Is Browser Fingerprinting good or bad? This is really a controversial topic right now. According to Pew Research, 83% of consumers regularly or occasionally see ads based on their browsing history. For consumers, they would consider it an invasion of their privacy. For businesses, Browser Fingerprinting offers a great competitive advantage.

If you want to understand what Browser Fingerprinting is, what exactly browser Fingerprinting does to our lives. Then this article is perfect for you.

 

What is Browser Fingerprinting

Browser fingerprint refers to the ability to locate a user almost absolutely through various information of the browser, such as system font, screen resolution, and browser plug-in, without the need for cookies and other technologies. Even if the browser’s private window mode is used, it cannot be anonymous. This is a passive way of identifying.

That is to say, if you visit a website, the website can recognize you, although you don’t know who you are, you have a unique fingerprint. It will be very convenient for advertising, precise push, and other things about privacy in the future. Also, don’t be superstitious about cloaking mode. The Chrome and Firefox extensions continuously record your browser fingerprint, allowing you to observe changes.

Browser Fingerprinting technologies

We already know that Browser Fingerprinting is a technology for locating a user using multiple technologies. So which technologies are giving us away? In fact, there are so many kinds of these technologies, which have laid a wide net for us. Generally speaking, it includes hardware fingerprint, Canvas fingerprint, AudioContext fingerprint, etc.

A fingerprint is a hallmark of any browser, Hardware type (Apple), operating system (Mac OS), User-Agent, system font, language, screen resolution, browser plug-ins (Flash, Silverlight, Java, Etc), Browser extensions, Browser Settings (do-not-track, etc), time zone Offset (Browser GMT Offset) and much other information.

Hardware fingerprints obtain information by detecting hardware modules, which supplement software-based fingerprints. Hardware modules include GPU, camera, speaker/microphone, motion sensor, GPS, battery, CPU, network adapter, Bluetooth, and BOIS.

The fingerprint information is like a person’s physical characteristics, which can be distinguished by gender, height, and weight. Human height, age, etc., have a great probability of conflict. However, these characteristics can not uniquely identify a person, and only using a basic fingerprint can not uniquely determine the client, but can only serve as an auxiliary identification.

So how do they make that distinction? Many advanced fingerprints based on HTML5 provide new ideas for this.

• Canvas prints

Many websites and tracking software use HTML Canvas fingerprints. Because each browser generates a different pattern.

Basically, every kind of browser will use a different image processing engine, different export option, different compression levels, so that every computer draw pictures will be slightly different, these patterns can be used to assign user equipment a specific number of fingerprints, also can be used to identify the different users.

• AudioContext fingerprint

If a Canvas fingerprint is a pattern fingerprint, an AudioContext is a sound fingerprint.

The Audio API gives developers the ability to manipulate raw Audio stream data directly in code, generating, manipulating, and reproducing it in any way they want, such as improving tone, changing pitch, and splitting Audio.

The AudioContext generates the audio flow (triangular wave), performs FFT transformation on it, calculates the SHA value as a fingerprint, and cleans the audio before it is output to the audio device without the user noticing.

Slight differences in the hardware or software of the host or browser lead to differences in the processing of audio signals. The same browser on the same device produces the same audio output, while the audio output generated by different machines or browsers may vary. This can then be used as a tracking technology for Browser Fingerprinting.

 

Is browser Fingerprinting legal?

Similar to human appearance and fingerprint, the Web client of the browser also has a variety of “appearance” and “fingerprint” information. After comprehensive analysis and calculation of these information, the client can be uniquely identified, and then lock, track, and understand the behavior and privacy data of Internet users. It is used for advertisement delivery, user interest analysis, and so on, and then as the basis of decision making. It is one of the important means to collect and track user behavior by using Web client.

But generally speaking, Browser Fingerprinting is legal and secure if no one uses it maliciously.

Browser Fingerprinting protects your rights

What? Isn’t Browser Fingerprinting violating my rights?

