/Tracking/Fingerprinting/active/js_echo/

• $ fingerprint@info:~ echo $JS-ECHO

• Name:

  JSEcho
  

  Original feature purpose:

  Most of the features used for this fingerprinting technique should extend the possibilities for web developers and allow to gather basic information about the browser to enhance the user experience. In the table below, for each test case, the specification of the tested feature can be found in the references column.

  
  

  FP-Explanation:

  JSEcho, is, in a broader sense, a variation of the first browser fingerprinting suite proposed by Peter Eckersley (a demonstration test launched on panopticlick.eff.org in 2010). Some fingerprinting features became outdated because browser vendors hardened JavaScript readouts to achieve a better privacy, and plugins like Flash Player were replaced by newer technologies. These stale features are therefore removed and not used in this fingerprinting suite. Instead, the omitted features are replaced by modern and up-to-date JavaScript API information and characteristics of the browsers.
  A major difference to other fingerprinting scripts, which generate a hash based on JavaScript property readouts, is that JSEcho does not only fingerprint property values, but also the JavaScript object itself, including its functions and prototypes. JavaScript objects will have different properties and values in different browsers. Iterating through an arbitrary JavaScript object returns a list of properties, which can be fingerprinted. For fingerprinting diversity, the order of the properties is most important. The order of the object properties varies across browsers. As a consequence, identical value extractions, performed by traditional JavaScript fingerprint readouts, will yield different results, if object properties and the order of the properties are also considered.
  
  For example, window.Intl.DateTimeFormat().resolvedOptions() property readouts:

  • Firefox:
      locale: de
      calendar: gregory
      numberingSystem: latn
      timeZone: Europe/Berlin
      day: numeric
      month: numeric
      year: numeric
    
  • Chrome:
      locale: de
      calendar: gregory
      numberingSystem: latn
      timeZone: Europe/Berlin
      year: numeric
      month: numeric
      day: numeric
    
  
  The values are identical, but the order is different (day/year).

  This applies to all JavaScript objects (JavaScript APIs, HTML Elements and CSS attributes). JSEcho currently fingerprints the result of more than 50 test cases. Unreliable features like browser resolution (which changes if the user resizes the browser window) are not included. More details to a specific test case can be found in the table below.

  
  

  FP-Type:

  active
  

  FP-Categories:

  js, js-attrib, html5, hardware-dependent, software-dependent, mixed-consistent
  

  Counter-measures:

  • Disable JavaScript
    Description: Disabling JavaScript blocks the fingerprinting technique completely.
    Info: With JavaScript disabled websites are likely to lose fundamental functionalities.
    
  
  

  Publications/References:

  • P Eckersley, How Unique Is Your Web Browser? (2010)
  • A privacy by design browser solution as protection against personalized online tracking (2019)
  
  
• $ fingerprint@info:~ run js-echo-demo

Demo:

>> Jump to JSEcho Fingerprinting Demo <<