  Browser fingerprinting aims to identify users or their devices, through
scripts that execute in the users' browser and collect information on software
or hardware characteristics. It is used to track users or as an additional
means of identification to improve security. In this paper, we report on a new
technique that can significantly extend the tracking time of fingerprint-based
tracking methods. Our technique, which we call DrawnApart, is a new GPU
fingerprinting technique that identifies a device based on the unique
properties of its GPU stack. Specifically, we show that variations in speed
among the multiple execution units that comprise a GPU can serve as a reliable
and robust device signature, which can be collected using unprivileged
JavaScript. We investigate the accuracy of DrawnApart under two scenarios. In
the first scenario, our controlled experiments confirm that the technique is
effective in distinguishing devices with similar hardware and software
configurations, even when they are considered identical by current
state-of-the-art fingerprinting algorithms. In the second scenario, we
integrate a one-shot learning version of our technique into a state-of-the-art
browser fingerprint tracking algorithm. We verify our technique through a
large-scale experiment involving data collected from over 2,500 crowd-sourced
devices over a period of several months and show it provides a boost of up to
67% to the median tracking duration, compared to the state-of-the-art method.
DrawnApart makes two contributions to the state of the art in browser
fingerprinting. On the conceptual front, it is the first work that explores the
manufacturing differences between identical GPUs and the first to exploit these
differences in a privacy context. On the practical front, it demonstrates a
robust technique for distinguishing between machines with identical hardware
and software configurations.