Every coin has its two sides, and Browser Fingerprinting is no exception. Now network technology is more and more developed, a lot of things can be done on the network. Such as receiving and paying. Now you don’t need to drive to the bank to access your account on your phone or computer.

And then the thieves upgraded their methods. Instead of stealing bank cards from the crowds on the shopping street, they are delving into computer technology and trying to steal your savings online. When they get access to your account and password, they are blocked from logging in. This is where Browser Fingerprinting comes into play.

The computer used by the thief is not the same as the computer used by you to log in to the online bank, and even the network is different. When he logs in from that computer, Browser Fingerprinting technology recognizes the device’s fingerprint. The network then realizes that it’s an unfamiliar fingerprint and discreetly sends you a reminder inviting you to verify your account. Thieves who don’t receive verification information can’t get their hands on your money.

Should I  worry about browser fingerprinting?

As stated above, Browser Fingerprinting is safe as long as no one uses it maliciously, but the reality is that in addition to the benefits, it does cause us some problems.

In the past, your stolen privacy might have been something concrete. Say your name, your bank card number. But for now, your Browser fingerprinting is also a very important piece of data. Criminals can use it to defraud you, and some businesses want to make money from your actions. Summary, Browser Fingerprinting

You may have the following effects:

1)  It made you look awkward in front of everyone

Getting a browser fingerprint has no real value to a website, but what is really valuable is the user information that the browser fingerprint corresponds to. As a webmaster, collecting a user’s browser fingerprint and recording the user’s actions is a valuable activity, especially for scenarios where there is no user identity.

For example, if you like to read about anime, the browser fingerprint will record that interest. The next time you visit this site, you don’t need to log in to get pushed animation information. This is a very generic way to distribute content. Also, your shopping preferences are monitored by Browser Fingerprinting.

The result is that Browser Fingerprinting knows exactly what you like. When someone else is using your computer to access the Internet, the network only recognizes the machine, not the person using it, so it’s easy for someone else to pass for you and get pushed some of your preferences.

Especially if you’re using a computer in a public place, it’s like a diary is out in the open, and your privacy is out there for all to see. It was undoubtedly a very awkward situation.

2) Let you always be punished by the platform

What? I’ve been banned again? When was the last time you were banned by Amazon?

Browser Fingerprinting is an important tool for checking account associations on commercial platforms. As we all know, some e-commerce platforms attach great importance to the market order. I believe you have seen many products with the same picture when opening the product page, which may be malicious competition. Maybe someone opened many stores to buy the same product in order to occupy the market.

In order to prevent such cases, e-commerce platforms use Browser Fingerprint to determine which stores belong to the same merchant. If detected, the platforms will impose penalties.

But maybe your good credit is being penalized, too? This is also a question of probability. Browser fingerprinting is not always accurate and you may be implicated.

Browser Fingerprinting has pros and cons, so how can you avoid this risk? Click here to see how to block Browser Fingerprinting.

In some services, it is necessary to obtain basic information of anonymous users to analyze user behaviors and then make targeted recommendations for certain user groups. This is where the Canvas fingerprint comes in.

Looking for a way to block canvas fingerprints? Trying to learn more about Canvas Defender? Then this article is for you.

In this article you will see:

• What is canvas fingerprint
• Why are Canvas fingerprints here
• What harm can canvas fingerprints do to me
• What is Canvas Defender? Does it work?
• The best alternative to Canvas Defender!

 

What is a Canvas fingerprint?

Every kind of browser use different image processing engine, different export option, different compression levels so that every computer draw graphics will be slightly different, these patterns can be used to assign user equipment a specific number (fingerprint), that is to say, can be used to identify different users, users won’t generally to replace hardware.

Therefore, Canvas can well specify the browser of the current user, but it is especially easy to generate the same fingerprint when multiple users have the same hardware device and browser. Therefore, canvas fingerprint cannot completely replace cookies as user identity authentication but can be used as auxiliary authentication information.

