Fingerprinting: Difference between revisions

(16 intermediate revisions by 7 users not shown)

Line 1:

[[wikipedia:Fingerprint_(computing)|'''Fingerprinting''']] consists on attempting to uniquely identify someone or something, so that it becomes easier to [[wikipedia:Web_tracking|track]].

~~In computer science,~~ '''~~fingerprinting~~''' is a ~~procedure that maps~~ an ~~arbitrarily large~~ data ~~item~~ (such as a ~~computer file~~) to a ~~much shorter bit string, its '''''~~fingerprint~~''''',~~ that uniquely identifies the original data for all practical purposes just as human fingerprints uniquely entify people for practical purposes.<ref>{{Cite web |title=What is fingerprinting in Computer Science? |url=https://tolumichael.~~com/what-is-fingerprinting-in-cybersecurity/ |access-date=30 August 2025}}</ref>~~

A '''[[wikipedia:Device fingerprint|device fingerprint]]''' is a collection of information about a device's hardware and configuration. Unlike an IP address, which is a singular piece of data that users can manipulate for privacy and security (such as using a VPN service or resetting network connections), a device fingerprint holds a series of specified data that can be uniquely attributed to a device or user (or a group thereof), and are therefore much harder to protect from tracking and abuse of privacy.

==How it works==

Fingerprinting ~~works by getting a~~ data ~~item and turning it into a much shorter bit string that uniquely identifies itself~~. ~~This includes the operating system~~, ~~device model~~, screen resolution ~~and more~~.<ref>{{Cite web |title=How does device fingerprinting work? |url=https://www.crossclassify.com/resources/articles/how-does-fingerprinting-work/ |access-date=31 August 2025 |website=crossclasiffy.com}}</ref>

Fingerprinting can work in 2 ways:

*By collecting one or more data items (e.g. device hardware, web browser, browser plugins, configuration, screen resolution, installed fonts, etc...)<ref>{{Cite web |title=How does device fingerprinting work? |url=https://www.crossclassify.com/resources/articles/how-does-fingerprinting-work/ |url-status=live |archive-url=http://web.archive.org/web/20250907041725/https://www.crossclassify.com/resources/articles/how-does-fingerprinting-work/ |archive-date=7 Sep 2025 |access-date=31 August 2025 |website=crossclasiffy.com}}</ref> from the subject and turning the data into a much shorter bit string that uniquely identifies itself (typically by applying a [[wikipedia:Hash_function|hash-function]]), this string can be recomputed and then matched against a database, to repeatedly correlate subject activity. Even the ''lack of data can be used to build a fingerprint'', as certain data is unlikely to be missing. Because of the many different variables used to generate a fingerprint, adding extensions and changing settings intending to increase privacy may have the opposite effect.

*By inserting unique (or mostly unique) data into the subject, there's no need to recompute the fingerprint, so it can be compared and matched faster. An example of this is ''Unicode [[wikipedia:Steganography|steganography]]'', which consists on adding [[wikipedia:Zero_width|invisible]] and/or [https://www.unicode.org/reports/tr39/tr39-32.html#confusables confusable] (see [[wikipedia:Homoglyph|homoglyphs]]) characters in digital text, so that copy-pasting the text distributes the fingerprint.<ref>https://www.zachaysan.com/writing/2017-12-30-zero-width-characters</ref><ref>https://www.zachaysan.com/writing/2018-01-01-fingerprinting-update</ref> A more common example is tracking [[Web cookie|cookies]].

==Why it is a problem==

~~Fingerprinting can be used~~ to identify individuals, flagging privacy concerns and letting companies do things like targeted advertising, selling personal data and more.

While there are some benefits from a security perspective (e.g. trusted-device recognition and fraud prevention), fingerprinting allows entities (such as web servers) to identify individuals even while masking their IP address, flagging privacy concerns and letting companies do things like [[Personalized ads|targeted advertising]], selling personal data and more. It also allows another avenue for tracking across websites as services implemented on many different sites on the web (such as [[CDN|CDNs]]) will be able to follow device browsing from one website to another. <ref>{{Cite web |title=Browser Fingerprinting: What It Is and How to Block It |url=https://techreviewadvisor.com/browser-fingerprinting/ |access-date=10 October 2025 |website=techreviewadvisor.com |url-status=live |archive-url=http://web.archive.org/web/20251121085958/https://techreviewadvisor.com/browser-fingerprinting/ |archive-date=21 Nov 2025}}</ref>

==Remedies==

Device fingerprinting is difficult to avoid due to the aforementioned data points available. Notable remedies include using privacy-focused browsers such as [[Mullvad]], [[Brave browser|Brave]], or [[wikipedia:Tor_(network)#Tor_Browser|Tor]], which either randomizes certain data points to hide unique attributes or modifies identifiers to make all users appear to be the same in an effort to reduce the uniqueness of the system (AKA [https://en.wikipedia.org/w/index.php?title=Device_fingerprint&oldid=1330865841#Offering_a_spoofed_fingerprint spoofing]). <ref>{{Cite web |title=Anti-fingerprinting |url=https://tb-manual.torproject.org/anti-fingerprinting/ |website=tb-manual.torproject.org |url-status=live |archive-url=http://web.archive.org/web/20251029015145/https://tb-manual.torproject.org/anti-fingerprinting/ |archive-date=29 Oct 2025}}</ref>

~~==Examples==~~

For those looking to test browser protection against web fingerprinting, the [[wikipedia:Electronic_Frontier_Foundation|Electronic Frontier Foundation]] has a tool called [https://coveryourtracks.eff.org/ Cover Your Tracks] to display unique hardware and software fingerprints.

