Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via java and flash, but the linked pdf also points out that disabling these common plugins actually just adds to the uniqueness, as well as simply altering the User Agent. Font detection is also seems possible via css introspection.

What steps can one take, what technology options do exists to counter-measure fingerprinting of one's browser?

share|improve this question
I think I should link the 2010 evercookie. Its goal is to identify a client even after they've removed standard cookies, Flash cookies (Local Shared Objects or LSOs), and others. – n611x007 Feb 27 '14 at 19:29

The fingerprinting technology used by the EFF is nothing but the "normal" Javascript functions used by web sites to, well, operate properly. It is possible to report untrue information to the outside, but then you'd risk either "falling behind":

  • the untrue information you would need send along changes and yours doesn't, making you unique -- and suspicious;
  • the detection techniques change, and you aren't aware of it, so become unique again;

or having a really awkward navigation.

Assuming that you can use TOR or a VPN or an openshell anywhere to tunnel away your IP address, the "safest" practice in my opinion would be to fire up a virtual machine, install a stock Windows Seven on it, and use that for any privacy-sensitive operation. Do not install anything unusual on the machine, and it will truthfully report to be a stock Windows Seven machine, one between a horde of similar machines.

You have also the advantage of the machine being insulated inside your true system, and you being able to snapshot/reinstall it in a flash.

This can be very useful, in that you could keep a "clean" snapshot and always restore it before sensitive operations such as home banking. Some VM's also allow 'sandboxing', i.e., nothing done in the VM will actually permanently change its contents -- all system changes, malware downloaded, virus installed, keyloggers injected, disappear as soon as the virtual machine is powered down.

Any other technique would be no less intrusive, and would entail a considerable work on the browser or on some kind of anonymizing proxy designed not only to sanitize your headers and your Javascript responses (as well as the fonts!), but to do it in a credible way.

In my opinion, not only would the total amount of work be the same (or even more), but it would be a much more complicated and less stable kind of work.

Install the most common OS, keep to the bundled browser and software, resist the temptation of pimping it, and what's to tell that machine from literally hundreds of thousands of similar just-installed, never-maintained, computers-are-not-my-thing machines on the Internet?

Update - browsing behaviour and side channels

Now I have installed a virtual Windows 7 machine, even upgraded it to Windows 10 as Joe Q. Average would do. I'm not using Tor or VPN; all that an external site can see is that I'm connecting from Florence, Italy. There are thirty thousand connections exactly like mine. Even knowing my provider, that still leaves around nine thousand candidates. Is this sufficiently anonymous?

It turns out not to be the case. There might still be correlations that could be investigated, having sufficient access. For example I'm playing an online game and my typing is sent straight away (character buffered, not line buffered). It becomes possible to fingerprint digram and trigram delays, and with a sufficiently large corpus, establish that online user A is the same person as online user B (within the same online game, of course). The same problem could happen elsewhere.

When I surf the Internet, I tend to always hit the same sites in the same order. And of course I hit my "personal pages" on several sites, e.g. Stack Overflow, regularly. A quite tailored distribution of images is already in my browser and is not downloaded at all or is bypassed with a HTTP If-Modified-Since or If-None-Match request. This combination of habit and browser helpfulness also constitutes a signature.

Given the wealth of tagging methods available to websites, it's not safe to assume that only cookies and passive data may have been collected. A site might for example advertise the need to install a font called Tracking-ff0a7a.otf, and the browser would download it dutifully. This file would not necessarily be deleted upon cache clearing, and on subsequent visits it not being re-downloaded would be proof that I've already visited the site. The font could even contain a unique combination of glyphs (e.g. the character "1" could contain a "d", "2" could contain an "e", "4" could contain a "d" again), and HTML5 can be used to draw a glyph string "12345678" on an invisible canvas and uploading the result as an image. The image would then spell the hex sequence, unique to me, 'deadbeef'. And this is, to all intents and purposes, a cookie.

