What is device fingerprinting?

Submitted by the community - Author: Anonymous

In the field of computer science, fingerprint generation It refers to the process of creating unique identifiers for various types of electronic data. And when we need to implement a technology to identify an individual user or device, we call them browser or device fingerprints.

Essentially, the process involves collecting information about a smartphone, computer or other device. Sometimes, even if the user hides the IP address or changes the browser, the device can be identified through fingerprint recognition.

Web analytics services have been collecting device and browser information for years with the goal of analyzing legitimate web traffic and detecting potential fraud. Nowadays, more advanced technologies have emerged that can collect specific parameters in the equipment.

Fingerprint technology was mainly used in the computer field before. Today, a new generation of technology can identify any type of device information, and the new generation continues to focus on the growing number of mobile applications.

How does it work?

In detail, device fingerprinting involves the collection of relevant data, and then merging and submitting the data sets through a hash function. The output of the hash function (hash value) can then be used as a unique ID for each device (or user).

The information collected is usually stored in the database rather than on the device side. While a single data point is generated in the same way, the combination of multiple data sets ultimately produces a unique fingerprint.

Device fingerprint identification methods can be divided into passive and active methods. The purpose of both methods is to collect device information. Therefore, even if there are thousands of computers running the same operating system, each computer can have a corresponding combination of software, hardware, browsers, plug-ins, languages, clocks, and general settings installed.

Passive device fingerprinting

As the name suggests, information is collected in a non-perceptual manner without requesting User (or remote system) consent. This approach collects data based on what each device sends, so passive fingerprinting tends to provide less specific information from the client (e.g., operating system).

For example, some developers have developed a passive fingerprint recognition technology that is used to collect wireless drive information on network devices (such as Internet modems). The program can interact passively with various types of drivers without requiring device operation. Simply put, different devices use different ways to scan for possible connections (access points) on the network. Therefore, attackers can also use these differences to identify exactly which driver is used by each target device.

Active fingerprint recognition

Another identification method is active fingerprint recognition, which requires active request for network communication , which makes their operation in the client easier to detect. Some websites run JavaScript code as a way to collect information about users' devices and browsers. The information collected includes window size, fonts, plug-ins, language settings, time zone, and even details about its hardware.

A typical example of active identification technology is canvas fingerprint recognition, which is often used in computers and mobile devices. Interactive scripts are usually based on the canvas (graphical element) of HTML5 web pages. The script records the hidden image drawn by the canvas on the screen, and then records the information contained in the image, such as screen resolution, font, and background color.

What is the specific use?

Device fingerprinting can provide advertisers with the ability to track consumer behavior across browsers. It can also help banking systems identify whether a user's request comes from a trusted device or from a system associated with fraudulent behavior.

In addition, device fingerprinting can also help websites identify the behavior of multiple account registrations, or help search engines identify devices with suspicious behavior.

Device fingerprinting can also come in handy when it comes to detecting and preventing identity theft or credit card fraud. However, these technologies may impact user privacy, especially when using passive fingerprinting, where some data collection methods may make it impossible for users to detect that personal data has been collected.

What are the restrictions?

In active fingerprinting, data collection relies on the availability of scripting languages such as JavaScript. However, when mobile devices and users run hidden programs or plug-ins, the availability of script execution may be affected, making it difficult for fingerprint recognition to identify the corresponding device information. These include browser plug-ins for blocking ads and trackers.

However, in some cases, some users who value privacy protection are more likely to be identified. For example, when they use some non-mainstream software and plug-ins with special settings, they will be more distinctive and easier to detect.

In addition, the effectiveness of fingerprinting may be affected by a large number of changes in the client. Users who continually change settings or use multiple virtual operating systems may be affected during data collection, resulting in inaccurate identification.

Using different browsers can also cause fingerprinting to make errors in collecting information, but these problems can now be avoided using modern cross-browser fingerprinting technology.

Summary

There are many ways to implement and use device fingerprinting technology. The effectiveness of collecting data and identifying the source of a device will vary depending on the method.

Whether used alone or in combination with other methods, device fingerprinting can be an effective tool for tracking behavior and identifying users. As such, this powerful technology can be used in both legal and illegal activities, so understanding their basic mechanics will help you become more familiar with the technology.