![Page 1: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/1.jpg)
Mitigating Browser Fingerprint Tracking: Multi-level Reconfiguration and Diversification
Pierre Laperdrix, Walter Rudametkin, Benoit BaudrySeams – May, 19th 2015
![Page 2: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/2.jpg)
Table of contents
1) What is fingerprint-based tracking?
2) Presentation of Blink
3) Experimental validation
4) Conclusion and perspectives
2/23
![Page 3: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/3.jpg)
Device fingerprinting
• Successor of cookies
• Side-effect of software diversity
• Collection of information on the device
Browser
Operating system
Hardware
3/23
![Page 4: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/4.jpg)
4/23
![Page 5: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/5.jpg)
Example of a fingerprintAttribute Value
User agent Mozilla/5.0 (X11; Linux i686; rv:25.0) Gecko/20100101 Firefox/25.0
HTTP accept text/html, application/xhtml+xml, application/xml;q=0.9,*/*;q=0.8 gzip, deflate en-US,en;q=0.5
Plugins Plugin 0: QuickTime Plug-in 7.6.6; libtotem-narrowspace-plugin.so; Plugin 1: Shockwave Flash; Shockwave Flash 11.2 r202; libflashplayer.so;
Fonts Century Schoolbook, Source Sans Pro Light, DejaVu Sans Mono, Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ...
HTTP DoNotTrack 1
Cookies enabled Yes
Platform Linux i686
OS Linux 3.14.3-200.fc20.x86 32-bit
Screen resolution 1920x1080x24
Timezone -480
DOM Session storage Yes
DOM Local storage Yes
I.E. User data No5/23
![Page 6: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/6.jpg)
How unique are we?
• 83.6% of unique fingerprints
• 86.4% of unique fingerprints
Browser
Timezone
Screen resolution
OS
Fonts
Plugins
6/23
Am I Unique?
![Page 7: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/7.jpg)
How unique are we?
• 83.6% of unique fingerprints
• 86.4% of unique fingerprints
6/23
Am I Unique?
We can be tracked!
![Page 8: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/8.jpg)
Amazon
How widespread is fingerprinting?
7/23
Advertising companies
![Page 9: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/9.jpg)
Device fingerprinting
• Silent
• Complement usage of cookies
• Hard to detect and block fingerprinting scripts
• Already adopted by major web actors
• Track users without their knowledge
• Real privacy problem
8/23
![Page 10: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/10.jpg)
Table of contents
1) What is fingerprint-based tracking?
2) Presentation of Blink
3) Experimental validation
4) Conclusion and perspectives
9/23
![Page 11: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/11.jpg)
Properties of a fingerprint
• Uniqueness: we can precisely identify a device thanks to its unique combination of features
• Stability: a fingerprint does not drastically change over time
• These two properties combined are the source of a real privacy problem.
10/23
![Page 12: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/12.jpg)
Blink
• Increase temporal diversity of fingerprints.
• Reconfigure platform at runtime.
• Browsing without Blink
• Browsing with Blink
11/23
![Page 13: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/13.jpg)
Browsing platform
12/23
Browsing platform
Hardware componentsCPU microphone
network…
Software componentsplugins fonts
OS browser…
Configuration parametersscree res. language
timezone…
Dynamic attributes
canvas
…
Fingerprint
fonts (name)
plugins (name and version)
user agent
accept header
…
exhibits
Diversifiable
elements
![Page 14: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/14.jpg)
Browsing platform
13/23
![Page 15: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/15.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2
VM2 VM3
Plugins Fonts
UF1
UF2
User Profile
![Page 16: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/16.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2
VM2
VM3
Plugins Fonts
UF1
UF2
User Profile
![Page 17: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/17.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2
VM2
VM3
Plugins Fonts
UF1
UF2
User Profile
![Page 18: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/18.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2
VM2
VM3
Plugins Fonts
UF1
UF2
User Profile
![Page 19: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/19.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2VM2
VM3
Plugins Fonts
UF1
UF2
User Profile
![Page 20: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/20.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2VM2
VM3
Plugins Fonts
UF1
UF2
User Profile
![Page 21: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/21.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2VM2
VM3
Plugins Fonts
UF1
UF2User Profile
![Page 22: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/22.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2VM2
VM3
Plugins Fonts
UF1
UF2
User Profile
![Page 23: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/23.jpg)
Browsing platform
Blink’s generation process
Host machine
OS Browser
14/23
UP1
UP2
Browsers Plugins Fonts
OS
Diversity reservoir
VM1
B3
B1
B4
B2
P3
P1
P4
P2
F3
F1
F4
F2
VM2 VM3
Plugins Fonts
UF1
UF2
User Profile
![Page 24: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/24.jpg)
Table of contents
1) What is fingerprint-based tracking?
