The Cookie(-Less) Monster
What is Device Fingerprinting, and Can You Stop It?
With an increased focus on privacy thanks to revelations of massive spying by the NSA, computer users are (or should be) increasingly concerned about their security online. Most of us know about cookies, small pieces of data sent from a website and stored in a Web browser. These cookies enable sites to learn information about your location and browsing history. And while a user can disable cookies, a method called device or browser fingerprinting can identify users even without cookies.
What is Device Fingerprinting?
This method properties (without relying on cookies) from PCs, smartphones and tablets to identify and track users, even if they enable the “do not track” option.
When a phone, TV box or computer turns on, certain items and characteristics of a browser’s environment make it unique, such as:
- Screen dimensions
- Browser version
- List of plugins (like Flash and Java)
- List of installed fonts
- What the browser talks to
Device fingerprinting can then identify or partially identify the user through those characteristics.
Users who could be identified and tracked without cookies
The simplest reason is money. Advertisers stand to make billions off ads that target individual users.
Internet sales figures from January-June 2013, an all-time high, meaning the potential for massive profit is greater than ever
Is This Legal?
Yep. Regulations in the U.S. and Europe limit cookies, but these methods fall under the category of “supercookie,” meaning they’re outside of the traditional restrictions on tracking cookies.
Power for Good or Evil
- Fraud prevention
- Prevention of account hijacking
- Anti-bot services
- Certain opt-out services are more permanent (they don’t always vanish like deleted cookies)
- Obtain real-time marketing analytics
- Collect personal data
- No way to know you’ve been fingerprinted
- Few resources for prevention
Maintaining Your Privacy
While device fingerprinting is difficult to combat, there are steps you can take to make yourself a bit less vulnerable.
- Frequently change settings on computer
- Stick with stock system fonts
- Run Windows XP
- Use Firefox with no add-ons
- Turn off cookies
- Use tools that analyze websites for suspicious scripts, such as FPDetective