Browser 'fingerprints' help track users

Web users are being warned about a novel tracking system that watches what they do online and frustrates tools designed to prevent them being tracked.

The warning comes from researchers who have found the tracking system being used on thousands of websites.

The system exploits features of the web's underlying code to generate unique identifiers for each visitor.

Government portals, online shops and pornography sites were all found to be using the tracking system.

"The tracking mechanisms we study are advanced in that they are hard to control, hard to detect and resilient to blocking or removing," wrote the researchers in a paper describing their work.

The team, made up of researchers at Princeton University in the US and University of Leuven in Belgium, analysed tracking techniques on the top 100,000 websites. They found that many sites had turned away from well-known systems such as small text files called "cookies" in favour of more subtle methods.

More than 5% of the sites they surveyed had turned to a technique known as "canvas fingerprinting" to identify visitors.

This technique forces a web browser to create a hidden image. Subtle differences in the set-up of a computer mean almost every machine will render the image in a different way enabling that device to be identified consistently.

Popular sites using the technique included the White House, the San Francisco Chronicle's website and the YouPorn pornographic portal.

Many web browsing programs now include tools that let people manage or stop their activity being tracked across the sites they visit. Many advertisers are keen to find out these browsing histories to better target ads.

The team also studied ways to stop canvas fingerprinting but said none of the browsing programs it tested had stopped the system being used. Only the Tor anonymising browser did a good job of spotting the fingerprinting technique was being used and asking people if they were happy for it to operate.

Web tracking company AddThis had tested canvas fingerprinting on a small number of the 13 million sites currently signed up to use its technology to track users, the firm told the ProPublica website.

It said it planned to stop using the technique because it was "not uniquely identifying enough".