What is a browser fingerprint?

When you visit some social network sites such as Facebook, or Instagram, or some e-commerce sites such as Amazon, or etsy, these sites are collecting all sorts of details related to your browser: such as your IP address, the operating system you are using (e.g., Windows or macOS), the resolution of the screen, and even what fonts you have installed, and so on. These seemingly insignificant pieces of information, when put together, form a browser fingerprint. This fingerprint is in most cases unique, and like a real-life fingerprint, it allows a website to recognize you as a unique visitor - even if you have cleared cookies or are in "Incognito mode” - and it can still be collected using technical means.

Why do the websites collect my browser fingerprint?

Browser fingerprint is important because it allows websites to remember who you are. E-commerce sites and social media platforms want their user to be a real person, and they usually do not ant to see one person holding a large number of accounts.

But in reality, especially with needs,  it's necessary for a team or a company to operate multiple accounts. This is why understanding what browser fingerprint is becomes very important. Knowing each browser fingerprint parameter allows them to set up their browser fingerprint more wisely and ensures each account run securely.

Common browser fingerprint parameters

IP address

An IP address, full name Internet Protocol Address, is used to identify each device on the Internet, much like every household has a unique street address. Every device connected to the Internet needs to have an IP address.

IP addresses are divided into IPv4 addresses and IPv6 addresses.

IPv4, short for Internet Protocol version 4, is one of the most widely used protocols on the Internet.

An IPv4 address consists of 32-bit binary numbers, i.e., four groups of numbers ranging from 0 to 255. For example, 192.168.1.1, 134.110.68.72, 46.108.92.133... IPv4 can represent a total of 4,294,967,296 addresses, approximately 4.2 billion addresses.

Now, with over 7 billion people globally, the number of devices connected to the Internet has far exceeded 7 billion. The quantity of IPv4 addresses is no longer sufficient to assign one IP address to each device. In order to address the depletion of IPv4 addresses, IPv6 addresses were created.

IPv6 consist of 8 groups, with each group composed of 4 numbers or letters from 0 to 9, A to F.

IPv6 are 128 bits long, capable of representing 2 to the power of 128 addresses: 340,282,366,920,938,463,463,374,607,431,768,211,456.

If you're interested, you can patiently count the units in this string of numbers. If you still can't grasp the scale, let me provide a vivid analogy: We could allocate an IPv6 address for every single grain of sand on Earth.

Since IPv6 addresses require support from Internet Service Provider(ISP) equipment, we seldom come across them in our daily usage. If you encounter an IPv6 address for the first time, don't be alarmed and think your IP address has turned into gibberish. It simply means your ISP has assigned you an IPv6 address. You can still use Internet as usual.

To learn more about Ip address, please refer to： https://blog.browserscan.net/docs/ip-address  

User Agent

What is a User Agent?

A user agent is any software that interacts with web servers on behalf of Internet users. They can also be seen as a bridge between you and the Internet.

Any software that sends web requests to web servers is a user agent whether its works independently of human interaction as it is in the case of automation tools or bots or in the case of web browsers and other software that accept direct commands from humans.

Take, for instance, if you want to send access content online, you will have to make use of a web browser that serves as the user agent that deals with retrieving, rendering, and making it possible for you to interact with the content.

In a network protocol, the client is seen as the user agent, which is used in communication with a client-server network system. It might interest you to know that your email reader is a mail user agent.

User agents do not stop there – your gaming console can be a user agent, so is your smart TV and other Internet-enabled devices. In the Hypertext Transfer Protocol (HTTP), clients (user agents) are identified using the user-agent header.

Uses of User Agents

You might be wondering why would client software identify itself and what do web servers need that information for? It turns out that user agents have two major uses. These include content negotiation and access granting and blocks.

Content Negotiation

There are many variants of a web page served to devices based on their capabilities. Take, for instance, the structure of the Google search engine result page varies depending on the browser or platform you are using to access it. By looking at the user agent string, Google is able to serve you the best version for your browser and device.

