A Large-scale Empirical Analysis of Browser Fingerprints Properties for Web Authentication

TL;DR

This study evaluates the potential of browser fingerprints as a reliable and stable method for web authentication by analyzing a large dataset of over 4 million fingerprints across multiple attributes.

Contribution

It provides a large-scale empirical analysis linking browser fingerprint properties to biometric authentication factors, demonstrating their stability, distinctiveness, and practicality for web security.

Findings

Over 81% of fingerprints are unique to a single browser.

91% of fingerprint attributes remain unchanged over 6 months.

Fingerprints are small in size and quick to collect, with a low error rate in verification.

Abstract

Modern browsers give access to several attributes that can be collected to form a browser fingerprint. Although browser fingerprints have primarily been studied as a web tracking tool, they can contribute to improve the current state of web security by augmenting web authentication mechanisms. In this paper, we investigate the adequacy of browser fingerprints for web authentication. We make the link between the digital fingerprints that distinguish browsers, and the biological fingerprints that distinguish Humans, to evaluate browser fingerprints according to properties inspired by biometric authentication factors. These properties include their distinctiveness, their stability through time, their collection time, their size, and the accuracy of a simple verification mechanism. We assess these properties on a large-scale dataset of 4,145,408 fingerprints composed of 216 attributes, and collected from 1,989,365 browsers. We show that, by time-partitioning our dataset, more than 81.3% of our fingerprints are shared by a single browser. Although browser fingerprints are known to evolve, an average of 91% of the attributes of our fingerprints stay identical between two observations, even when separated by nearly 6 months. About their performance, we show that our fingerprints weigh a dozen of kilobytes, and take a few seconds to collect. Finally, by processing a simple verification mechanism, we show that it achieves an equal error rate of 0.61%. We enrich our results with the analysis of the correlation between the attributes, and of their contribution to the evaluated properties. We conclude that our browser fingerprints carry the promise to strengthen web authentication mechanisms.