Why Johnny Can't Browse in Peace: On the Uniqueness of Web Browsing History Patterns

Lukasz Olejnik (1) , Claude Castelluccia (1) , Artur Janc (2)

1 PLANETE - Protocols and applications for the Internet
2 Google Inc [Mountain View]

We present the results of the first large-scale study of the uniqueness of Web browsing histories, gathered from a total of 368; 284 Internet users who visited a history detection demonstration website. Our results show that for a majority of users (69%), the browsing history is unique and that users for whom we could detect at least 4 visited websites were uniquely identified by their histories in 97% of cases. We observe a significant rate of stability in browser history fingerprints: for repeat visitors, 38% of fingerprints are identical over time, and differing ones were correlated with original history contents, indicating static browsing preferences (for history subvectors of size 50). We report a striking result that it is enough to test for a small number of pages in order to both enumerate users' interests and perform an efficient and unique behavioral fingerprint; we show that testing 50 web pages is enough to fingerprint 42% of users in our database, increasing to 70% with 500 web pages. Finally, we show that indirect history data, such as information about categories of visited websites can also be effective in fingerprinting users, and that similar fingerprinting can be performed by common script providers such as Google or Facebook.

Domaines: Cryptographie et sécurité [cs.CR]

Lukasz Olejnik, Claude Castelluccia, Artur Janc. Why Johnny Can't Browse in Peace: On the Uniqueness of Web Browsing History Patterns. 5th Workshop on Hot Topics in Privacy Enhancing Technologies (HotPETs 2012), Jul 2012, Vigo, Spain. ⟨hal-00747841⟩