Several top websites use device fingerprinting to secretly track users

October 10, 2013
Several top websites use device fingerprinting to secretly track users
Credit: © Shutterstock

( —A new study by KU Leuven-iMinds researchers has uncovered that 145 of the Internet's 10,000 top websites track users without their knowledge or consent. The websites use hidden scripts to extract a device fingerprint from users' browsers. Device fingerprinting circumvents legal restrictions imposed on the use of cookies and ignores the Do Not Track HTTP header. The findings suggest that secret tracking is more widespread than previously thought.

Device fingerprinting, also known as browser fingerprinting, is the practice of collecting properties of PCs, smartphones and tablets to identify and track users. These properties include the screen size, the versions of installed software and plugins, and the list of installed fonts. A 2010 study by the Electronic Frontier Foundation (EFF) showed that, for the vast majority of browsers, the combination of these properties is unique, and thus functions as a 'fingerprint' that can be used to track users without relying on cookies. Device fingerprinting targets either Flash, the ubiquitous browser plugin for playing animations, videos and sound files, or JavaScript, a common programming language for web applications.

This is the first comprehensive effort to measure the prevalence of device fingerprinting on the Internet. The team of KU Leuven-iMinds researchers analysed the Internet's top 10,000 websites and discovered that 145 of them (almost 1.5%) use Flash-based fingerprinting. Some Flash objects included questionable techniques such as revealing a user's original IP address when visiting a through a third party (a so-called proxy).

The study also found that 404 of the top 1 million sites use JavaScript-based fingerprinting, which allows sites to track non-Flash mobile phones and devices. The fingerprinting scripts were found to be probing a long list of fonts – sometimes up to 500 – by measuring the width and the height of secretly-printed strings on the page.

The researchers identified a total of 16 new providers of device fingerprinting, only one of which had been identified in prior research. In another surprising finding, the researchers found that users are tracked by these device fingerprinting technologies even if they explicitly request not to be tracked by enabling the Do Not Track (DNT) HTTP header.

The researchers also evaluated Tor Browser and Firegloves, two privacy-enhancing tools offering fingerprinting resistance. New vulnerabilities – some of which give access to ' identity – were identified.

Device fingerprinting can be used for various security-related tasks, including fraud detection, protection against account hijacking and anti-bot and anti-scraping services. But it is also being used for analytics and marketing purposes via fingerprinting scripts hidden in advertising banners and web widgets.

To detect websites using device fingerprinting technologies, the researchers developed a tool called FPDetective. The tool crawls and analyses websites for suspicious scripts. This tool will be freely available at for other researchers to use and build upon.

The findings will be presented at the 20th ACM Conference on Computer and Communications Security this November in Berlin.

Explore further: Google and Mozilla take 'Do Not Track' steps (Update)

Related Stories

Get dialed in on how to safeguard your smartphones

September 2, 2013

Remember the sneaky trick played by software makers? Download a free program and somehow it would automatically install an unwanted "search toolbar" on your computer's Internet browser. That annoying ploy hasn't disappeared ...

Recommended for you

Toyota promises better mileage and ride with Prius hybrid

October 13, 2015

Toyota Motor Corp. released details for its fourth-generation Prius on Tuesday, promising that improvements in the battery, engine, wind resistance and weight mean better mileage for the world's top-selling hybrid car.

Facebook to test mobile app shopping tab

October 12, 2015

Facebook said Monday that it will begin testing a shopping tab for its mobile app as it works to ramp up advertising and online commerce offerings.


Adjust slider to filter visible comments by rank

Display comments: newest first

1 / 5 (1) Oct 10, 2013
websites don't need to know which device is viewing them, i say sandbox the browser and randomise certain variables then no matter what the website won't be able to tell one device from another, personally though, i am going to go back to my old protective regime and disable javascript and plugins for all websites except the ones i approve
1 / 5 (1) Oct 10, 2013
Oddly, the Firefox plug-in, FireGloves, which supposedly protects against browser fingerprinting, isn't there. Am I paranoid to think it's been removed or hidden?
not rated yet Oct 10, 2013
websites don't need to know which device is viewing them

Actually, that's not really strictly correct. If a web site developer wants to serve a re-formatted version of the site to a user based upon say the screen dimensions and resolution (because it's not very helpful to be served a web site formatted for, say, a 1920 x 1080 pixel 17" monitor, for reading on a smart phone). To do this, you can either use JavaScript to ask for the inner dimensions of the window (viewport) and / or screen or figure this out from knowing the device (or both) since most e.g. handheld devices have a fixed screen size and resolution. The device type and browser making the web site request is normally sent to the server anyway so this is an easy and obvious "default' choice (though asking for the dimensions is often more exact, clearly).

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.