2) Presentation of Blink
3) Experimental validation
4) Conclusion and perspectives
15/23
![Page 25: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/25.jpg)
Objectives
1. Does dynamic reconfiguration break fingerprint stability?
2. What is the impact of the user’s plugins and fonts on global diversity?
Requirements
• A fingerprinting script
• A metric to quantify the difference between two synthesized platforms
16/23
![Page 26: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/26.jpg)
Synthesized b. p.Initial situation n°1
User browsing platform
Experimental protocol
17/23
OS browser
plugins fonts1 plugin 20 fonts
20 fonts1 plugin
Synthesized b. p.Initial situation n°25
User browsing platformOS browser
plugins fonts25 plugins 500 fonts
500 fonts25 plugins
![Page 27: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/27.jpg)
Initial situation n°1
User browsing platform
Experimental protocol
17/23
1 plugin 20 fonts
Initial situation n°25
User browsing platform
25 plugins 500 fonts
100 synthesized b.p.
1
2
3
4
5
6
7
8
97
98
99
100
100 synthesized b.p.1
2
3
4
5
6
7
8
97
98
99
100
2500 synthesized browsing platforms
![Page 28: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/28.jpg)
Research questions
1. How diverse is the set of fingerprints exhibited by the synthesized platforms?
18/23
100 synthesized b.p.1
2
3
4
5
6
7
8
97
98
99
100
FP4FP3FP2FP1
FP96FP..FP6FP5
FP100FP99FP98FP97
![Page 29: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/29.jpg)
Research questions
1. How diverse is the set of fingerprints exhibited by the synthesized platforms?
19/23
More and more similar
Less and less similar
Median
75th percentile
25th percentile
Boxplot
![Page 30: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/30.jpg)
Research questions
1. How diverse is the set of fingerprints exhibited by the synthesized platforms?
19/23
Coffee-break mode Faster modeModify fonts and
pluginsOS and browser
are not changed
![Page 31: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/31.jpg)
Research questions
2. How diverse are the platforms in the eyes of actual fingerprinters?
20/23
http://bluecava.com/opt-out/
![Page 32: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/32.jpg)
Research questions
2. How diverse are the platforms in the eyes of actual fingerprinters?
20/23
http://bluecava.com/opt-out/
More than 99% of unique IDs!
![Page 33: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/33.jpg)
Table of contents
1) What is fingerprint-based tracking?
2) Presentation of Blink
3) Experimental validation
4) Conclusion and perspectives
21/23
![Page 34: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/34.jpg)
Conclusion and perspectives
• Blink: break fingerprint stability thanks to automatic and complete synthesis of a new browsing platform for each browsing session
• AmIUnique.org: Collection of fingerprints to refine Blink’s randomization algorithms https://amiunique.org
• Blink on Docker: Fast and lightweight prototype already available https://github.com/plaperdr/blink-docker
22/23
![Page 35: Mitigating Browser Fingerprint Tracking: Multi-level … · 2020-03-04 · Bitstream Vera Serif, URW Palladio L, Bitstream Vera Sans Mono, Bitstream Vera Sans, ... HTTP DoNotTrack](https://reader036.vdocument.in/reader036/viewer/2022062604/5fb69d182cc3d804853d3e0e/html5/thumbnails/35.jpg)
Thank you for listening!
Any questions?
23/23