Why need to use canvas fingerprint?

In general, websites or advertising alliances want a technical way to accurately target each individual on the network. In this way, they can collect the data of these individuals and push advertisements (precision marketing) or other targeted activities more accurately through analysis. Cookie technology is a very popular one.

When a user visits a website, the site can permanently plant a unique identifier (UUID) in the user’s current browser Cookie and use this information to associate all of the user’s actions. These behaviors can be:

• What pages did you browse?
• What keywords are searched?
• What are you interested in?
• Which buttons were pressed?
• What features are used?
• What products did you see?
• What goes into the shopping cart

And so on.

As Internet users attach more importance to personal privacy, cookies are becoming less and less popular. Many security tools and even browsers are starting to allow or instruct users to turn cookies off. For example, many major browsers have a “private browsing mode” feature. This makes it harder for websites to track user behavior. However, there are still some ways for websites to track the behavior of each visitor, for example, flash cookies can also achieve the purpose of unique identification and tracking.

As HTML5 matures, identifying a unique browser via Canvas Fingerprinting is becoming more accepted. The feature of it is that users can hardly block it without cookies.

This tracking technology can track the unique feature code of the device through dynamic drawing parameters in HTML 5 and JavaScript without the permission of the user. It does not need to carry any token or accept cookies, and it can be tracked even if the IP address is changed. Therefore, it is considered to be unable to completely resist the tracking technology at the present stage.

How can Canvas fingerprints harm you?

1) Disclosure of personal privacy

Your washing machine is broken and you bought a new one online yesterday, right?

Did you play tower defense last night? Staying late?

Don’t look around, I’m not lurking, but I am. As soon as you log into the network using your device, I can see what you’re doing with that device.

Yes, I am a browser fingerprint. Canvas prints.

As mentioned before, some advertisers need the help of Canvas fingerprint to accurately find the best potential consumer groups. Your browsing behavior will be unique under Canvas fingerprint technology. While this may make ads and feeds more refined and easier for some, it also leaves users with no privacy at all.

2) Induce fraud

This point is based on the user privacy exposure caused by criminal acts.

When your browsing tendencies and browsing history are exposed to criminals, they can easily use these characteristics to determine your preferences and send you highly matched false messages. When this information gets your attention, fraud is easy to occur.

3) Impeding business activities

Why would Canvas fingerprints get in the way of business? Isn’t it just a threat to our privacy?

Yes, when Canvas fingerprints can tell you who you are, your business will be hindered a lot. Because it’s probably associated with the account.

What is account association? This rule generally applies to platforms that limit multiple accounts. Some platforms pay attention to the browsing environment and user experience and are very opposed to a user to achieve their own business marketing purposes to create and manage multiple accounts. In order to control this phenomenon, the platform tries to determine whether an account is connected or not.

When many different accounts have very similar operation behaviors, the platform will judge that there is a connection, leading to the closure of the account.

Canvas fingerprints can distinguish individual characteristics, thus playing an irreplaceable role.

 

What is Canvas Defender

Canvas Defender is a free add-on for Firefox and Chrome that manipulates Canvas fingerprints to prevent Canvas fingerprints.

Canvas fingerprints use the HTML5 Canvas element. The Canvas element is used to draw graphics on Web pages and is supported by all major Web browsers.

Fingerprints take advantage of the fact that the output of a canvas is often different when rendered in different browsers. This is not always the case, which is why Canvas fingerprinting is often used in conjunction with other tracing methods.

In general, the more unique the browser and operating system, the more unique the fingerprint.

Canvas Defender is available on all browsers and platforms (Windows, Linux, and Mac).

How does Canvas Defender work?

Internet users have two options when it comes to blocking fingerprinting. Add-ons may block the Canvas element in the browser entirely or provide whitelisting/blacklisting methods. Since Canvas requires JavaScript, turning it off will also block it, but this is usually not feasible.

Canvas Defender changes its “real” Canvas fingerprint by adding interference to the browser.

