Just how much information we give away about ourselves as we browse the Web has been raised again by a tracking device used in thousands of Web sites.
Researchers at Belgium’s University of Leuven have revealed the widespread use of a technique called “canvas fingerprinting” that tracks the activities of people on a Web site without their knowledge.
More than 5,600 Web sites were identified using the fingerprinting technique. While it’s relatively new, it represents another front in a very long battle to find out what users do online, and raises concerns about our ability to control our online privacy.
Here, have a cookie
Technical mechanisms for uniquely identifying Web users date back to the introduction of the cookie in the Netscape browser in 1994.
When the user loads a web page they get all the information necessary to display the page, such as the text, layout and images. But they also a small amount of “cookie” data sent along too, which is stored by the browser on the user’s computer.
When the user requests another page from the same Web site, the browser appends the cookie to the request to the server. In this way, the server hosting the Web site knows that the request came from the same computer.
Cookies are extremely useful and without them there would be no support for Web site logins.
But they can also be used to provide a complete record of a user’s use of a Web site. The use of “tracking cookies” allows this recording to extend across many, manyWeb sites, providing a comprehensive picture of a user’s browsing history to whoever controls the tracking cookie.
This becomes particularly intrusive if this browsing history can then be tied to any identifying data.
Understandably, many Internet users aren’t terribly enthusiastic about their browsing history being so readily available to third parties. Tools to manage cookies have been incorporated into Internet browsers and third-party privacy tools.
Deleting cookies, or controlling whether particular cookies are sent back to particularWeb sites, gives the user more control over the extent of monitoring.
The technical response of browser developers has been combined with legal measures, such as the European Union’s privacy directive.
Under these rules, cookies used in a potentially privacy-invading manner must be disclosed to Web site visitors and explicit consent obtained.
Some Internet companies have now turned to another ingenious technique for uniquely identifying and tracking users.
Rather than relying on browsers to send back a previously sent cookie, they collect enough information about the user’s browser environment to uniquely identify the user.
Modern computers have specialized hardware that greatly speeds up the computations needed to draw pictures on the screen. These graphics chips, made by companies such as NVidia, have made possible the amazing graphics of modern games, and speed up your browsing and spreadsheets on today’s high-resolution monitors.
But the wide variety of such hardware, and the software used as “drivers” to control them, means that different computers will render such pictures in subtly different ways.
Images rendered by the graphics hardware (and thus subtly different on different computers) can be created from within a browser, analyzed and sent back to a web server.
On its own, this is not enough to uniquely identify a user. But when combined with information such as the browser name and version number, and the list of fonts available on the system, it can provide a unique “fingerprint” of a user’s computer.
This provides a tracking mechanism that can be operated across manyWeb sites; a “super-cookie” that can’t be deleted as it is inherent to the computer it’s running on.
Again, this is most intrusive if it can be combined with personally identifying information. But even without this, it is very much against the spirit of the cultural norm (and the E.U. law) that requires Internet sites to explicitly gain the consent of their users to enable tracking.
The University of Leuven research indicates that around 5 percent of the world’s top 1,000 Web sites make some use of this fingerprinting method, which was originally identified by University of California researchers in 2012.
Interestingly, however, the vast majority of Web sites using browser fingerprinting had done so by incorporating a third-party element into theirWeb sites.
Free tools come with a hidden price
The primary product of AddThis is sharing tools – an easy-to-add component that Web site developers can incorporate on their sites that allow visitors to easily share the page they are viewing on social media such as Facebook and Twitter.
While AddThis charges for some use of some these components, others are available for free. Free and good-looking Web site components are to Web site developers what honeypots are to bears, so it’s not surprising that they have been widely adopted.
But AddThis extracts an additional quid pro quo – collecting browser data about those who visit sites using their tools, much more than either the visitors, or the Web site owners, would have realized.
AddThis’s Rich LaBarca said it carried out a six month test using the fingerprinting and that any data collected was used for “internal research.” The code has since been disabled.
Taking what most of us give away anyway
As a computer geek from way back, I can’t help but grudgingly respect the ingenuity of those who perfect these privacy-invading tools, even as I deplore their ethics.
But my outrage is also tempered by the knowledge that these companies are taking by stealth what most of us choose to give away freely to other companies.
As media theorist Douglas Rushkoff observed, we – or, more precisely, our personal information – are “products” to many online companies such as Facebook, Google and AddThis.
The greatest fortunes of the 21st century have been founded on collecting and exploiting the personal information of billions of people, with a level of detail that companies such as AddThis can only dream of accessing.
And they’ve found that providing an easy way for us to share web pages of amazing cat videos and pictures is compelling enough that most of us will freely give them that information.
Do those who actually build these technologies – the programmers, analysts, testers and other IT professionals – have any obligation to consider the ethics of the tools they build? In theory, they do.
The two largest global professional bodies of the IT profession – the Association for Computing Machinery (ACM) and Institute of Electrical and Electronics Engineers Computer Society (IEEE-CS) – have jointly developed a Software Engineering Code of Ethics.
Unfortunately – and unlike law, medicine or other fields of engineering – professional societies and their codes of ethics have virtually no influence within the information technology community.
Despite occasional efforts to set themselves up as gatekeepers through licensing, they have had little success. As such, however virtuous these codes of ethics may appear, they have no teeth.
Much as I would personally like it to be otherwise, it’s unlikely that attempts to violate the privacy of individuals will reduce through the self-regulation of IT professionals.
The financial incentives for companies to do so are likely to continue. Privacy protection will have to come through some combination of public pressure, legal means, and individual adoption of technical and behavioural countermeasures.