There are many other sites on the Internet that make use of user-agent for providing a better user experience. Without a user-agent, at best, you are served the generic version of a page, which may or may not render well on your browser. Bot developers use this to walk around avoiding JavaScript-rich site by using mobile browser agents that will get web servers to return a non-JavaScript heavy version of a page.

Access Negotiation and Blocks

Perhaps, the most popular use of the user-agent string is to know whether a particular client software has the access right to access certain content or not. Web servers use the user-agent string in an HTTP request header to exclude crawlers, scrapers, and other bots from accessing their platform.

Many of the popular websites on the Internet frown at bot traffic and, as such, will deny access to user-agents other than that of popular browsers. While they do this internally, they can provide web crawlers signals via the robots.txt file – and expect you to follow the directives in there. Generally, web servers only want to allow access to traffic originating from a user and tend to block traffic from automated sources, except there’s a benefit for them.

To learn more about User Agent, please refer to: https://blog.browserscan.net/docs/useragent

Cookie

Cookie, a type of “small text file”, refers to data (usually encrypted) that some websites store on the user’s local terminal (Client Side) in order to identify the user.

Because the HTTP protocol is stateless, that is, the server does not know what the user did last time, which severely hinders the implementation of interactive web applications. In a typical online shopping scenario, a user browses several pages and buys a box of biscuits and two bottles of drinks. At the final checkout, due to the stateless nature of HTTP, the server does not know what the user bought without additional means, so cookies are one of the “extra means” used to bypass the statelessness of HTTP. The server can set or read the information contained in Cookies to maintain the state of the user in the conversation with the server.

In the shopping scenario just now, when the user purchases the first item, the server sends a cookie to the user while sending the web page to the user, recording the information of that item. When the user visits another page, the browser will send the cookie to the server, so the server knows what he bought before. The user continues to purchase drinks, and the server adds new product information to the original cookie. At checkout, the server just reads the cookie sent.

Another typical application of cookies is when logging in to a website, the website often asks the user to enter a user name and password, and the user can check “Automatic login next time”. If checked, the next time the user visits the same website, the user will find that he has logged in without entering the user name and password. This is precisely because the server sent a cookie containing login credentials (an encrypted form of user name and password) to the user’s hard disk during the previous login. When logging in for the second time, if the cookie has not expired, the browser will send the cookie and the server verifies the credentials, so the user can log in without entering the user name and password.

WebRTC

WebRTC, which stands for Web Real-Time Communication, allows for real-time communication between web browsers without the need for plugins or third-party applications. Besides Facebook Messenger, WhatsApp, Discord, Google Meet, and Zoom, there are numerous other applications that utilize WebRTC technology. These applications include various communication platforms and services.

WebRTC uses STUN or TURN servers to obtain the user's real IP address for establishing peer-to-peer connections. This is part of WebRTC's real-time communication, but it has raised concerns about privacy and security, as your real IP address may be leaked.

To learn more about WebRTC please refer to: https://blog.browserscan.net/docs/webrtc-fingerprinting

Timezone

When we visit a website, an IP address is required. Each IP address has a geographical location: country, state/province, city, longitude and latitude. As we learned in geography class, each country/region has a time zone. Some countries, due to their vast size, span several time zones. For example, Russia has 11 time zones, and the United States and its territories have 9 time zones.

From the above, we know that websites can use various online services or IP databases to map IP addresses to actual geolocation, including countries, cities, and even more specific locations. Once the geolocation is obtained, the website can use this information to determine the time zone of that location.

Once the time zone is known, the website can convert the server's system time to local time. This is usually achieved by adding the offset of the time zone (i.e., the difference between UTC and local time) to the system time.

AdsPower displays Greenwich Mean Time when you open the browsers.

To learn more about Timezone please refer to: https://blog.browserscan.net/docs/ip-time-zone-and-system-time

Geolocation

The Geolocation API provides websites with a high-level interface that enables them to query physical location information, such as latitude and longitude, potentially compromising the user's anonymity. This page will check if the Geolocation API works in your browser, display all retrievable data, and ensure that websites cannot access the API without your explicit permission.

