Double-Edged Shield: On the Fingerprintability of Customized Ad Blockers
summary
Claim: customized ad‑blocker filter selections are fingerprintable. The authors build three scriptless fingerprinting attacks (notably a CSS animation attack and a lazy loading attack) that evade JavaScript detectors, detect 84% of filter lists, produce stable fingerprints with ~0.72 normalized entropy, and shrink median anonymity sets to 48 users (0.2% of the population) using 45 rules out of 577K. Evaluation uses 18K AdGuard and 5.9K uBlock Origin configs; defenses need activating ~400K rules or break web features and incur heavy performance cost.
AI-written summary · about
chapters (9)
- 0:00Privacy risks of customized ad blockers
- 1:17Customization undermines privacy
- 2:40Differences from prior fingerprinting
- 4:46Detecting ad blocker rules via stylistic attacks
- 8:12Optimal rules for stealthy fingerprinting
- 10:22Evaluating fingerprintability on real data
- 12:31Stability against filter list changes
- 13:13Mitigation strategies and trade-offs
- 13:55Conclusion and recommendations
related talks
35mStealthy fingerprinting users with personalized blocking rules
14mBrowser Fingerprinting: Stalking With a Personal Touch
19mBlock, unblock, block! How ad blockers are being circumvented…
40mAn Analysis of the Fingerprinting-Scripts and their Actors on the Internet
21mFp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies
26mBeyond filter lists: using LLMs to rethink ad blocking
52mBreaking Fraud and Bot Detection Solutions
35mBreaking fraud & bot detection solutions