On the Workings and Current Practices of Web-Based Device Fingerprinting

By analyzing the code of three popular browser-fingerprinting code providers, the authors reveal the techniques that allow websites to track users without client-side identifiers. They expose questionable practices, such as the circumvention of HTTP proxies to discover a user's real IP address and the installation of intrusive browser plug-ins. In addition, they measure the adoption of fingerprinting on the Web and evaluate user-agent-spoofing browser extensions, showing that current commercial approaches can bypass the extensions and take advantage of their shortcomings.