Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? What if you incorporate biometric data like mouse gestures or typing patterns? 

The other day I ran into the Panopticlick experiment EFF is running on browser fingerprints.

Of course I immediately thought of the privacy repercussions and how it could be used for evil. But on the other hand, this could be used for great good and, at the very least, it's a tempting problem to work on.

While researching the topic I found a few companies using browser fingerprinting to attack fraud. And after sending out a few emails I can confirm at least one major dating site is using browser fingerprinting as but one mechanism to detect fake accounts. (Note: They have found it's not unique enough to act as an identity when scaling up to millions of users. But, my programmer brain doesn't want to believe them).

Here is one company using browser fingerprints for fraud detection and prevention:
http://www.bluecava.com/

Here is a pretty comprehensive list of stuff you can use as unique identifiers in a browser:
http://browserspy.dk/

First, I don't think it's realistic to expect users to have JavaScript disabled on the modern web. So let's take a look at what Panopticlick can gather through JavaScript alone, along with the uniqueness score of my particular browser:


User Agent (1 in 4,184)
HTTP_ACCEPT Headers (1 in 14)
Browser Plugin Details (1 in 1.8 million)
Time Zone (1 in 24)
Screen Size and Color Depth (1 in 1,700)
System Fonts (1 in 11)
Cookies Enabled? (1 in 1.3)
Limited SuperCookie test (1 in 2)


The standouts for uniqueness are clearly User Agent and Browser Plugins. Remember that these items are used together to form a browser fingerprint, so they are more than as strong as the individual scores. The cumulative uniqueness here is: 4,184 x 14 x 1.8 million x 24 x 1,700 x 11 x 1.3 x 2 aka a REALLY BIG NUMBER. That's ... pretty unique.

I have Flash disabled at the moment, with "click to activate". Enabling Flash adds:


System Fonts (1 in 374k)


Flash provides the second most unique detectable element, but given the enormous number even the default JavaScript detection in Panopticlick produces, I'm not sure Flash is necessary for this sort of browser fingerprinting to work. Just JavaScript being enabled is enough.

Browser fingerprinting is merely a part of the story, though. Consider the sum of what all we can detect from anonymous users, because it can all work together to fingerprint anonymous users. How difficult is it to gather and use the detected data?


Browser detail sniffing, as shown above (easy)
IP Address, which has a known level of reliability with pros and cons (easy)
User behavior patterns such as usage (time of day), typing, mouse or finger movements, word use (hard, some server side, some client side)


One thing I worry about with browser sniffing alone is how trivially easy it is for users to switch browsers. There are at least four great and free browser alternatives on most platforms: Chrome, Opera, Firefox, Safari. So to break the browser sniffing, or at least interrupt it, you could switch browsers frequently. 

It's worth mentioning so-called SuperCookies here since they can actually work, in some cases, even if you switch browsers and even if JavaScript, HTML 5 Local Storage, and Flash are disabled. 


  A privacy researcher has revealed the evil genius behind a for-profit web analytics service capable of following users across more than 500 sites, even when all cookie storage was disabled and sites were viewed using a browser's privacy mode.


(If you're curious, the TL;DR version is that they do this by exploiting obscure principles of the ETag header.)

Anyway, getting back to browser sniffing -- there are two somewhat inconvenient things users can do to defeat this: 


Constantly switch browsers.
Always browse with JavaScript and Flash disabled.


However, if the user doesn't know that their browser settings are being sniffed and used as part of the method to fingerprint them, I highly doubt they would necessarily go to the trouble of doing these two things. It's work.

Based on the above data, I believe browser sniffing can help identify the typical anonymous internet user -- but it is only effective in combination with the other things we typically detect from anonymous internet users like IP Address.
