- User Agent (1 in 4,184)
- HTTP_ACCEPT Headers (1 in 14)
- Browser Plugin Details (1 in 1.8 million)
- Time Zone (1 in 24)
- Screen Size and Color Depth (1 in 1,700)
- System Fonts (1 in 11)
- Cookies Enabled? (1 in 1.3)
- Limited SuperCookie test (1 in 2)
The standouts for uniqueness are clearly User Agent and Browser Plugins. Remember that these items are used together to form a browser fingerprint, so they are more than as strong as the individual scores. The cumulative uniqueness here is:
4,184 x 14 x 1.8 million x 24 x 1,700 x 11 x 1.3 x 2 aka a REALLY BIG NUMBER. That's ... pretty unique.
I have Flash disabled at the moment, with "click to activate". Enabling Flash adds:
Browser fingerprinting is merely a part of the story, though. Consider the sum of what all we can detect from anonymous users, because it can all work together to fingerprint anonymous users. How difficult is it to gather and use the detected data?
- Browser detail sniffing, as shown above (easy)
- IP Address, which has a known level of reliability with pros and cons (easy)
- User behavior patterns such as usage (time of day), typing, mouse or finger movements, word use (hard, some server side, some client side)
One thing I worry about with browser sniffing alone is how trivially easy it is for users to switch browsers. There are at least four great and free browser alternatives on most platforms: Chrome, Opera, Firefox, Safari. So to break the browser sniffing, or at least interrupt it, you could switch browsers frequently.
A privacy researcher has revealed the evil genius behind a for-profit web analytics service capable of following users across more than 500 sites, even when all cookie storage was disabled and sites were viewed using a browser's privacy mode.
(If you're curious, the TL;DR version is that they do this by exploiting obscure principles of the ETag header.)
Anyway, getting back to browser sniffing -- there are two somewhat inconvenient things users can do to defeat this:
- Constantly switch browsers.
However, if the user doesn't know that their browser settings are being sniffed and used as part of the method to fingerprint them, I highly doubt they would necessarily go to the trouble of doing these two things. It's work.
Based on the above data, I believe browser sniffing can help identify the typical anonymous internet user -- but it is only effective in combination with the other things we typically detect from anonymous internet users like IP Address.