Eadem, Sed Aliter: Investigating the Instability of Browser Fingerprinting#

Authors: Xu Lin, Jacob Anthony Eckfeldt (Washington State University), Shujiang Wu, Pengfei Sun (F5, Inc.), Jason Polakis (University of Illinois Chicago)

• Why: Browser fingerprinting increasingly shows up as an authentication and fraud signal, so its actual stability matters to identity work. This paper subverts the community's established understanding: fingerprints are inherently unstable even when nothing about the device changes.
• What: An in-depth analysis of fingerprints from users authenticating to high-value web services, revealing that prevalent attributes change even in stable execution environments (e.g., minor deviations in browsers' floating-point arithmetic or HTML element-size calculations) — a fundamental obstacle to fingerprinting's real-world effectiveness. It then proposes Predictive-FP, an adaptive strategy that uses historical population-wide information to anticipate unstable values and ignores ephemeral attributes, re-identifying ~51% more devices after 6 months than state of the art. A configurable privacy-preserving browser extension counteracts the technique on non-allowlisted sites. (from abstract only)
• How: Longitudinal attribute-stability analysis over a production authentication dataset, followed by adaptive prediction modeling that separates stable-in-principle attributes from ephemeral ones.
• Where applicable: Web services using device fingerprinting for auth or fraud. Dual-edged finding: it both improves fingerprint-based re-identification (a privacy risk the authors address) and tells you not to over-trust raw fingerprint stability in your own systems.