Browser Fingerprinting and Privacy-Preserving Web Architecture

How Browsers Leak Identity, How Trackers Exploit It and How to Defend Users

Introduction: The Invisible Identifier

Chapter 1: The Browser as an Information Leak

1. The Browser’s Dual Role: Application Container and User Agent
2. From Mosaic to Modern Engines: A Brief History of Browser Capabilities
3. The Fundamental Tension: Rich Computing Versus Anonymous Access
4. Threat Models and Attack Surfaces

Chapter 2: Web Platform Fundamentals

1. HTTP/1.1, HTTP/2, HTTP/3: Protocols, Headers and State
2. TLS Handshake Mechanics and Cryptographic Negotiation
3. The Browser’s Same-Origin Policy and Its Variants
4. JavaScript Execution Environments and the Event Loop
5. The Origin Model, Cross-Origin Requests and CORS

Chapter 3: Online Tracking: History and Mechanisms

1. HTTP Cookies: Mechanics, Lifetime and Tracking Uses
2. Tracking Pixels and Beacon Requests
3. Third-Party Scripts and Advertising Technology Stacks
4. Local Storage and IndexedDB as Tracking Vectors
5. From Cookies to Fingerprinting: Why Tracking Evolved

Chapter 4: The Identification Problem: Entropy and Uniqueness

1. Entropy in Information Theory and Its Application to Identification
2. Measuring Uniqueness: Direct and Indirect Methods
3. The Fingerprint Entropy Calculation
4. Probabilistic Identification and False Positive Rates
5. Composition of Multiple Weak Signals into Strong Identifiers

Chapter 5: HTTP and TLS Fingerprinting

1. The TLS Client Hello: Structure, Extensions and Identifying Power
2. JA3, JA4 and TLS Fingerprinting Algorithms
3. HTTP Header Fingerprints: User-Agent, Accept and More
4. HTTP/2 and HTTP/3 Fingerprinting via Stream and Frame Behavior
5. Network Address and ASN Information

Chapter 6: Screen, Display and Window Characteristics

1. Screen Resolution, Color Depth and Pixel Ratio
2. The Window Size API and Resizing Behavior
3. Display Modes, Fullscreen and Picture-in-Picture
4. GPU Vendor and Device Strings
5. Cross-Platform Screen Enumeration Differences

Chapter 7: Canvas and WebGL Fingerprinting

1. Canvas Rendering Contexts and Subtle Rendering Variations
2. The Canvas Fingerprinting Technique: Algorithms and Entropy
3. WebGL Rendering Pipeline and GPU Identification
4. WebGL Extension Enumeration and Capability Testing
5. Shader Compilation and Vertex/Fragment Processing Leaks

Chapter 8: Web Audio Fingerprinting

1. Web Audio Architecture: Nodes, Contexts and Buffers
2. Floating-Point Arithmetic Variations Across Implementations
3. Constructing Audio Fingerprint Signals
4. Entropy and Stability of Audio-Based Fingerprints
5. Detection and Mitigation of Audio Fingerprinting

Chapter 9: Font Enumeration and Text Rendering

1. Font Detection via CSS and Canvas Measurement
2. The JavaScript Font Detection Algorithm
3. Text Rendering Engines: FreeType, Core Text, DirectWrite
4. Subpixel Rendering, Antialiasing and Their Fingerprinting Value
5. Cross-Platform Font Inventory Differences

Chapter 10: Hardware and System Properties

1. navigator.hardwareConcurrency and CPU Detection
2. Device Memory and RAM Estimation
3. Battery API and Power State Detection
4. USB, NFC and Peripheral Detection APIs
5. Sensor APIs: Accelerometer, Gyroscope and Geolocation

Chapter 11: JavaScript API Fingerprinting

1. Navigator Properties and Their Identifying Value
2. API Presence Detection: Feature Detection as Fingerprinting
3. Constructor Strings and Prototype Chain Information
4. Error Messages and Stack Trace Fingerprinting
5. Microtask and Task Scheduling Differences

Chapter 12: CSS-Based Detection Techniques

1. CSS Media Queries for Feature Detection
2. The @supports Rule and Its Fingerprinting Uses
3. Content-Based Detection via CSS :has() and Attribute Selectors
4. CSS-Only User Enumeration Attacks
5. Interaction with Server-Side Logging for Silent Fingerprinting

