Visible to the public EssentialFP: Exposing the Essence of Browser Fingerprinting

TitleEssentialFP: Exposing the Essence of Browser Fingerprinting
Publication TypeConference Paper
Year of Publication2021
AuthorsSjösten, Alexander, Hedin, Daniel, Sabelfeld, Andrei
Conference Name2021 IEEE European Symposium on Security and Privacy Workshops (EuroS PW)
Date Publishedsep
Keywordsauthentication, Browser Fingerprinting, compositionality, Fingerprint recognition, Human Behavior, Information filters, information flow, JavaScript, Metrics, pubcrawl, resilience, Resiliency, Surface fitting, target tracking, Virtual assistants, Web Browser Security, Web pages, web security and privacy
AbstractWeb pages aggressively track users for a variety of purposes from targeted advertisements to enhanced authentication. As browsers move to restrict traditional cookie-based tracking, web pages increasingly move to tracking based on browser fingerprinting. Unfortunately, the state-of-the-art to detect fingerprinting in browsers is often error-prone, resorting to imprecise heuristics and crowd-sourced filter lists. This paper presents EssentialFP, a principled approach to detecting fingerprinting on the web. We argue that the pattern of (i) gathering information from a wide browser API surface (multiple browser-specific sources) and (ii) communicating the information to the network (network sink) captures the essence of fingerprinting. This pattern enables us to clearly distinguish fingerprinting from similar types of scripts like analytics and polyfills. We demonstrate that information flow tracking is an excellent fit for exposing this pattern. To implement EssentialFP we leverage, extend, and deploy JSFlow, a state-of-the-art information flow tracker for JavaScript, in a browser. We illustrate the effectiveness of EssentialFP to spot fingerprinting on the web by evaluating it on two categories of web pages: one where the web pages perform analytics, use polyfills, and show ads, and one where the web pages perform authentication, bot detection, and fingerprinting-enhanced Alexa top pages.
DOI10.1109/EuroSPW54576.2021.00011
Citation Keysjosten_essentialfp_2021