To learn more about WebRTC please refer to:  https://blog.browserscan.net/docs/geolocation

Language

Language is one of the basic fingerprints of the browser. The basic fingerprint of the browser is a characteristic identifier that any browser has, including screen resolution, hardware type, operating system, user agent, system font, language, browser plug-in, Browser extensions, browser settings, time zone differences and many other information, these fingerprint information is similar to human height, age, etc., there is a high probability of conflict, can only be used as auxiliary identification.

To learn more about Language please refer to: https://blog.browserscan.net/docs/language

Screen Resolution

Screen resolution refers to the clarity of text and images displayed on the screen. The larger the monitor, the higher the resolution usually supported. Whether the screen resolution can be increased depends on the size and capabilities of the monitor and the type of video card used. Technically speaking, “resolution” is the number of pixels per unit area, not the total number of pixels.

Fonts

Font fingerprinting techniques rely on measuring the dimensions of HTML elements filled with text or single Unicode glyphs. However, font rendering in web browsers can be affected by multiple factors, leading to subtle differences in these measurements.

Font metrics measurement is a brute force method that tries different fonts from a large dictionary of known typefaces. By comparing the size of the rendered element to the default values, this method can determine if a font is present on the system.

Unicode glyphs measurement technique uses special Unicode characters with a large font size and default letterforms as a font-family to create fingerprints by hashing the obtained measurement results.

Reference: https://browserleaks.com/fonts

Canvas

Canvas fingerprinting is a recognition method that captures distinctive device characteristics through the Canvas element in HTML5. The Canvas element is an HTML5 tag used for drawing graphics and images on a web page. It enables the dynamic generation, display, and modification of images using JavaScript code. Canvas fingerprinting exploits the subtle variations in how browsers render the Canvas element, resulting in the creation of a unique fingerprint.

We all know that disabling cookie functionality can prevent cookie tracking. However, disabling canvas tracking is not as straightforward.

If we completely disable the Canvas element, what would happen?

The webpages you visit may not load properly since you are blocking the normal display of canvas elements. Additionally, from the perspective of the website, while every other user has canvas elements displayed, you stand out by not having them, which may raise suspicions by the website.

According to BrowserScan's research on privacy and security, in most cases, "Replace" solutions are preferable to "Disable" solutions. If a website requires user data, users can use randomly generated canvas fingerprints as substitutes for their real canvas fingerprints. This allows the website to obtain data while preserving privacy and security, achieving two goals at once.

There are plugins available in the market specifically designed to generate canvas fingerprints, but their effectiveness and security are still under observation. In most cases, using a fingerprint browser is the most convenient option, as it can mask the real device's canvas fingerprint almost entirely.

Reference: BrowserScan

WebGL

WebGL is a JavaScript API used to render interactive 2D and 3D graphics in any compatible web browser without using plug-ins. WebGL is fully integrated into all webpage standards of the browser, and GPU acceleration of image processing and effects can be used as part of the webpage Canvas. WebGL elements can be added to other HTML elements and mixed with other parts of the web page or web page background. The WebGL program consists of a handle written in JavaScript and a shader code written in OpenGL Shading Language (GLSL), which is similar to C or C++ and runs on the graphics processing unit (GPU) of the computer.

To learn more about WebG please refer to: https://blog.browserscan.net/docs/webgl-fingerprinting

WebGPU

WebGPU is a new technical standard that allows web applications (such as browser games, online video editing tools, etc.) to efficiently use the Graphics Processing Unit (GPU) of the computer for graphics rendering and computation. Its goal is to provide more powerful, faster and safer graphics performance than the existing WebGL technology.

WebGPU, in its quest to render complex graphics, needs to access the device information related to a user's graphics card. This helps to better utilize system resources. However, since each user's device information varies, this data can be used to create a unique browser fingerprint. By comparing differences in how hardware handles rendering tasks and performance, websites can use these unique WebGPU fingerprints to identify and track users.

