Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Regarding the concept of device (browser) fingerprinting, would it be possible for the user to spoof fingerprinting data by giving random information such that your fingerprint changes after every request?

If so, are there any plugins/browsers that have this capability?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

As far as I can see, you can easily spoof all of the fingerprinting data, and potentially change it with every request. All this information is sent by your browser in the HTTP headers of the request (or obtained via browser client-side scripts). I am not aware of a particular plugin that supports this fully, but there are some plugins for changing your user-agent, manipulating headers and managing cookies. The user-agent is one of the main identifying pieces of information of the fingerprinting process and most other pieces are in other various headers. Blocking javascript/flash scripts is also possible, e.g. using the noscript plugin

Changing this fingerprinting info however does come with a price. It might cause the website to display pages in a different way, which will cause the site to look wrong or not to function properly. Lots of website developers rely on (at least some of) this fingerprint information in order to make the pages they display compatible with your browser. Hiding/spoofing this info will therefore affect this process and your browsing experience may be altered.

It's also possible that this fingerprinting is performed for legitimate security reasons. For example, a security-aware website might tie in the fingerprint info to the session or logged-in user, and will reject requests where the fingerprinting doesn't match (this would suggest to the server a request is now coming from a different browser). Here's one more example from another question where the website owner wants to test browser plugin versions of your browser (which is part of the fingerprinting data) before allowing access. I don't know of any specific sites that use this technique, but it is definitely feasible. Changing fingerprint data with every request will again cause unwanted behaviour.

I suppose that performing some minor randomized tweaks to specific headers will achieve a better degree of anonymity against fingerprinting without compromising the browsing experience. This requires some experimentation and will probably mean a compromise between security and usability.

share|improve this answer

No. It's hardly possible. There are several problems with it.

The main problem with avoiding fingerprinting is that we have very little idea about how it actually works, so we have no idea what to do to circumvent it.

Everybody seems to think of Panopticlick as a reference frame for fingerprinting. And you can, in theory, more or less circumvent Panopticlick by crowdsourcing fingerprints. But Panopticlick is a very limited demo. Its whitepaper clearly states that even in 2009 when Panopticlick was created commercial fingerprinting solutions were much more advanced:

Arcot... claims it is able to ascertain PC clock processor speed, along with more-common browser factors to help identify a device. 41st Parameter looks at more than 100 parameters, and at the core of its algorithm is a time di fferential parameter that measures the time di fference between a user's PC (down to the millisecond) and a server's PC. ThreatMetrix claims that it can detect irregularities in the TCP/IP stack and can pierce through proxy servers... Iovation provides device tagging (through LSOs) and clientless [ ngerprinting], and is best distinguished by its reputation database, which has data on millions of PCs.

And this was in 2009! I'm afraid to think what those guys have come up with since then.

The other problem is that if you change your clock skew every so often, you can't check if that helped or not, unless you have access to admin consoles of all major fingerprinting providers.

This is why there are no software to circumvent fingerprinting: nobody really knows how to combat it. So we'll probably have to deal with it.

share|improve this answer

Yes, it's probably possible. However, I don't know of any browsers or plugins that support spoofing the fingerprint or making it change on every request.

If you are trying to protect your anonymity and protect yourself against fingerprinting, I would suggest a combination of Tor (install it via the Tor bundle), possibly along with NoScript.

share|improve this answer
3  
Tor does not affect fingerprinting. And having JavaScript disables is a hell of an identifier by itself - less 10% of clients have it disabled and very few of them happen to have a desktop web browser's user agent. –  Shnatsel Jul 4 '13 at 8:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.