Choose: Simple Style

Fingerprinting JSEcho

║▌║▌│█║▌║│█│█║

/Tracking/Fingerprinting/active/js_echo/

  • $ fingerprint@info:~ echo $JS-ECHO
  • Name:

    JSEcho

    Original feature purpose:

    Most of the features used for this fingerprinting technique should extend the possibilities for web developers and allow to gather basic information about the browser to enhance the user experience. In the table below, for each test case, the specification of the tested feature can be found in the references column.


    FP-Explanation:

    JSEcho, is, in a broader sense, a variation of the first browser fingerprinting suite proposed by Peter Eckersley (a demonstration test launched on panopticlick.eff.org in 2010). Some fingerprinting features became outdated because browser vendors hardened JavaScript readouts to achieve a better privacy, and plugins like Flash Player were replaced by newer technologies. These stale features are therefore removed and not used in this fingerprinting suite. Instead, the omitted features are replaced by modern and up-to-date JavaScript API information and characteristics of the browsers.
    A major difference to other fingerprinting scripts, which generate a hash based on JavaScript property readouts, is that JSEcho does not only fingerprint property values, but also the JavaScript object itself, including its functions and prototypes. JavaScript objects will have different properties and values in different browsers. Iterating through an arbitrary JavaScript object returns a list of properties, which can be fingerprinted. For fingerprinting diversity, the order of the properties is most important. The order of the object properties varies across browsers. As a consequence, identical value extractions, performed by traditional JavaScript fingerprint readouts, will yield different results, if object properties and the order of the properties are also considered.

    For example, window.Intl.DateTimeFormat().resolvedOptions() property readouts:

    • Firefox:
        locale: de
        calendar: gregory
        numberingSystem: latn
        timeZone: Europe/Berlin
        day: numeric
        month: numeric
        year: numeric
    • Chrome:
        locale: de
        calendar: gregory
        numberingSystem: latn
        timeZone: Europe/Berlin
        year: numeric
        month: numeric
        day: numeric

    • The values are identical, but the order is different (day/year).

    This applies to all JavaScript objects (JavaScript APIs, HTML Elements and CSS attributes). JSEcho currently fingerprints the result of more than 50 test cases. Unreliable features like browser resolution (which changes if the user resizes the browser window) are not included. More details to a specific test case can be found in the table below.


    FP-Type:

    active

    FP-Categories:

    js, js-attrib, html5, hardware-dependent, software-dependent, mixed-consistent

    Counter-measures:

    • Disable JavaScript
      Description: Disabling JavaScript blocks the fingerprinting technique completely.
      Info: With JavaScript disabled websites are likely to lose fundamental functionalities.

    Publications/References:


  • $ fingerprint@info:~ run js-echo-demo
  • Demo:

    >> Jump to JSEcho Fingerprinting Demo <<


JSEcho Fingerprint Info:

Below you can find a list of properties extracted with JavaScript.

Your JSEcho fingerprint: ---


Info: You can ignore the DRM info message displayed by your browser (do not click activate)

Fingerprint Info:
  • The hash created from window properties is site specific, changing the style will result in a different hash.
  • Test cases marked with an asterisk* (i.e. "Connection", "Speech Voices", "SupportedEMEs") are disabled for fingerprinting because these tests are asynchronous



JSEcho Table Results
Test case Result/Hash Description References