Panopticlick – How Unique, and Trackable, Is Your Browser?

Their paper [1] mentions this, and suggests that ~37% of individuals who returned for repeat testing had differing fingerprints (they assessed this via a control cookie, placed by the site). Although this seems high, this was over the entire life of the experiment, with some users returning after weeks or months.

Importantly, we can assume that the fingerprint will change incrementally, and remain mostly constant (eg., upgrade plugin OR install new fonts, but probably not everything at once). Therefore, closely-spaced repeat visits could be algorithmically matched, even if the fingerprint changes. This could be especially effective when including other "unstable" (short term) information, such as IP or geolocation, something the authors did not attempt (because these are generally unstable).

From the paper (page 13):

"We ran our algorithm over the set of users whose cookies indicated that they were returning to the site 1-2 hours or more after their first visit, and who now had a divergent fingerprint. Excluding users whose fingerprints changed because they disabled javascript (a common case in response to visiting panopticlick. eff.org, but perhaps not so common in the real world), our heuristic made a correct guess in 65% of cases, an incorrect guess in 0.56% of cases, and no guess in 35% of cases. 99.1% of guesses were correct, while the false positive rate was 0.86%. Our algorithm was clearly very crude, and no doubt could be signifcantly improved with effort."

[1] https://panopticlick.eff.org/browser-uniqueness.pdf

> isn't really a great way for websites to track users.

You are quite right, this is true, however it's not really about that.

Firstly this is one technique that when combined with other information becomes more valuable.

Secondly it's not for websites to track users, it's for tracking companies to track browsers across multiple websites.

For example: A credit scoring / user tracking company that your bank uses. You log into the bank system. You visit other websites which have a tracking system. The bank gets a profile of the types of websites you visit, to better profile the types of customers it has. The tracking service has a profile of the types of users that it sees, to better place advertisements for their other customers.

Thirdly, a fingerprint of this kind is more of a multi-dimensional nature, than just a hash of the results. It allows for some variation, it will also update itself based on other information. For example "oh it looks like they have added a new font, but the other information is the same, and their behaviour across all the sites we track them is the same"...

I have Java/Flash disabled by default and yet it was still able to populate a fonts list for me. Forgive my ignorance, but surely that's not possible?

Firefox 28 restricts the enumeration of navigator.plugins[] to reduce the impact of plugin fingerprinting. A website can directly query navigator.plugins["Some Plugin Name"] to check for a plugin, but no website should need to enumerate all installed plugins just to look for one particular plugin. Unfortunately, many major websites do, so enumerating Firefox's navigator.plugins[] will reveal QuickTime, Adobe Flash Player, Adobe Shockwave Player, and Java to avoid breaking those websites.

https://bugzilla.mozilla.org/show_bug.cgi?id=757726

Great for destroying user experience that uses these for valid reasons.

Use throw away virtual machines if you must, otherwise there is no easy workaround