Browser Fingerprinting: Analysis, Detection, and Prevention at Runtime
Faiz Khademi, Amin
MetadataShow full item record
Most Web users are unaware of being identified or followed by web agents which leverage techniques such as browser fingerprinting (or fingerprinting). Data obtained through such fingerprinting techniques can be utilized for various purposes ranging from understanding the types and properties of the user's browser to learning the user Web experience (e.g., through the browsing history). For enterprises, this can be a useful means to personalize services for their end-users or prevent online fraudulent activities. Similarly, a good fingerprinting technique can provide a rich set of data for various adversary purposes such as for compromising the security and privacy of Web users. Careful or attentive Web users might configure privacy enhancing tools (e.g., pop-up and cookie blockers) or operate in the private mode of the browser in order to block or prevent fingerprinters. However, recently we have observed that new fingerprinting methods can easily bypass the existing fingerprinting detection and prevention mechanisms. Moreover, while the topic of browser fingerprinting has been well studied, little attention was given to their detection and prevention. To address this challenge, we first analyze and reverse engineer the most widely used fingerprinting methods on the Web and unify these methods for developing a hybrid fingerprinting tool, called Fybrid. Furthermore, we integrate Fybrid with a social networking service and develop an integrated Web application, called iFybrid. Using iFybrid, we show the possibility of performing individual identification on top of browser identification using fingerprinting. We also identify metrics related to each method which are the indicators for performing fingerprinting attempts. Then, we use the identified metrics and propose a novel runtime fingerprinting detection and prevention approach, called FPGuard. FPGuard monitors activities of the running websites on the user's browser. While the detection capability of FPGuard is evaluated using the top 10,000 Alexa websites, its prevention mechanism is evaluated against four fingerprinting providers. Our evaluation results show that FPGuard can effectively detect and mitigate fingerprinting at runtime without interfering the user's browsing experience.