Princeton computer science researchers Steven Englehardt and Arvind Narayanan (previously) have just published a new paper, Online tracking: A 1-million-site measurement and analysis, which documents the state of online tracking beyond mere cookies — sneaky and often illegal techniques used to "fingerprint" your browsers and devices as you move from site to site, tracking you even when you explicitly demand not to be track and take countermeasures to prevent this.
Englehardt and Narayanan recorded an interview with Fivethirtyeight's What's the Point podcast (MP3), presenting their findings in an easily accessible summary that will do more to tighten your pelvic floor than an hour of kegels.
Arvind Narayanan: In the ad tech industry, cookies are gradually being shunted in favor of fingerprinting. The reason that fingerprinting is so effective is that even if you have a device that you think is identical to the device of the person sitting next to you, there are going to be a number of differences in the behavior of your browser. The set of fonts installed on your browser could be different. The precise version number of the browser could be different. Your battery status could be different from that of the person next to you, or anybody else in the world. And it turns out that if you put all of these pieces of information together, a unique or nearly unique picture of the behavior of your device emerges that's going to be relatively stable over time. And that enables your companies to recognize you when you come back.Jody Avirgan: But how does it enable that? My actual finger's fingerprint doesn't change from today to tomorrow. But my computer's battery status can change. So how do they know it's still you?
Narayanan: The battery status is actually the only exception to that general principle. And that's the reason why we're still figuring out how that works. [Editor's note: Earlier in the interview, Narayanan had mentioned that the rate at which your battery depletes might be an identifier.] But let's say you've got 41 fonts installed on your browser today. You come back in a week, maybe you have 43 fonts installed. But 41 of those are going to be the same as what they saw a week ago. And it changes slowly enough that statistically you can have a high degree of confidence. In the industry they call these things statistical IDs. It's not as certain as putting a cookie on your browser, but you can derive a very high degree of confidence.
Online tracking: A 1-million-site measurement and analysis [Steven Englehardt and Arvind Narayanan/Princeton]
Internet Tracking Has Moved Beyond Cookies
[Jody Avirgan/Five Thirty Eight]
(via Naked Capitalism)
