  Recent works showed that websites can detect browser extensions that users
install and websites they are logged into. This poses significant privacy
risks, since extensions and Web logins that reflect user's behavior, can be
used to uniquely identify users on the Web. This paper reports on the first
large-scale behavioral uniqueness study based on 16,393 users who visited our
website. We test and detect the presence of 16,743 Chrome extensions, covering
28% of all free Chrome extensions. We also detect whether the user is connected
to 60 different websites.
  We analyze how unique users are based on their behavior, and find out that
54.86% of users that have installed at least one detectable extension are
unique; 19.53% of users are unique among those who have logged into one or more
detectable websites; and 89.23% are unique among users with at least one
extension and one login. We use an advanced fingerprinting algorithm and show
that it is possible to identify a user in less than 625 milliseconds by
selecting the most unique combinations of extensions.
  Because privacy extensions contribute to the uniqueness of users, we study
the trade-off between the amount of trackers blocked by such extensions and how
unique the users of these extensions are. We have found that privacy extensions
should be considered more useful than harmful. The paper concludes with
possible countermeasures.
