/Tracking/Fingerprinting/active/error_messages/

• $ fingerprint@info:~ echo $ERROR-MESSAGES

• Name:

  Error Messages
  

  Original feature purpose:

  Error messages help to handle controlled exceptions in an informative way and allow better analysis of unexpected conditions. The Error constructor in JavaScript creates an error object and instances of Error objects are thrown when runtime errors occur. These instances contain more detailed information as well as metadata about the error which has occurred. For more details see, e.g., MDN web docs

  
  

  FP-Explanation:

  Error messages are browser-dependent. For example, the Error Object in Firefox supports the attributes 'FileName', 'LineNumber' and 'ColumnNumber'. Firefox based browsers can show different values for 'ColumnNumber'. Internet Explorer is the only browser which has the attribute 'description'.
  All browsers have the 'message' attribute, but with their own message style and content. For example, the message string can start with an uppercase or lowercase letter, or the messages are completely different. But even if the error messages have identical strings, it is likely that the stack output will be different.
  The Error Stack has no standard, but is defined in most browsers. Thus, the format of the stack output varies across browser. For example, a browser may include error name, error message and anchor links in the stack - or not.
  Chrome and Opera share the same error messages, but - depending on the Opera Version - Opera's stack contains the string "('native')" while Chrome's stack does not contain this string. Also the string formatting can vary.
  Non mainstream browsers also handle error messages differently. For example, Midori echos out the complete error-producing code within the error message.
  This code:
  'x'.repeat(500000001);
  will result in this error message:
  undefined is not a function (evaluating ''x'.repeat(500000001)')
  ... and the following code:
  "<img onerror=alert('thats') src='bad'>".repeat(500000001);
  will open an alert-box on page load, if error messages are printed out on a website.

  
  

  FP-Type:

  active
  

  FP-Categories:

  js, js-attrib, software-dependent, consistent
  

  Counter-measures:

  Unwise counter-measures:

  • Block error message readouts
    Info: All browsers support error message readouts.
    Problem: Thus, only a very small portion of the internet community would block readouts.
  • Spoof error message readouts
    Problem: There are many other browser/version detection methods, so your browser will become more unique.
  
  

  Publications/References:

  • A privacy by design browser solution as protection against personalized online tracking (2019)
  • Browser Fingerprinting with Ajax
  
  
• $ fingerprint@info:~ run error-messages-demo

Demo:

>> Jump to Error Messages Demo <<