Unlike other add-ins created for this purpose, the browser extension does not completely block the Canvas element in the browser. Canvas is also used on legitimate sites, and blocking Canvas entirely may disable some or all of those sites’ functionality.

This extension adds ICONS to the browser’s main toolbar that you can interact with. Clicking will display the interference hash, along with the option to generate a new interference. You can also disable creation at any time using the menu.

Does Canvas Defender work?

What’s the response to Canvas Defender’s launch? Does Canvas Defender work? Does it really deliver what it promises?

Some users highly recommend using this product:

5 star! Works perfectly, tested using https://www.deviceinfo.me and it does in fact show “spoofed” instead of “blocked”.

Works as expected, easy to use: install and forget. Been using it for months, don’t plan to stop using it..

However, some users say Canvas Defender still has some problems.

Some websites just don’t work with this addon enabled. The notification is annoying and the reasons dev gives for keeping it that way are not justified.

While the idea is nice theoretically, practically this addon isn’t all that useful. Apps using canvas for legitimate reasons (i.e. WhatsApp web file upload, draw.io file export) will often have coloured tint (or sometimes it will just break the app completely) on them, which not only affects the web experience, but will also make you trackable. The addon does have a white-list function, but I haven’t been able to get it to work. There’s also an annoying notification that pops up on every webpage that tries to read your canvas hash and you can’t actually disable it.

 

The best alternative to Canvas Defender!

There are alternatives to using Canvas Defender for fingerprint protection, such as a plugin or a browser with special features.

Canvas Blocker for Google Chrome and CanvasFingerprintBlock are designed to block web pages from tracking fingerprints, so if you’re not too security-sensitive, you can try them out.

If you use a privacy-protected browser, your canvas fingerprint problem can be solved easily.

ClonBrowser is a virtual browser with high privacy protection. In ClonBrowser, your real browser fingerprints are not retrieved, they are retrieved as a fake mask fingerprint. With measures like Canvas Spoofing, you don’t have to worry about fingerprints anymore!

In addition, your personal data, such as cookies, will also be kept independently.

Come and try it for free!

What is a fingerprint?

Fingerprint, or fingerprint recognition, is identified using the texture on the front of the finger. Fingerprints are a reliable way of identifying people because the texture arrangement on each finger varies from person to person and does not change with development or age. On the Internet, it becomes a string that uniquely identifies the current browser.

As soon as you pass, you leave a trail. The same goes for our online lives. As long as you visit certain websites, you are sure to leave a trail, even if you have been “smart” enough to browse without a trace.

That’s because most sites embed tracking codes in their pages to retrieve user data, such as user accounts and browser and computer configuration information.

For website platforms, big data analysis is a must, only in this way can we better seize the market and survive. And the user’s data to them is the most valuable and most direct data. Without an embedded tracking feature, there is no way to get first-hand data, and no way to recommend personalized services.

What information does a fingerprint contain?

A browser fingerprint is a combination of many browser characteristics, including but not limited to:

• User agent string for each browser
• HTTP ACCEPT header sent by the browser
• Screen resolution and color depth
• System Settings
• The browser plug-ins installed, and the versions of those plug-ins
• Fonts installed on your computer
• Whether the browser executes JavaScript scripts
• Can browsers plant cookies and “super cookies”
• The hash of the image generated by the Canvas fingerprint
• Hash generated by WebGL fingerprint
• Is the browser set to “Do Not Track”?
• System platforms (e.g. Win32, Linux x86)
• System languages (e.g. Cn, en-us)
• Whether the browser supports touch screen

 

Browser fingerprints and Javascript

Every browser’s fingerprint is unique, so browser fingerprint tracking is something every website has to do. Fingerprint tracking is the use of some means to obtain the user’s fingerprint information.