To fight this, I may need to:

  • completely re-snapshot the VM after each browsing session (and reset the modem when I do). Keeping always the same VM wouldn't be enough.
  • use several different virtual machines, or browsers, as well as well-known proxy services or Tor (it wouldn't do for me to use a proxy that's unique to me, or for which I'm the only Florence user, for anonymity purposes).
  • routinely empty and/or sanitize the browser cache and remember not to always open, say, XKCD immediately after Questionable Content.
  • adopt two or more different "personas" for those services I want anonymity in, and those I don't care about, and take care to keep them separated in separated VMs - it only takes one slip, and logging to one believing it's the other, for a permanent link to possibly be established by a savvy enough external agency.

Which also goes to show that I'll better have a good reason to want anonymity: because achieving it reliably is going to be a royal pain in the rear end.

share|improve this answer

During fingerprinting, the following are taken:

  1. IP address / subnet / country / region
  2. User Agent
  3. Other HTTP headers

Now, for IP address, you can use:

  • Tor
  • I2P
  • Public VPN service like OpenVPN, where many others users are as well it is having nodes across multiple networks

For User-Agent:

  • Online anonymous proxy
  • Your own proxy server, which does set User-Agent and some common headers
  • Browser plugin which modify headers
  • Browser plugin, which runs browser on remote, anonymity service

BUT, you will always be fingerprinted and identified in some way. It is because you normally connect from the same subnet, and you use the same browser. So to avoid these two, is really hard, because you would need VPN servers on endless number of networks, as well User-Agent generator, and header obfuscation, which does set different values each day, or each time you start it.

I for myself, I use Amazon EC2 free micro instance with free OpenVPN server, and it does self-stop and self-start every day in different region (by itself, it boots new server with a script to set it up thru AWS API), and updates DNS via Route 53 API. It is using SQUID as proxy, and there are many rules to block advertising, tracking as well some other things. It has also full BGP table, as these VPN servers are working in the network, but you dont need this, if you are not making cover-up.

You can also make EC2 instance change it's IP address without actually rebooting it. You can use AWS API to release Elastic IP and allocate a new one, and add to it. If you change User-Agent at the same time, you will avoid fingerprinting.

See this for example:

And indeed, with different IP number and user-agent every day, Google cant recognize me, so I can see ads which are not "tracking me".

ps. When you add new instance, you need at least 20GB of EBS root volume. Then you just do yum install squid or apt-get install squid, configure it thru /etc/, and there you go. If you want to change IP address, just change Elastic IP on it - it does work in both ways - the way you can access new instance or you get to the internet.

And then you will need only this:

Don't forget to update instance once a while yum update

I could produce maybe AMI image, which would work automatically. Simply you just launch instance, it setups OpenVPN, and thru AWS API it would configure IPs, DNS as well SQUID etc. Maybe there are some AMIs at Amazon already.

See this:

Some websites will complain that you work over VPN. For example, some sites which serve music or video. While most of sites works OK, there are just few exceptions.

share|improve this answer
You missed "disable javascript", which is one of the first things you should do. Plugins like noscript are great for this kinda thing. – Polynomial Oct 24 '12 at 5:57
The steps outlined here, are contra productive to prevent panopticlick. The only way to stay under the radar of this kind of fingerprinting technology, is to hide in the masses. Using the amazon cloud as proxy or disabling javascript make you stand out from the mass. – Hendrik Brummermann Oct 24 '12 at 7:02
@HendrikBrummermann Ha ha ha. You need to think like an analyst - if you dont keep the same ip number, dont keep same subnet, dont keep the user agent - in practice, it's impossible to track you over all ways are in use today (ads, network). It's practically proven to work very well. – Andrew Smith Oct 24 '12 at 13:54
@Andrew Smith: Your premise is completely off. You mentioned 3 pieces of information out of at least 9 that can be used to identify you. The remaining 6 WILL uniquely identify you. Regardless of how "anonymous" you appear to be, fingerprinting you proves that you actually are completely and uniquely identifiable and trackable. Specifically by looking at your system fonts and browser plug-ins installed which are highly likely to be unique, especially among the technically adept. – user55217 Sep 9 '14 at 14:41
This answer seems to be more or less aiming against identification (eg. get ones real location and identity) than trackability (eg. check out wheter a user is the same on multiple, different site visits). – dronus May 23 '15 at 6:58

The technical requirement for avoiding any form of browser fingerprinting is that all potentially identifying characteristics returned by the browser are randomized, so that the probability of the browser returning a certain set of characteristics approximates the probability of observing that set of characteristics in the browser population within which we want to maintain anonymity.

