14 DAY TRIAL // The Electronic Frontier Foundation EFF has revealed the results of an interesting study regarding online privacy. While most people seem concerned with sites like Facebook or Google amassing too much private information or making it too public, it looks like a user’s browser can be as much of a risk to privacy as anything else. The study found that 84 percent of the participants were fully identifiable based solely on their browser, plugin configurations and the limited data provided by web browsers.
Volunteers in the study were asked to visit a site set up by EFF. The site would then log the operating system, browser, and browser plug-ins of each visitor creating a profile. This data is freely provided by most browsers as it enables sites to adapt to the user’s software and hardware configuration. The assumption here is that these tidbits of data are harmless and should be safe to share. After all, a lot of people are going to have the same Firefox version you have or the same screen resolution.
It turns out though that by aggregating all the data made available, a unique profile of the user could be created in 84 percent of cases. What’s more, for those with the Adobe Flash or Java runtime plugins installed, the percentage rose to 94 percent. And we’re talking about a sample size of close to a million visitors. You can take the test yourself and find out if the data your browser provides can make you identifiable. It most cases, the answer will be yes.
"We took measures to keep participants in our experiment anonymous, but most sites don't do that," EFF Senior Staff Technologist Peter Eckersley said. "In fact, several companies are already selling products that claim to use browser fingerprinting to help websites identify users and their online activities. This experiment is an important reality check, showing just how powerful these tracking mechanisms are."
It’s not time to start panicking just yet, but it is food for thought. What’s more, the EFF says these kinds of methods may already be used in the wild. At this point, the threat is largely hypothetical. Scripts to log and store this data would have to be deployed across a number of sites before this approach would be a viable tracking system. But if it were to happen, users today would have little means of protecting their privacy and concealing the data shared.