Methods for obtaining browser fingerprints include HTTP, FLASH, and Javascript. Through the HTTP request information submitted by the user, the characteristics of the browser can be obtained, including the browser type version (userAgent) and the accepted type of information (http_accept). Through the embedded Javascript code in the page, the user’s plug-in information can be obtained when the user executes ( Plugins) display Settings (vdeo), timezone information such as fingerprint (timezone), cookie receive Settings. At the same time, you can use FLASH to get the user’s installed fonts.

The fingerprint of the current browser can be obtained through Javascript. Screen size, color depth, browser plug-ins, time zone, language, system font, platform, and touch support are detected through JavaScript.

With Javascript, you can collect a lot of data about the user’s browser and device. When stitched together, they display a unique combination of information that forms each user’s own “digital fingerprint.”

It is calculated by the following parameters:

• User_agent: Including the browser version
• Language: Current language of the browser setting
• Color_depth: Screen color depth
• Device_memory: Whether device memory debugging is supported (presumably for mobile testing)
• Pixel_ratio: Whether pixel ratio adjustment is supported
• Hardware_concurrency: Whether hardware concurrency is supported
• Resolution:Screen resolution
• Available_resolution:Available screen resolution
• Timezone_offset:Time difference between the Greenwich Mean Time and the local time, expressed in minutes
• Session_storage:Whether session_storage is supported, which is a standard feature of HTML5
• Local_storage:Whether local_storage is supported, which is a standard feature of HTML5
• Indexed_db:Whether browser-side databases is supported, which is one of the new html5 features
• Navigator_platform:Specifies the operating system platform, for example, Win32
• Do_not_track:Privacy Settings, whether users allow websites to track their preferences
• Regular_plugins:installed plugins (e.g. installed PDF plugins)
• Canvas: Draw a rectangle using the Canvas API and convert it to a Base64 string
• Webgl:WEB 3D drawing protocol. Information that aggregates support for WebGL
• Webgl_vendor:Indicates the webGL provider and graphics card
• Adblock:Whether to support AD blocking
• Has_lied_languages:Indicates whether the browser language is the first language
• Has_lied_resolution:Resolution comparison screen.width < screen.availWidth
• Has_lied_os:Determines whether the system platform is true and reliable (lied)
• Has_lied_browser:Check whether the browser checks for authenticity
• Touch_support:Whether touch is supported
• Js_fonts:checks for font support

What is a JavaScript

JavaScript (” JS “for short) is a function-first, lightweight, interpreted, or just-in-time compiled programming language. Although it is best known as a scripting language for developing Web pages.

JavaScript was born in 1995 on the Netscape Navigator browser. It was created by Brendan Eich of Netscape. Because Brendan Eich’s company was working with Sun, it got the name JavaScript. But in fact, its syntactic style is closer to Self and Scheme. The standard for JavaScript is ECMAScript.

Main functions:

1. Embed dynamic text in HTML pages.
2. Respond to browser events.
3. Read and write HTML elements.
4. Validate data before it is submitted to the server.
5. Check the browser information of the visitor. Control cookies, including creation and modification.
6. Server-side programming based on Node.js technology.

What are the fingerprint tracking technologies

1) Cookie (first generation)

The first generation of fingerprint tracking was cookie, a tracking technology that servers set flags on clients. Evercookie is an enhanced version of cookie. Cookies are currently the most commonly used method on web pages. This is done primarily through small pieces of data placed by web servers in the user’s browser.

To put it simply, when we click on a website we have never visited, the website randomly plants a cookie file on our computer that is unique to the same user. And the next time we visit the site, the site will identify you through the cookie. This explains why, at the beginning of our article, even if you start “Non-trace mode,” it’s not really traceless.

2) Device fingerprint technology (second generation)

The second generation of fingerprint tracking is to find the device behind the IP. Obtain a series of information such as operating system, resolution, pixel ratio, and so on through JS, transmit it to background calculation, and then merge the device.

Uniqueness can be guaranteed, but accuracy is difficult to guarantee completely. The main reason is in browser fingerprinting. After the browser, canvas fingerprint and browser plug-in fingerprint, which are important in the second generation technology, have changed, making it difficult to merge browser fingerprint on the same device.

