Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Fingerprinting

I was impressed at the accuracy they were able to get with browser/architecture detection:

> Concretely, our expression reveals differences in 1116 OS-browser combination pairs (94.9 %).

Very cool to see that they've even gone as far as inferring elements like the likelihood of MS Office being installed on your computer by checking the width of a container with the font 'Leelawadee' specified:

> As this font is a non-free Microsoft font for the Thai Language, we do not expect users without Microsoft Office to have it installed

There is lots of really interesting information in here past what you might figure out yourself if you've played around with abusing CSS yourself before. So many things that had just never, and probably would never have, occurred to me to try.

It is definitely worth a read (or skim) over the paper to see the lengths they went to in order to figure out some of the unique elements to fingerprint on.

https://abrahamjuliot.github.io/creepjs/

Couldn't most fingerprinting techniques be thwarted by just using a stock windows install in a frozen VM with a stock browser without changing anything? Wouldn't that make you pretty boring as far as any potential variations go?

Article's date is in the future:

2025-02-02