Chapter 13: Network Characteristics and Timing

1. High-Resolution Time: performance.now() and Its Implications
2. Network Information API and Connection Properties
3. DNS Resolution Timing and Fingerprinting
4. Resource Load Timing and Performance API Signals
5. Timing Attacks on Same-Origin Resources

Chapter 14: Behavioral and Interaction Signals

1. Mouse Movement and Click Patterns
2. Typing Dynamics and Keystroke Timing
3. Touch Events and Touchscreen Detection
4. Scroll Behavior and Viewport Interaction
5. Combining Behavioral Signals with Device Fingerprinting

Chapter 15: Commercial Tracking Systems and Signal Aggregation

1. The Advertising Technology Stack: DSPs, SSPs and Exchanges
2. Fingerprinting as a Service: FingerprintJS and Similar Platforms
3. Signal Aggregation: Combining Cookies, Storage and Fingerprints
4. Real-World Case Studies of Tracking Systems
5. The Economics of Browser Fingerprinting

Chapter 16: Fingerprint Stability and Cross-Site Correlation

1. Defining Fingerprint Stability and Measuring It
2. Temporal Persistence: How Long Do Fingerprints Last?
3. Cross-Site Correlation Techniques
4. Fingerprint Drift and Resilience Strategies
5. The Role of Browser Updates and System Changes

Chapter 17: Cross-Browser and Cross-Device Tracking

1. Shared Hardware Characteristics Across Browsers
2. Account-Based Correlation and Its Privacy Implications
3. Network-Level Cross-Browser Correlation
4. Cross-Device Graph Construction by Ad Networks
5. Defenses Against Cross-Browser Tracking

Chapter 18: Anti-Fingerprinting Strategies and Browser Defenses

1. Fingerprint Normalization: Principles and Implementation
2. Randomization vs. Uniformity in Anti-Fingerprinting
3. Firefox ESR and Strict ETP: Implementation Details
4. Safari’s Intelligent Tracking Prevention
5. Chromium’s Fingerprinting Protection Research

Chapter 19: Privacy-Preserving Web Architecture

1. Privacy-by-Design Principles for Web Architecture
2. Capability-Based Access Control for Browser APIs
3. Progressive Disclosure and Permission Prompts
4. The Privacy Sandbox Architecture
5. Decoupling Identity from Behavior

Chapter 20: Storage Partitioning and State Isolation

1. Same-Site Cookies and Their Limitations
2. Storage Access API and First-Party Sets
3. Partitioned Storage: Mechanisms and Trade-offs
4. Chrome’s Federated Learning of Cohorts Proposal History
5. Site Isolation and Process-Level Sandboxing

Chapter 21: Privacy Budgets and Differential Privacy

1. Differential Privacy: Definitions and Mechanisms
2. The Laplace and Exponential Mechanisms for Web Tracking
3. Privacy Budgets in Browser Telemetry
4. Applying Differential Privacy to Analytics
5. Trade-offs Between Privacy and Utility

Chapter 22: Network-Level Protections

1. DNS-over-HTTPS and DNS-over-TLS
2. Encrypted Client Hello and TLS 1.3 Extensions
3. Proxy Architectures and Tor Browser
4. Certificate Transparency and Connection Fingerprinting
5. QUIC Protocol and Its Privacy Implications

Chapter 23: Privacy-Preserving Authentication and Identification

1. Passkeys and WebAuthn: Authenticating Without Fingerprinting
2. Decentralized Identifiers (DIDs) and Verifiable Credentials
3. Privacy-Preserving Proofs: Zero-Knowledge Approaches
4. Session Management Without Cross-Site Tracking
5. Balancing Fraud Prevention with User Privacy

Chapter 24: Building Privacy-Respecting Web Applications

1. Minimal Data Collection and Purpose Limitation
2. On-Device Analytics and Edge Processing
3. Privacy-First Design Patterns for User Identification
4. Security Headers and Content Security Policies
5. Auditing Your Application for Fingerprinting Leakage

Chapter 25: End-to-End Implementations and Projects

1. Project 1: Browser Fingerprinting Measurement Framework
2. Project 2: Fingerprint Entropy Analysis Tool
3. Project 3: Tracking Detection Browser Extension
4. Project 4: Anti-Fingerprinting Extension
5. Project 5: Privacy-Preserving Web Application

Conclusion: The Path Forward

References