Stealthy fingerprinting users with personalized blocking rules
summary
Users who enable many custom filter lists become easier to identify because active rules change page behavior in detectable ways. The paper presents scriptless fingerprinting and three concrete exploits including a CSS animation attack that suppresses background image requests and an image lazy-loading attack that shifts images past the viewport, plus iframe and container-style query variants. Evaluation on AdGuard (≈18.5k) and uBlock Origin (≈5.9k) configs shows 16–25% unique reidentification with ~30 tests and stability of fingerprints up to three years. Proposed defenses trade off performance and breakage: enabling rules globally or granularly blocking leaking features.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker welcome
- 1:04Research overview and motivation
- 4:43Differences from prior fingerprinting attacks
- 8:13CSS animation attack explained
- 9:42Image lazy loading attack explained
- 12:12Evaluation and anonymity reduction
- 18:28Mitigation strategies and trade-offs
- 23:16Takeaways and recommendations
- 23:38Q&A session part 1
- 28:33Q&A session part 2
- 33:00Q&A session part 3
related talks
15mDouble-Edged Shield: On the Fingerprintability of Customized Ad Blockers
14mBrowser Fingerprinting: Stalking With a Personal Touch
19mBlock, unblock, block! How ad blockers are being circumvented…
40mAn Analysis of the Fingerprinting-Scripts and their Actors on the Internet
49mWeb Side Story: A Privacy Odyssey through Tracking and Fingerprinting
24mTales From the Trenches: Fingerprints on the Web
21mFp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies
35mBreaking fraud & bot detection solutions