A comprehensive study of how fingerprintable users are

Here's what we want to present to you with this paper and the broader scope of our work. Fingerprinting test sites have a seemingly endless list of measurements they can pull from your browser. If a user has a unique fingerprint, it is typically not because of a single measurement, but it is also not because of 20 or 30 measurements. It is a small number of metrics that make users unique. In fact, it's very close to the 80/20 rule. Specifically, of all the users seen as unique by Fingerprint Pro (the most discerning fingerprinter we model) - 80% of them are unique after only 8 metrics - while the fingerprinter collects a total of over 50 metrics. Signifyd collects more metrics, but identifies fewer users as unique: 80% of the users it sees as unique will be identified after 9 metrics despite collecting over 80. Whenever someone cites a single percentage when describing "How many users are unique" - you should be suspicious. Because this collapses multiple different populations that behave very differently. Firstly, as a baseline, your operating system is always going to be exposed to a fingerprinter. We are always working within the constraint of web compatibility, and lying about the user's operating system breaks shortcut keys and gives you the wrong downloads among other problems. So if we know the website is going to learn your real OS anyway, we can use it to segment the population and analyze it separately. And when you do you see that each operating system behaves differently because they have different important metrics. Admittedly, it's very difficult to give a concise summary of work and also provide four sets of numbers - so even we fall prey to the trap of providing a single number, as we did in the prior paragraph. But every time we have a single percentage, somewhere we have that number broken down by operating system, and in doing so, you will see that each behaves differently. It's so, so easy to take all the results for a metric and just calculate Shannon entropy - it's a standard yardstick in this literature. But as we show - a high Shannon entropy does not reliably predict fingerprinting impact. Previous analyses calculated how many people were unique, but they did not analyze the other people - the ones who weren't. All those other people might be 1 million users who share one fingerprint or 500,000 distinct fingerprints shared by 2 people each - that's quite the difference. We use the Simpson Index (aka the Herfindahl–Hirschman Index) to quantify that difference and compare different sets of cohorts (shared fingerprints). This lets us compare how effective different fingerprinting defenses are based not just on how much uniqueness they eliminate but how much they collapse groups of users into each other. For example, two different protections can each lower the share of unique users by about 2.1 percentage points. But one improves the cohort score by 56%, while another raises it by only 13%. Judged on uniqueness alone, two defenses can look equally effective; while the cohort improvement varies significantly. Protections are not uniformly impactful, and the variation is not small. As an example, clamping the available screen resolution takes 25.3 percentage points off cumulative macOS uniqueness but between 0 and 3 points off the other three platforms. Averaged across all users, that 25-point drop shrinks to 3.5 - a protection that matters enormously to one platform can look marginal in the aggregate. This is yet another reason why it's so important to segment and analyze data on a per-operating-system basis. Making users report the same values makes them look more alike, but it never makes everyone look the same. Some users will still stand out, and that gets worse on websites with small visitor populations. Standardization improves the situation, but it should still be paired with randomization. Randomization is very strong when it works, but can always be detected and bypassed. Neither can carry the burden of providing privacy on its own. Correlating fingerprinting values with users' hardware and other characteristics let us identify why certain measurements differed between users. Knowing the root cause lets us build protections that reach much further, and protect small groups of users who would otherwise stand out as a minority. Addressing these differences has already produced more consistent outputs for image rendering, Web Audio, and mathematical operations on Android, with more root causes being investigated. Breakage from a strict mode is delayed, and the delay hides the cause. Turning on a stricter mode is a one-time act - but the broken website arrives later and nothing connects the two. From the user's perspective, this website doesn't work in Firefox and they have no idea why and are frustrated. Report after report we see people posting for help, confused - despite having taken specific action to enable a hidden setting opting them into strict fingerprinting protections. Users don't realize that a setting they changed caused the breakage, and don't know how to fix it - so a protection that breaks the web breaks the browser along with it. We selected and tuned mitigations on both measured impact and compatibility. For a default, compatibility isn't a trade-off against privacy - it's a precondition for it. The web is vast, and even the most innocuous change is likely to break something somewhere. Some breakage can be anticipated, which helps design, testing, and detection. The other breakage gets fixed only if a chain of luck holds: someone has to recognize the breakage, report it, reproduce it on the right hardware, and get it to the right person. Commercial fingerprinters evolve continuously, and they borrow openly from the community that studies them. Sites built to teach people about fingerprinting - CreepJS among them - get picked up and used outright by fingerprinting products. So we have been deliberately conservative. There are analyses this dataset would support that we have not run, data we could have released that we have not, and offensive angles on this work that we have not pursued. That is a choice rather than an oversight: we would rather leave a question open than make it easier to build a better fingerprinter.