Because the device has the same fingerprint, there is a high probability that it is the same device; However, devices with different fingerprints may not be the same device.

3) Beacons (Internet bugs)

Network beacons are often used in DEM. They are usually extremely small images (the size of a single pixel) and can also be embedded in a page with names like “tag”, “metag tag”, “trac error”, “piex.gif “, etc., without being noticed by the average person.

Beacons are hidden in web pages and can be hidden in emails. When we open a web page and start loading, they download it as an image and send a message to the image’s remote server. The server script tells your company when and where someone opened one of their web pages. The same goes for emails.

Testing browser fingerprints

There are various tools available to test your browser identity. You can use “Am I Unique”, “PANOPTICLICK”, or “Unique Machine” to test the identity of your device.

 

Anti-fingerprint browser

ClonBrowser protects your privacy, solves your fingerprint problem, and adds security to your online life! ClonBrowser deals with browser fingerprints in a clever way, by putting a mask on you and making the fingerprint read by a website look like a “mask fingerprint” that is different from your real fingerprint. In this way, any attempt to gain access to your private information can be effectively blocked.

In addition, ClonBrowser has many amazing features, such as the ability to manage multiple accounts and run multiple stores!

Learn about it now!

What is a Browser Fingerprint?

Browser fingerprinting is a method of tracking the web browser through the configuration and setting information that the browser can see on the website.

Browser fingerprints are like fingerprints on our hands, with individual recognition.

Formally because of the folds of the human skin, a unique human fingerprint is formed that is different for everyone.

The same is true for the browser fingerprint. Obtain the recognizable information of the browser and perform some calculations to get a value. Then this value is the browser fingerprint.

Recognizable information includes language, time zone, user agent, geographic location, etc. The information you select determines the accuracy of the browser fingerprint.

Obtaining fingerprints has no real meaning for the website, and more importantly, the user information corresponding to the fingerprints.

As a website, collecting user browser fingerprints and recording user operations is a valuable behavior, especially for scenarios where there is no user identity.

For example, on a content distribution website, user A likes to browse military content, and the browser fingerprint can record this interest. Then the user can push military information to user The next time without logging in to the website.

At the moment when personal PCs are so popular, this is also a way of content distribution.

For users, establishing a connection between personal surfing behavior and browser fingerprints more or less infringes on user privacy.

Fortunately, this method has limited infringement on users’ privacy, and abusive user behavior will also overdraft the user’s favor on the site.

The development of browser fingerprinting

First generation: stateful

The main focus is on the user’s cookie, which requires the user to log in to obtain effective information.

Second generation: browser fingerprint

Make users more distinguishable by continuously increasing the feature value of the browser.

For example UA, a browser plug-in, Canvas, AudioContext information, etc.

Third generation: user behavior big data

By collecting user behaviors and habits to build feature values and even models for users, real tracking technology can be realized. This part of the current implementation is relatively complicated and is still being explored.

How to get the browser fingerprint

Get browser fingerprint from HTTP

Entropy is the average amount of information contained in each message received. The higher the entropy, the more information can be transmitted, and the lower the entropy, the less information is transmitted.

Browser fingerprints are synthesized from the feature information of many browsers, and the information entropy of feature values is also different.

You can check your browser fingerprint ID and basic information here.

Browser fingerprints can also be simply divided into ordinary fingerprints and advanced fingerprints.

Ordinary fingerprints can be understood as parts that are easy to find and easy to modify.

