Logo IMG
HOME > PAST ISSUE > March-April 2014 > Article Detail


Uniquely Me!

How much information does it take to single out one person among billions?

Brian Hayes

Font Sniffing

2014-03CompsciFp108top.jpgClick to Enlarge ImageThe history list is not the only part of a browser that a nosy website might try to sniff at. Peter Eckersley of the Electronic Frontier Foundation has cataloged a number of other browser properties that might also serve as identifiers. An intrusive program can enumerate the plug-ins or extensions installed in the browser, probe the list of fonts available for displaying text, or count the pixels on the computer’s screen.

Are plug-ins, fonts, and other such attributes of a web browser likely to provide a uniquely identifying portrait? This might seem unlikely, in that computers ship with built-in fonts, and browsers come with a standard set of plug-ins, and many users never meddle in such technical arcana. Eckersley investigated the question by experiment. Among volunteers who visited a website set up to perform profiling, he found that almost 84 percent of browsers “had an instantaneously unique fingerprint.” You can check your own browser configuration at When I visited recently, the site reported: “Your browser fingerprint appears to be unique among the 3,760,699 tested so far.”

One method of detecting fonts is similar to the trick for probing the history list. A website can request that text be displayed in a specific font; if the typeface is not available, the browser falls back to a default. The idea, then, is to ask for a sequence of characters to be rendered in many different fonts, and invoke a JavaScript function to measure the width and height of the resulting text. If the dimensions differ from those of the same character sequence in the default font, then the requested typeface must be installed on the user’s computer and available to the browser. (As with history sniffing, all the formatting and measuring can be done out of sight, without actually displaying anything on the screen.)

Browser designers could take steps to prevent font profiling through JavaScript, but it’s probably not worth the bother. There’s an easier way to get font information from browsers that have an Adobe Flash plug-in (as most do): The Flash scripting language includes a command to list all installed fonts.

A group of investigators at the Catholic University of Leuven have surveyed a million websites to see how many are exploiting intrusive technologies such as font sniffing. The reassuring news is that only a tiny fraction of the sites—perhaps one in a thousand—seem to be engaging in the most devious practices. On the other hand, a few of those sites are apparently large and popular ones.

Browser profiling is not always done for nefarious purposes. A bank might use a browser fingerprint to trigger extra security precautions when a customer logs in from an unfamiliar location. But even when the aims are legitimate, companies tend to be secretive about the practice. One prominent website that appears to engage in browser fingerprinting is the Skype telephone service. Skype’s 5,000-word privacy statement does not clearly disclose that fact.

The tracking methods I have described here are especially sneaky, but they are hardly the only threats to personal privacy on the Internet. Most tracking relies on “cookies” (text that a website can store in your browser) and “beacons” (links to images or other objects that reveal your arrival on a web page). The more elaborate sniffing methods may be aimed primarily at those who block cookies and beacons.

comments powered by Disqus


Subscribe to American Scientist