Breaking this down, suppose we are only dealing with a single characteristic (say the User-Agent header) and we want to ensure we remain anonymous. For illustrative purposes, let's assume that there are 50 possible values for User-Agent, numbered 1 to 50.

One possible strategy is to use the most commonly occurring value of User-Agent, as observed according to the browser population. Under certain circumstances, this could be a poor strategy, as illustrated by the following figure:


According to the figure, the most commonly occurring User-Agent value in the browser population is only slightly more likely to occur than the remaining values. If we simply used the most common value (25), a fingerprinting service could (consistently) infer that we belong to the (relatively small) subset of 2.4% of browsers in the population. Thus, we have compromised our anonymity.

Note that simply generating values at random without regard to the browser population can severely compromise anonymity, as illustrated by the following figure:


According to the figure, the values of User-Agent returned by our browser are (uniformly) randomised. However, since the values never occur in the population, a (moderately sophisticated) fingerprinting service in this case could consistently infer that our browser type is rare--this is itself a potentially identifying characteristic! Thus, anonymity is compromised.

The only strategy which guarantees that anonymity is maintained is to match the distribution of values that we observe in the browser population, illustrated in the following figure:


By ensuring that values of User-Agent returned by our browser are randomized so that the probability of each value matches the probability of observing that value in the browser population, we never commit ourselves to identifying with a particular subset of the browser population, while ensuring that our browser doesn't use any rarely occurring User-Agent version. In this way, anonymity is maintained.

In the real-world scenario, where there are many potentially identifying browser characteristics, to maintain anonymity note that it is not sufficient to ensure individually for each characteristic that the probability of each value matches the population probability: we may risk returning rare combinations of values, thus compromising our anonymity; this may ultimately result in our browser being uniquely identifiable! Rather, it is necessary to apply the above considerations to the joint distribution of browser characteristics in the browser population, i.e. the probability of observing values for sets of browser characteristics.

share|improve this answer

Todays used fingerprints mostly rely on generating as much entropy as possible by exploiting as much details of the browser as they can. Even subtle, but short term stable details, like the exact (hardware and driver version dependent) rendering on a canvas is exploited. The information gathered is most likely compressed by generating a long enough hash value depending on all the details, eg. by adding all details to a long string or actually drawing something depending on the details into a canvas and apply a hash function to it.

However, as long as the information is compressed and not stored in full, the fingerprinting can be defended by frontal attack: Instead of trying to make the fingerprint as non-unique as possible, one can just try to make it as unique as possible, eg. unique per connection.

This can easily be achived by tampering with details that relying on would be very bad practice for a web page:

  • most insignificant digits of version numbers
  • hiding rare fonts
  • plugin detail description strings
  • ...

To circumvent this attack, the fingerprint would have to be fuzzy enough to go around the random parts, which means it can not hash the data as a whole and a lot of information would have to be transfered and stored.

Circumventing the attack by masking out the random parts would mean only use details the web pages also strongly rely on, which would need permanent adaption of the fingerprinting algorithm. The amount of necessarily non-random details will be somewhat limited by standardisation. However, it may still allow unique indentification if selected properly.

share|improve this answer

The panopticlick site has "self defense" recommendations to avoid tracking.

One of the recommendations is to use the torbutton. The torbrowser design docs have a good description of how they try to avoid browser fingerprinting and tracking.

All of these approaches are trying to normalize your profile to look like as many other people as possible.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.