For example, HTTP header

{

“headers”: {

“Accept”: “text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9”,

“Accept-Encoding”: “gzip, deflate, br”,

“Accept-Language”: “zh-CN,zh;q=0.9”,

“Host”: “httpbin.org“,

“Sec-Ch-Ua”: “\” Not A;Brand\”;v=\”99\”, \”Chromium\”;v=\”90\””,

“Sec-Ch-Ua-Mobile”: “?0”,

“Sec-Fetch-Dest”: “document”,

“Sec-Fetch-Mode”: “navigate”,

“Sec-Fetch-Site”: “none”,

“Sec-Fetch-User”: “?1”,

“Upgrade-Insecure-Requests”: “1”,

“User-Agent”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36”,

“X-Amzn-Trace-Id”: “Root=1-6103c0a2-2deb3a391be2e99a38b1f813”

}

}

Use the tool to query.

In the above, we can see the browser’s Accept-Language and User-Agent, through which the language information of the browser can be obtained.

This HTTP header entity information may be generated by your current operating system language or the language information set by the browser.

This header is not necessarily accurate. Some websites will ignore this header and use ip to determine the language of the user’s region.

User-Agent contains information about the browser and operating system.

For example, I am currently using MacOS and I am using version 77 of Chrome.

If the UA is deliberately faked in the header, the webpage can also get the real UA through navigator.userAgent.

Other basic information, such as IP, physical address, geographic location, etc. can also be obtained.

Use the tool to query.

Other ways to get browser fingerprints

In addition to fingerprints obtained from HTTP, browser characteristic information can also be obtained in other ways.

1. User-agent string for each browser

2. HTTP ACCEPT header sent by the browser

3. Screen resolution and color depth

4. System setting time zone

5. Browser extensions/plugins installed in the browser

For example, Quicktime, Flash, Java or Acrobat, and the versions of these plug-ins

6. Fonts installed on the computer, font fingerprint technology

7. Whether the browser executes JavaScript scripts

8. Browser cookie

9. Hash of the image generated by Canvas fingerprint

10. Hash of the image generated by the WebGL fingerprint

11. Whether the browser is set to “Do Not Track”

12. the system platform

For example Win32, Linux x86

13. System language

For example, cn,en-US

14. Does the browser support touch screen

15. Hardware concurrency

16. TLS/SSL

After getting these values, you can perform some calculations to get the specific information entropy of the browser fingerprint and the UUID of the browser.

The integrated fingerprint information can greatly reduce the collision rate and improve the accuracy of the client UUID.

Fingerprints also have rank. Some feature values with larger information entropy will have larger ranks.

The information described by ordinary fingerprints is still not unique enough, after all, there are still very many people using MacOS in the United States.

Advanced fingerprints can further narrow this range, and can almost directly determine a unique browser identity.

Types of browser fingerprints

Canvas fingerprint

Canvas is a dynamic drawing tag in HTML5, and it can also be used to generate pictures or process pictures.

The same HTMLCanvasElement element drawing operation, on different operating systems and different browsers, the content of the pictures produced is not exactly the same.

In terms of image format, different browsers use different graphics processing engines, different image export options, and different default compression levels.

At the pixel level, the operating systems each use different settings and algorithms for anti-aliasing and sub-pixel rendering operations.

Even with the same drawing operation, the CRC check of the generated picture data is different.

Canvas has been supported by almost all major browsers and can be accessed through most PCs, tablets, and smart phones.

Use the tool to query.

WebGL fingerprint

The WebGL object (canvas.getContext(“WebGL”)) can be obtained through the HTMLCanvasElement element, and the user’s hardware information can be obtained through this object.

Graphics card name, Graphics card model, Graphics card manufacturer, etc.

For example: ANGLE (NVIDIA GeForce GTX 1050 Ti Direct3D11 vs_5_0 ps_5_0), Google Inc.

Since the hardware is generally not replaced at will, some computers have not been replaced when they are scrapped.

There are also many types of computer hardware. Although the collision rate is very large, it can still be used as part of the user’s fingerprint.

The more information collected from a user, the more it can represent the user’s unique fingerprint, which cannot be ignored.

Use the tool to query.

AudioContex fingerprint

The Audio API provided by HTML5 for JavaScript programming allows developers to directly manipulate the original audio stream data in the code.

