An advanced browser fingerprint calculator aimed mainly at Tor Browser users
I worked on designing tracking scripts for six months (Sorry. Fortunately they aren&#x27;t in production). Fingerprinting was very difficult to pull off in practice: even with canvas fingerprinting, font enumeration, plugin enumeration, etc. most mobile phones are still indistinguishable. Desktops are easier to fingerprint because they often have unique browser plugins or a unique set of fonts installed. Even with desktops, fonts and other settings usually change within a matter of days, so its difficult to identify a user unless they&#x27;re browsing from the same ip address you&#x27;ve seen them at before.<p>What used to work really well were Flash cookies. Adobe had a security hole where Flash cookies weren&#x27;t cleared when you cleared your regular cookies. The only way to clear your Flash cookies was to open the Flash application on your laptop and clear all content, or visit a special webpage Adobe built to help users clear their cookies. So for years marketers could store any cookies they wanted this way. This only ended when Chrome began embedding a version of Flash into the browser so Flash cookies could be deleted when other cookies are deleted.<p>The other mechanism that was really interesting was ETag tracking. When you request a picture or other asset from a website, the website can send you an etag id which is supposed to signify the picture&#x27;s version. When the client revisits the page, the client sends back the etag to confirm the version cached is the same as the version on the server. The security leak is that the etag protocol allows arbitrary text to be set as an etag, so to set an etag cookie all you have to do is place a 1x1 pixel on each page with a random GUID, and when the user revisits the page the browser will resend the tracking etag in its request for the 1x1 tracking pixel. This works for browsers with cookies disabled, and will remain when cookies are cleared. The only way to clear it is to clear all browsing history entirely, including cached images. Fortunately, Chrome now clears cached images by default when you clear your cookies.