Reference: BrowserScan

Audio

Audio fingerprinting is a relatively new fingerprint tracking technology. The basic principle is that due to minor differences in hardware and software configurations, different devices will produce minor differences when playing the same audio. These differences can be captured and used to generate a unique identifier for the device, i.e., the "Audio Fingerprints".

The technical principles involved in audio fingerprinting technology mainly include audio processing and signal analysis, and specific operations usually require the use of the browser's Web API, such as the AudioContext interface.

Reference: BrowserScan

Media Device

Media Device fingerprinting refers to the creation of a unique identifier by detecting and analyzing the properties of media devices on a user's device. These media devices include cameras, microphones, and so on. The technology of media device fingerprinting utilizes the subtle differences between devices to identify and track users for purposes such as user identification and targeted advertising.

Reference: BrowserScan

Client Rects

Client Rects is a browser API that provides layout information for webpage elements, including the position and size of the elements. This information is referred to as "rectangles" (rects).

The reason why Client Rects can become a browser fingerprinting technology is that even if two devices open the same webpage, due to differences in their hardware configuration, operating system, browser type and version, screen resolution, font settings, etc., the layout information of the rendered webpage elements may differ. These differences can be used to generate a unique identifier, that is, a browser fingerprint.

For example, the monitor of one device may display an element larger or smaller than the monitor of another device, or in a different position on the screen. These differences can be captured through the Client Rects API.

In summary, Client Rects is like a "ruler" and "notebook" for websites, which can help them identify and remember you. But this does not mean that the website can know who you are or what you are doing. They just record how your browser displays web pages and some basic information about your device. The website needs to combine other fingerprint information to improve the accuracy of the fingerprint.

Reference: BrowserScan

SpeechVoices

The Web Speech API SpeechSynthesis interface is the control interface for the speech service; it can be used to obtain information about the synthesized sounds available on the device.

Mac Address

Just like each house has its own postal address, every device connected to a network has a Media Access Control (MAC) address, that uniquely identifies it.

The MAC address is tied to the Network Interface Controller (NIC), a subcomponent of the larger device. The NIC is where you make your physical connection to the network, by plugging in an Ethernet cable or connecting to a WiFi signal.

Q: Should I turn on Mac Address?

A: Many sites can't get Mac addresses. So, it doesn't matter much if you don't turn it on. However, if you are doing Google-related business, it may be better to turn on. After all, Chrome browser is developed by Google, so he may have permission to get more information about the browser.

Reference: https://blog.browserscan.net/docs/mac-addresss-vs-ip-address

Do Not Track

The principle of Do Not Track is based on a special flag in the HTTP request headers. It sends a request to websites and advertisers indicating that the user does not want to be tracked. Here are some key technologies of Do Not Track:

• HTTP header flag: When users enable the Do Not Track option in their browser, the browser adds a special flag to the headers of each HTTP request, indicating that the user has chosen not to be tracked.
• DNT flag: This special flag is called the Do Not Track (DNT) flag, with a value of 1 indicating that the user has enabled Do Not Track, and a value of 0 indicating that the user has not enabled the option.
• Sending the DNT signal: When a user visits a website or initiates an HTTP request, the browser includes the DNT flag in the request headers. This flag informs websites and advertisers of the user's Do Not Track preference.
• Website response: Once a website or advertiser receives a request with the DNT flag, they can decide how to respond based on their own policies and ethical guidelines. Some websites and advertisers may respect the user's request and stop collecting and tracking their online behavior, while others may choose to ignore the request.

As you may have noticed, Do Not Track only provides an option for users to express whether they want to be tracked or not. Whether websites and advertisers will comply with the user's request depends entirely on their own policies and ethical standards.

It's a bit like an agreement between gentlemen. If a website doesn't comply with the DNT request, there isn't much a user can do.

Reference: BrowserScan