…pretty soon, the number of devices that match all those characteristics is pretty small, before we even get into the nitty-gritty ones like the WebGL fingerprint hash.

And there’s one meta-factor that isn’t listed: IP address.  I use the only device from my IP address that will hit that web site today.  So tracking what I do on that web site is easy, and companies that have a lot of popular web sites with vast advertising farms (say, Google) can easily correlate all that data.

Unfortunately, there isn’t much that can be done at present.  Browsers could do a little more to obfuscate things – the order of things in HTTP accept headers could be randomized, as could the list of fonts – but a lot of the data is genuinely needed (or at least, plausibly could be) by web sites.

raindog308

raindog308 is a longtime community LETizen, technical writer, and self-described techno polymath. With deep roots in the *nix world, he has a passion for systems both modern and vintage, ranging from Unix, Perl, Python, and Golang to shell scripting and mainframe-era operating systems like MVS. He’s equally comfortable with relational database systems, having spent years working with Oracle, PostgreSQL, and MySQL.

As an avid user of LowEndBox providers, raindog308 runs an empire of LEBs, from tiny boxes for VPNs, to mid-sized instances for application hosting, and heavyweight servers for data storage and complex databases. He brings both technical rigor and real-world experience to every piece he writes.

Beyond the command line, raindog308 has a life-long love of German Shepherd Dogs, high-quality knives, target shooting, theology, tabletop RPGs, playing guitar, and hiking in deep, quiet forests.

His goal with every article is to help users, from beginners to seasoned sysadmins, get more value, performance, and enjoyment out of their infrastructure.

You can find him daily in the forums at LowEndTalk under the handle @raindog308.