Be randomly generated, processing, recycling, such as raising the tone, pitch change, audio division, and even can be called Web version of Adobe Audition.

AudioContext fingerprint principle is as follows:

Method 1: Generate an audio information stream (triangular wave), perform FFT transformation on it, and calculate the SHA value as a fingerprint.

Method 2: generating an audio stream (sine wave), the dynamic compression processing, MD5 value is calculated.

Both methods are cleared before the audio output to the audio device, the user simply unaware it was acquired fingerprint.

AudioContext fingerprint basic principles:

The subtle differences in the hardware or software of the host or browser cause differences in the processing of audio signals.

The same type of the browser on the same device produces the same audio output.

Different machines or different browsers generate audio output will be different.

It can be seen from the above that AudioContext and Canvas fingerprint principles are very similar.

Both use the difference in hardware or software. The former generates audio, the latter generates pictures, and then calculates different hash values as identification.

Use the tool to query.

WebRTC fingerprint

WebRTC (Web Real-Time Communication) is the ability for the browser to have real-time audio and video communication.

It provides three main APIs to allow JS to obtain and exchange audio and video data in real-time, MediaStream, RTCPeerConnection, and RTCDataChannel.

Of course, if you want to use WebRTC to obtain communication capabilities, the user’s real IP must be exposed (NAT penetration), so RTCPeerConnection provides such an API.

You can get the user’s IP address directly by using JS.

Cross-browser fingerprint

The browser fingerprints mentioned above are all obtained from the same browser.

However, many feature values are unstable. For example, UA and canvas fingerprints will be completely different when opened in different browsers on the same device.

The same set of browser fingerprint algorithms is not available on different browsers.

Cross-browser fingerprinting is a stable browser feature that can obtain the same or similar value even on different browsers.

How to protect the browser fingerprint

If you do not have enough professional knowledge or change browser information very frequently, almost 100% of your browser fingerprints will be leaked. Of course, this is not necessarily a bad thing.

The leaked privacy is very one-sided, and it can only be said that it has leaked part of the user’s behavior when browsing the web.

Insufficient value, user behavior does not correspond to actual accounts or specific people, and the value generated is limited.

Beneficial use, use browser fingerprinting can produce user isolation part black, part to prevent brush votes or malicious behavior.

But even so, browser fingerprints have some preventive measures.

Do Not Track

In the HTTP header, you can declare such a flag “DNT” means “Do Not Track”, if the value is 1, it means not to track my webpage behavior, and 0 means it can be tracked.

Even if there is no cookie, you can tell the server that I don’t want to be tracked and don’t record my behavior through this flag.

The bad news is that most websites currently do not abide by this agreement and completely ignore the “Do Not Track” signal.

ClonBrowser

Through the above-mentioned understanding of browser fingerprints, it is not difficult to find that the more features your browser has, the easier it is to be traced.

On the contrary, if you want to deliberately hide certain browser features or make magic changes, then congratulations, your browser may have a unique browser fingerprint, and you don’t need to deliberately calculate it, you can directly communicate with other people distinguish.

Therefore, an effective method is to popularize the feature values as much as possible.

For example, the most widely available combination on the market is Window 10 + Chrome.

Then you change the UA to this combination is an effective method, and at the same time try to avoid the website from acquiring feature values with very high information entropy, such as canvas fingerprints.

ClonBrowser browsers do a lot of work on this to prevent them from being used to track ClonBrowser users.

In response to Panopticlick and other fingerprinting experiments, the ClonBrowser browser now includes some patches.

To prevent font fingerprints, by restricting the fonts that can be used by the website and Canvas fingerprints, it is prevented by detecting the reading of HTML5 Canvas objects and requiring user approval.

For example, the code for obtaining Canvas fingerprints above, in ClonBrowser, you can choose to close, noise, block and other settings to adapt to your business scenarios.

In summary, these measures make the ClonBrowser browser a powerful defense tool against fingerprints to protect your privacy.