Fingerprinting Explained: How It Works & How to Block It

Fingerprinting is a tracking technique that advertisers and companies use. This tracking is such a shocking invasion of privacy that I feel compelled to explain it and how you can block it.

My concern is not the only one. Different companies have developed browser plug-ins to block fingerprinting, and one open-source project has given away their code, which shows how fingerprinting works—and we’ll explain in this article.

What is fingerprinting?
Can I find my own fingerprint?
How is fingerprinting so accurate?
Who is most vulnerable to fingerprinting?
Why should I care about fingerprinting?
Can I block fingerprinting?
What is the user agent?
Does this approach work for all browsers and operating systems?
Note on browser behavior
Firefox on Mac
Chrome on Mac
iCab Mobile on iPhone and iPad
What about advertising cookies?
Washington Post example
CNN example
Privacy concerns

What is fingerprinting?

I first heard about fingerprinting in The Washington Post, when Edward Snowden said, in the information he gave to journalists, that the NSA was using the screen resolution of computers to identify terrorists and others. Now, advertisers are using these same techniques. It shocks me that the techniques of spy agencies have gone mainstream.

A fingerprint is a number that is calculated from information about your computer, some of it the user perhaps thinks might be private. This includes:

• The browser you are using
• Your screen resolution
• Information on your graphics drivers
• CPU type
• Operating system and version
• Time zone
• Etc.

Much of this information is contained in the browser. Other information can be stolen in clever ways that researchers have discovered.

The fingerprint takes all that data, turns it into numbers, sums it, and then runs a calculation over it to yield a single value. Because this algorithm uses the same calculation every time, it will provide the same value (number) every time. As long as you are using the same device and browser, every time you visit a web site that uses fingerprinting, that website knows who you are—with approximately 95% to 99.5% accuracy.

To be specific, fingerprinting uses these metrics:

These metrics are available in the fingerprinting JavaScript code, shown below. The authors of that open source code say there are working on gathering other metrics that advertisers use, such as information about your camera.

What’s remarkable is that fingerprinting is able to extract this information simply by querying what is in the browser. It does not require access to the operating system at all.

At least one item, screen resolution, does require some clever thinking. To figure that out, the web site sends you a graphic of a known size and resolution, then reads the pixel resolution that your browser is able to display. And, it does this without displaying the image at all.

Can I find my own fingerprint?

To find your fingerprint, visit this page I set up. I sourced this code and put it on a web server. The programmers of this code wanted to expose this practice by providing JavaScript code and links to other code and research to explain how fingerprinting works.

The screen below shows your fingerprint and the metrics gathered from your machine used to calculate that fingerprint.