{"id":6744,"date":"2021-06-17T10:12:31","date_gmt":"2021-06-17T08:12:31","guid":{"rendered":"https:\/\/welaikaadv.site\/toothpic\/?p=6744"},"modified":"2021-06-17T11:14:03","modified_gmt":"2021-06-17T09:14:03","slug":"security-and-privacy-what-it-means-tracking-and-security-exploiting-the-unique-fingerprint-of-the-device","status":"publish","type":"post","link":"https:\/\/welaikaadv.site\/toothpic\/security-and-privacy-what-it-means-tracking-and-security-exploiting-the-unique-fingerprint-of-the-device\/","title":{"rendered":"Why your device is unique and what this means for your privacy and security"},"content":{"rendered":"\n

Device fingerprinting in a nutshell<\/strong><\/h3>\n\n\n\n

The need to identify and track people in their online activities is as old as the Web itself. Services need a way to recognize a specific user <\/strong>over time to serve them customized content or just to make sure they are really interacting with right person. Device fingerprinting is a set of techniques that allow online services to achieve this goal by building unique identifiers for the devices<\/strong> they use, such as their PCs, smartphones, etc. However, there is a fine line between using device fingerprints to increase security and using them for extensive tracking which is damaging to one\u2019s privacy.\u00a0<\/strong><\/p>\n\n\n\n

In the former case, a service may exploit a device fingerprint to check if the customer is actually who they are supposed to be since they are using a well-known device, used in past interactions. This is the case of banks, or other institutions wanting to prevent frauds and identity theft.<\/strong><\/p>\n\n\n\n

The latter case uses device fingerprints as unique identifiers to track people <\/strong>across services, usually for purposes of advertising. <\/strong>In fact, by being able to recognize the same user across multiple websites, advertisers can build very accurate profiles to serve customized content. This can be detrimental to a person\u2019s privacy, especially if their consent to be tracked is granted implicitly or in obscure manners.<\/p>\n\n\n\n

What are some common fingerprinting methods?<\/strong><\/h3>\n\n\n\n

At the beginning there were browser cookies<\/em><\/strong>, little pieces of information that a website would store on your device, to be replayed during future interactions. However, cookies are rather limited in their identification and tracking capabilities and can be easily deleted. <\/p>\n\n\n\n

Browser fingerprinting<\/em> examines the entirety of the capabilities of your browser to build a unique identifier.<\/strong> There are many components of the browser or of the system that runs it that easily change from one person to another. Browser brand and version, exact screen resolution, list of fonts installed, the specific way in which certain elements of a webpage are displayed and many more are characteristics that, while not sufficiently distinctive by themselves, can form a unique pattern when combined together. And, this pattern is persistent across many browsing sessions. Some websites<\/a> allow you to test if your browser fingerprint is unique. Remedies to this fingerprinting techniques exist and are easy to integrate, such as extensions that randomize the responses to the browser attributes when some snoopy website queries for them.<\/p>\n\n\n\n

In the mobile space, Apple and Google supply their operating systems with built-in identifiers<\/em> (see Apple\u2019s Identifier for Advertisers (IDFA)<\/a> or Google\u2019s Android Advertising ID (AAID)<\/a><\/strong>, so that when a third party application wants to track the device, it just needs to read this identifier. However, this approach has several issues.<\/strong> Those identifiers are global, which means that can be easily (mis)used to track users across applications. They can also be reset. Recently, their widespread use has been targeted by privacy concerns, and Apple has changed their policy towards IDFA to make it opt-in, <\/em><\/strong>i.e. applications must explicitly request permission to the user to use it.<\/p>\n\n\n\n

Smartphones offer other candidates as unique identifiers such as IMEI and MAC addresses but they can be easily spoofed, so they are not robust candidates for fraud detection systems.<\/p>\n\n\n\n

ToothPic\u2019s camera fingerprint<\/strong><\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n

ToothPic<\/a> invented a technology that recognizes a smartphone through the sensor of its camera because each sensor has some imperfections in the way it captures light that make it unique.<\/strong> ToothPic is able to extract unique identifiers from the camera hardware and this has some key benefits:<\/strong><\/p>\n\n\n\n