A new study by KU Leuven–iMinds researchers has uncovered that 145 of the Internet’s 10,000 top websites track users without their knowledge or consent.
The websites use hidden scripts to extract a device fingerprint from users’ browsers. Device fingerprinting circumvents legal restrictions imposed on the use of cookies and ignores the Do Not Track HTTP header. The findings suggest that secret tracking is more widespread than previously thought.
Device fingerprinting, also known as browser fingerprinting, is the practice of collecting properties of PCs, smartphones and tablets to identify and track users. These properties include the screen size, the versions of installed software and plugins, and the list of installed fonts. A 2010 study by the Electronic Frontier Foundation (EFF) showed that, for the vast majority of browsers, the combination of these properties is unique, and thus functions as a ‘fingerprint’ that can be used to track users without relying on cookies. Device fingerprinting targets either Flash, the ubiquitous browser plugin for playing animations, videos and sound files, or JavaScript, a common programming language for web applications.
This is the first comprehensive effort to measure the prevalence of device fingerprinting on the Internet. The team of KU Leuven-iMinds researchers analysed the Internet’s top 10,000 websites and discovered that 145 of them (almost 1.5%) use Flash-based fingerprinting. Some Flash objects included questionable techniques such as revealing a user’s original IP address when visiting a website through a third party (a so-called proxy).
The study also found that 404 of the top 1 million sites use JavaScript-based fingerprinting, which allows sites to track non-Flash mobile phones and devices. The fingerprinting scripts were found to be probing a long list of fonts – sometimes up to 500 – by measuring the width and the height of secretly-printed strings on the page.
Do Not Track
The researchers identified a total of 16 new providers of device fingerprinting, only one of which had been identified in prior research. In another surprising finding, the researchers found that users are tracked by these device fingerprinting technologies even if they explicitly request not to be tracked by enabling the Do Not Track (DNT) HTTP header.
The researchers also evaluated Tor Browser and Firegloves, two privacy-enhancing tools offering fingerprinting resistance. New vulnerabilities – some of which give access to users’ identity – were identified.
Device fingerprinting can be used for various security-related tasks, including fraud detection, protection against account hijacking and anti-bot and anti-scraping services. But it is also being used for analytics and marketing purposes via fingerprinting scripts hidden in advertising banners and web widgets.
Go deeper with Bing News on:
Device fingerprinting
- Google, Meta, Spotify break Apple's device fingerprinting rules – new claim
Last week, Apple began requiring iOS developers justify the use of a specific set of APIs that could be used for device fingerprinting. Yet the iGiant doesn't appear to be making much effort to ensure ...
- Fingerprint Cards AB (publ) publishes interim report for January – March 2024
Positive momentum in PC continued, with an 80-percent year-on-year growth Slight increase in gross margin compared to the previous quarter, as profitability in non-Mobile areas continues to be strong ...
- Fingerprint Cards strikes deals for biometric wearable, IP licensing
Infrafon is collaborating with Fingerprint Cards on the development and launch of a new multifactor authentication solution.
- Fingerprint & Oscilar team to enhance fraud prevention for FinTechs
IBS Intelligence (IBSi) is the world’s only pure-play Financial Technology focused research, advisory, and fintech news analysis firm, with a 30-year track record and clients globally. We take pride ...
- Fingerprints and Infrafon collaborating on new smart badges for the European Medical and IoT market
(Fingerprints™) and Infrafon, a German based biometric wearables technology startup, are collaborating to develop and launch biometric smart badge products for the European market. The Infrafon ...
Go deeper with Google Headlines on:
Device fingerprinting
[google_news title=”” keyword=”Device fingerprinting” num_posts=”5″ blurb_length=”0″ show_thumb=”left”]
Go deeper with Bing News on:
Tracking website users
- Boys track and field: South Jersey stars lead standout performances from Week 5
While Week 5 is the unofficial last week of county relay meets, we saw more then a fair share of individual historic performances at open meets. The competition was fierce at many of these open meets, ...
- Girls track & field: Sub-60 time in 400 hurdles leads Week 5′s standout performances
Ryan Jennings, of Timber Creek, runs in the girls 400-meter dash during the Tri-County Conference Track and Field Championships at Delsea Regional High School in Franklinville, Wednesday, May 17, 2023 ...
- The 13 Best Apps to Track Your Employees
Knowing exactly when your employees work and what they're working on can be challenging for business owners juggling mul ...
- AI Tracker: OpenAI brings ChatGPT memory feature to Plus users
In a post on X, OpenAI said users can just start a new chat and tell ChatGPT anything they’d like it to remember ...
- New WhatsApp iPhone Feature Urges iOS Users To Chat More
According to feature tracking website WABetaInfo, WhatsApp's latest update will allow users to access a new feature within their contacts lists to see who was recently online, including those of their ...
Go deeper with Google Headlines on:
Tracking website users
[google_news title=”” keyword=”tracking website users” num_posts=”5″ blurb_length=”0″ show_thumb=”left”]