Browser Fingerprinting: Analysis, Detection, and Prevention at Runtime

Loading...
Thumbnail Image

Authors

Faiz Khademi, Amin

Date

2014-11-04

Type

thesis

Language

eng

Keyword

Fingerprinting , Web Privacy , Detection , Prevention , Runtime

Research Projects

Organizational Units

Journal Issue

Alternative Title

Abstract

Most Web users are unaware of being identified or followed by web agents which leverage techniques such as browser fingerprinting (or fingerprinting). Data obtained through such fingerprinting techniques can be utilized for various purposes ranging from understanding the types and properties of the user's browser to learning the user Web experience (e.g., through the browsing history). For enterprises, this can be a useful means to personalize services for their end-users or prevent online fraudulent activities. Similarly, a good fingerprinting technique can provide a rich set of data for various adversary purposes such as for compromising the security and privacy of Web users. Careful or attentive Web users might configure privacy enhancing tools (e.g., pop-up and cookie blockers) or operate in the private mode of the browser in order to block or prevent fingerprinters. However, recently we have observed that new fingerprinting methods can easily bypass the existing fingerprinting detection and prevention mechanisms. Moreover, while the topic of browser fingerprinting has been well studied, little attention was given to their detection and prevention. To address this challenge, we first analyze and reverse engineer the most widely used fingerprinting methods on the Web and unify these methods for developing a hybrid fingerprinting tool, called Fybrid. Furthermore, we integrate Fybrid with a social networking service and develop an integrated Web application, called iFybrid. Using iFybrid, we show the possibility of performing individual identification on top of browser identification using fingerprinting. We also identify metrics related to each method which are the indicators for performing fingerprinting attempts. Then, we use the identified metrics and propose a novel runtime fingerprinting detection and prevention approach, called FPGuard. FPGuard monitors activities of the running websites on the user's browser. While the detection capability of FPGuard is evaluated using the top 10,000 Alexa websites, its prevention mechanism is evaluated against four fingerprinting providers. Our evaluation results show that FPGuard can effectively detect and mitigate fingerprinting at runtime without interfering the user's browsing experience.

Description

Thesis (Master, Computing) -- Queen's University, 2014-10-31 11:02:53.485

Citation

Publisher

License

This publication is made available by the authority of the copyright owner solely for the purpose of private study and research and may not be copied or reproduced except as permitted by the copyright laws without written authority from the copyright owner.

Journal

Volume

Issue

PubMed ID

External DOI

ISSN

EISSN