Browser fingerprint

Collection happens in ordinary page code while the page is still loading. A property read costs nothing and asks nothing, so a whole set is gathered before the first picture appears.

No permission dialog appears, because the browser does not treat any of it as private. The technique works precisely on a visitor who has agreed to nothing.

1. 1

   Reads what is reported

   The user agent, the language list, the timezone, the screen size and the core count.

2. 2

   Draws and measures

   A canvas image, a WebGL frame, an audio buffer and the width of a string in a named font. Each of the four comes back slightly differently on different hardware.

3. 3

   Joins it into one value

   The joined text is hashed, and that hash is stored beside the account you just opened.

These five values are read in your browser on this page. A site that wanted them would read the same properties in the same order.

Nothing here leaves this page. The values are read and drawn on the spot, and a checker that sends your readings somewhere has already collected them.

The value rarely refuses a visit outright. It decides that two accounts belong to one person, and that decision arrives days after both were opened.

It also survives the things people expect to break it. A fresh window, a cleared jar and a different address leave it exactly where it was.

• Linking two accounts

  One fingerprint behind two logins is read as one person, whatever the addresses say. The link is drawn quietly and shows up as a suspension weeks later.

• Scoring a session

  An unusual set raises the score that decides whether a checkout or a login gets challenged. Rarity counts against you here even when nothing about it is wrong.

• Recognising a return

  A visitor who cleared everything is still recognised, which is the whole reason the technique exists. Storage rules apply to storage, and this is not storage.

Changing the user agent is the easiest change to make and the weakest one. The set has to agree with itself, and every reader inside the browser has to give the same answer.

Three disagreements measured on our own engine. Each is one line of the self-test, and each is a value a site can read in a few milliseconds.

A site does not need all three to act. One disagreement inside a single browser is stronger evidence than any unusual value on its own.

• The picture disagrees with itself

  A WebGL frame read straight from the buffer did not match the same frame copied onto a canvas.

  109 bytes

• The voice list names other languages

  A profile speaking one language carried the whole system voice list beside it.

  68 voices

• The connection answers its own number

  Reported latency did not match the number the profile was given, and no real link behaves that way.

  100 against 150

The seed reaches the engine on the launch line and the values are produced inside it, not written over the page by a script afterwards. A worker, a frame and the document therefore answer the same numbers, because all three inherit one source.

Two runs of the same acceptance harness: the build before the fingerprint patches, and the build shipping today.

• Cookies

  A cookie is a file left on your machine and you can delete it. A fingerprint is computed on demand, and there is no file to find.

• Your IP address

  The address says where the traffic comes out. The fingerprint says which machine sent it, and changing one leaves the other untouched.

• Canvas fingerprint

  That is one value inside the set, not the set itself. Fixing it alone leaves the other twenty odd readings as they were.

• Device fingerprint

  That phrase covers the machine rather than the browser, and the two overlap heavily. Two browsers on one computer still answer differently, so the browser is the unit that counts here.

The panel above shows five values for the browser you are reading this in. The full self-test lives in the app and runs inside a profile, against the engine that profile launched.

It reports every check by name, green and red alike. A checker embedded in a frame on a marketing page tells you about that page instead.

Read it against a second profile on the same computer. Two profiles that answer as two machines are the thing worth checking, and one run shows both.