Fingerprinting

Fingerprinting scripts silently interrogate the browser's application programming interfaces (APIs) to harvest a wide array of seemingly innocuous details. This process requires no storage on the user's device and no explicit consent dialogs.

• Canvas Fingerprinting: Renders a hidden graphic to detect subtle variations in GPU and graphics driver output.
• AudioContext Fingerprinting: Analyzes minute differences in audio signal processing to identify hardware oscillators.
• WebGL Fingerprinting: Exposes the precise model and capabilities of the rendering GPU.
• Font Enumeration: Lists all system-installed fonts to create a highly distinguishing set.

The identifying power of a fingerprint lies in its entropy, measured in bits of identifying information. A single attribute like the User-Agent string provides low entropy, but the combination of dozens of signals creates a highly unique identifier.

• High-Entropy Signals: Timezone offset, screen resolution, installed plugins, and platform architecture.
• Statistical Rarity: A study by the EFF found that only 1 in 286,777 browsers share a completely identical fingerprint.
• Hash Generation: The collected attributes are fed into a hashing function to produce a compact, consistent identifier string.

Unlike traditional HTTP cookies, a fingerprint is stateless from the server's perspective. The identifier is regenerated on each visit by re-querying the browser's attributes, making it resilient to standard user clearing actions.

• No Local Storage: The identifier is not stored on the client, evading cookie deletion and private browsing modes.
• Cross-Session Tracking: The fingerprint remains stable across browser restarts as long as the underlying hardware and software configuration remains unchanged.
• Incognito Mode Limitation: While offering some protection, incognito mode often fails to fully normalize all fingerprintable surfaces.

A fingerprint's value for long-term tracking depends on its stability. However, legitimate user actions cause the fingerprint to mutate, requiring probabilistic matching algorithms.

• Natural Mutation Sources: Operating system updates, browser version upgrades, and plug-in installations alter the fingerprint.
• Drift Detection: Systems must distinguish between a legitimate fingerprint evolution and a completely new device.
• Heuristic Matching: Algorithms use fuzzy logic to link a new fingerprint to a previous one if a critical mass of attributes remains consistent.

Privacy-focused browsers and tools actively attempt to combat fingerprinting by normalizing or spoofing browser attributes to blend in with a generic crowd.

• Tor Browser: Standardizes the browser window size and disables many fingerprintable APIs to make all users appear identical.
• Brave Browser: Implements farbling, a technique that adds controlled, per-session random noise to API outputs to prevent stable identification.
• Privacy Badger: A browser extension that can detect and block third-party fingerprinting scripts heuristically.
• Virtual Machines: Running a browser inside a VM can mask the true underlying hardware, but the VM's own virtual hardware creates a new, stable fingerprint.

Advanced identity graphs use fingerprinting as one signal among many to probabilistically link multiple devices to a single user, a process known as cross-device graph building.

• IP Address Co-occurrence: Devices frequently sharing a public IP address are strong candidates for belonging to the same household.
• Login Correlation: A deterministic anchor that definitively links a fingerprint to a known user profile.
• Behavioral Biometrics: Layering typing cadence and mouse movement patterns on top of static fingerprinting for continuous authentication.