~~Some examples of~~ fingerprinting ~~include some types of cookies~~,

==References==

@@ Line 1: / Line 1: @@
-{{StubNotice}}
+{{StubNotice}}{{ToneWarning}}
+[[wikipedia:Fingerprint_(computing)|'''Fingerprinting''']] consists on attempting to uniquely identify someone or something, so that it becomes easier to [[wikipedia:Web_tracking|track]].
-In computer science, '''fingerprinting''' is a procedure that maps an arbitrarily large data item (such as a computer file) to a much shorter bit string, its '''''fingerprint''''', that uniquely identifies the original data for all practical purposes just as human fingerprints uniquely entify people for practical purposes.<ref>{{Cite web |title=What is fingerprinting in Computer Science? |url=https://tolumichael.com/what-is-fingerprinting-in-cybersecurity/ |access-date=30 August 2025}}</ref>
+A '''[[wikipedia:Device fingerprint|device fingerprint]]''' is a collection of information about a device's hardware and configuration. Unlike an IP address, which is a singular piece of data that users can manipulate for privacy and security (such as using a VPN service or resetting network connections), a device fingerprint holds a series of specified data that can be uniquely attributed to a device or user (or a group thereof), and are therefore much harder to protect from tracking and abuse of privacy.
 ==How it works==
-<!-- Can someone knowledgable enough please check this? -->Fingerprinting works by getting a data item and turning it into a much shorter bit string that uniquely identifies itself. This includes the operating system, device model, screen resolution and more.<ref>{{Cite web |title=How does device fingerprinting work? |url=https://www.crossclassify.com/resources/articles/how-does-fingerprinting-work/ |access-date=31 August 2025 |website=crossclasiffy.com}}</ref>
+<!-- Can someone knowledgable enough please check this? -->Fingerprinting can work in 2 ways:
+*By collecting one or more data items (e.g. device hardware, web browser, browser plugins, configuration, screen resolution, installed fonts, etc...)<ref>{{Cite web |title=How does device fingerprinting work? |url=https://www.crossclassify.com/resources/articles/how-does-fingerprinting-work/ |url-status=live |archive-url=http://web.archive.org/web/20250907041725/https://www.crossclassify.com/resources/articles/how-does-fingerprinting-work/ |archive-date=7 Sep 2025 |access-date=31 August 2025 |website=crossclasiffy.com}}</ref> from the subject and turning the data into a much shorter bit string that uniquely identifies itself (typically by applying a [[wikipedia:Hash_function|hash-function]]), this string can be recomputed and then matched against a database, to repeatedly correlate subject activity. Even the ''lack of data can be used to build a fingerprint'', as certain data is unlikely to be missing. Because of the many different variables used to generate a fingerprint, adding extensions and changing settings intending to increase privacy may have the opposite effect.
+*By inserting unique (or mostly unique) data into the subject, there's no need to recompute the fingerprint, so it can be compared and matched faster. An example of this is ''Unicode [[wikipedia:Steganography|steganography]]'', which consists on adding [[wikipedia:Zero_width|invisible]] and/or [https://www.unicode.org/reports/tr39/tr39-32.html#confusables confusable] (see [[wikipedia:Homoglyph|homoglyphs]]) characters in digital text, so that copy-pasting the text distributes the fingerprint.<ref>https://www.zachaysan.com/writing/2017-12-30-zero-width-characters</ref><ref>https://www.zachaysan.com/writing/2018-01-01-fingerprinting-update</ref> A more common example is tracking [[Web cookie|cookies]].
 ==Why it is a problem==
-Fingerprinting can be used to identify individuals, flagging privacy concerns and letting companies do things like targeted advertising, selling personal data and more.
+While there are some benefits from a security perspective (e.g. trusted-device recognition and fraud prevention), fingerprinting allows entities (such as web servers) to identify individuals even while masking their IP address, flagging privacy concerns and letting companies do things like [[Personalized ads|targeted advertising]], selling personal data and more. It also allows another avenue for tracking across websites as services implemented on many different sites on the web (such as [[CDN|CDNs]]) will be able to follow device browsing from one website to another. <ref>{{Cite web |title=Browser Fingerprinting: What It Is and How to Block It |url=https://techreviewadvisor.com/browser-fingerprinting/ |access-date=10 October 2025 |website=techreviewadvisor.com |url-status=live |archive-url=http://web.archive.org/web/20251121085958/https://techreviewadvisor.com/browser-fingerprinting/ |archive-date=21 Nov 2025}}</ref>
+==Remedies==
+Device fingerprinting is difficult to avoid due to the aforementioned data points available. Notable remedies include using privacy-focused browsers such as [[Mullvad]], [[Brave browser|Brave]], or [[wikipedia:Tor_(network)#Tor_Browser|Tor]], which either randomizes certain data points to hide unique attributes or modifies identifiers to make all users appear to be the same in an effort to reduce the uniqueness of the system (AKA [https://en.wikipedia.org/w/index.php?title=Device_fingerprint&oldid=1330865841#Offering_a_spoofed_fingerprint spoofing]). <ref>{{Cite web |title=Anti-fingerprinting |url=https://tb-manual.torproject.org/anti-fingerprinting/ |website=tb-manual.torproject.org |url-status=live |archive-url=http://web.archive.org/web/20251029015145/https://tb-manual.torproject.org/anti-fingerprinting/ |archive-date=29 Oct 2025}}</ref>
-==Examples==
+For those looking to test browser protection against web fingerprinting, the [[wikipedia:Electronic_Frontier_Foundation|Electronic Frontier Foundation]] has a tool called [https://coveryourtracks.eff.org/ Cover Your Tracks] to display unique hardware and software fingerprints.
-Some examples of fingerprinting include some types of cookies,
 ==References==