Fingerprinting web users through font metrics
David Fifield1 and Serge Egelman1,2
1

2

University of California, Berkeley
International Computer Science Institute{fifield,egelman}@cs.berkeley.edu

Abstract. We describe a web browser fingerprinting technique basedon measuring the onscreen dimensions of font glyphs. Font rendering in
web browsers is affected by many factors—browser version, what fonts
are installed, and hinting and antialiasing settings, to name a few—that are sources of fingerprintable variation in end-user systems. We
show that even the relatively crude tool of measuring glyph boundingboxes can yield a strong fingerprint, and is a threat to users’ privacy.
Through a user experiment involving over 1,000 web browsers and an
exhaustive survey of the allocated space of Unicode, we find that fontmetrics are more diverse than User-Agent strings, uniquely identifying
34% of participants, and putting others into smaller anonymity sets.
Fingerprinting is easy and takes only milliseconds. We show that of theover 125,000 code points examined, it suffices to test only 43 in order toaccount for all the variation seen in our experiment. Font metrics, beingorthogonal to many other fingerprinting techniques, can augment andsharpen those other techniques.
We seek ways for privacy-oriented web browsers to reduce the effectiveness of font metric–based fingerprinting, without unduly harming usability. As part of the same user experiment of 1,000 web browsers, we findthat whitelisting a set of standard font files has the potential to morethan quadruple the size of anonymity sets on average, and reduce thefraction of users with a unique font fingerprint below 10%. We discuss
other potential countermeasures.

1

Introduction

Web browser fingerprinting exploits measurable characteristics of browsers tobuild an identifier that can be used to track the same browser over time. Fingerprinting works even when cookies are disabled, and can be hard for users to defend themselves against. A fingerprint is composed of a variety of measurementsof the browser environment, typically acquired through client-side JavaScript.
Previous studies have identified many sources of fingerprintable variation, including the User-Agent string, the list of system fonts, and the list of installedbrowser plugins [8, 5].
In this work, we examine another facet of font-based device fingerprinting,the measurement of individual glyphs. Figure 1 shows how the same characterin the same style may be rendered with different bounding boxes in different

Fig. 1. The Unicode code point U+00C6 LATIN CAPITAL LETTER AE rendered at
font-size: 1000% in various styles in Firefox 24 (top) and Chromium 35 (bottom).
Even when JavaScript is forbidden from reading the pixel data, it can tell the difference
between browsers by measuring the dimensions of rendered glyphs. Notice that Firefox
has chosen a sans-serif and Chromium a serif font for the CSS cursive and fantasy
families. The browsers chose different serif fonts from among those available, and eventhe same font in the same style appears at different sizes.

browsers. The same effect can serve to distinguish between instances of eventhe same browser on the same OS, when there are differences in configurationthat affect font rendering—and we find that such differences are surprisingly
common. By rendering glyphs at a large size, we magnify even small differences
so they become detectable. The test is invisible—the glyphs are drawn on the
background and never actually appear onscreen—and fast, taking less than asecond when the code points tested come from a carefully chosen small set.
At the most basic level, font metrics can tell when there is no installed fontwith a glyph for a particular code point, by comparing its dimensions to thoseof a placeholder “glyph not found” glyph. But even further, font metrics candistinguish different fonts, different versions of the same font, different default
font sizes, and different rendering settings such as those that govern hinting andantialiasing. Even the “glyph not found” glyph differs across configurations.
Font metric–based fingerprinting is weaker than some other known fingerprinting techniques. For example, it is probably strictly inferior to canvas fingerprinting [16], which gets not only bounding boxes but also pixel data. However,
it is relevant because it is as yet effective against Tor Browser, a browser whose
threat model includes tracking by fingerprinting [23, Section 4.6], and which already defends against easier, more powerful attacks. For instance, Tor Browser
was highlighted in a recent study [4] as being the only browser to resist canvas
fingerprinting.
We performed an experiment with more than 1,000 web users that tested theeffectiveness of font fingerprinting across more than 125,000 code points of Uni-

code. 34% of users were uniquely identified; the others were in various anonymity
sets of size up to 61. We found that the same fingerprinting power, with this user
population, can be achieved by testing only 43 code points. We tested a proposed
anti-fingerprinting defense of using standard fonts in the web browser, and foundit to be effective, more than quadrupling the size of anonymity sets on average.

2

Related work

Eckersley [8] investigated the potential of fingerprinting in the absence of usual
tracking technologies like cookies. The well-known Panopticlick experiment collected hundreds of thousands of submissions and is still ongoing. Fingerprints
are derived from a variety of features: User-Agent string, HTTP request headers,
whether cookies are enabled, time zone, screen size, browser plugins and theirversions, whether certain long-term state storage (“evercookies”) are blocked,
and the list of system fonts. These limited features uniquely identified 84% ofparticipants. Fingerprints that had changed slightly between visits were foundto be nevertheless linkable to previous fingerprints.
Previous studies [8, 5] have considered fingerprinting using the list of installed
fonts; that is, a list of names like “Courier” and “Lucida.” An ordered list of
font names is available from the Java and Flash plugins. Nikiforakis et al. [19]describe how to get an unordered list of font names from JavaScript when Javaand Flash are not available. For each of a long list of known font names, rendera reference string using that font, and—using the same APIs that we use in thiswork to measure individual glyphs—compare its rendered dimensions against a
database of known fonts. The technique has been known since at least 2007 [20]and was found to be in use by a large fingerprinting company.
Mowery and Shacham [16] found the HTML canvas element [18, Section 4.11.4]
to be a rich source of variation. They measured an entropy of 5.73 bits, with
116 unique fingerprints in a population of 294. Their technique is to ask thebrowser to draw shapes and text to a pixel buffer, and then read back the resulting bitmap. Variations in how browsers draw antialiased lines, for example,
are fingerprintable characteristics. They tested font rendering using both system
and web fonts, and found, as we do, that the appearance of nominally identical
fonts differs across systems. Like us, they recruited users for their experimentfrom Mechanical Turk and had a similar sample size. Canvas fingerprinting ismore powerful than what we describe in this work; however our technique works
even when HTML canvas is absent or disabled.
Mowery et al. [15] fingerprinted JavaScript implementations using performance benchmarks. A web browser’s JavaScript implementation is an integral
part of the browser, and optimization techniques such as just-in-time compilation mean that timing characteristics of even the underlying physical processor
may be exposed. They were able to correctly identify a browser family 98% of thetime. They also show how the use of a privacy technology, in this case NoScript,
can paradoxically make a user more identifiable, by leaking individualized block-ing preferences. Mulazzani et al. [17] used the success and failure of standard
JavaScript test suites to identify different JavaScript engines.
Acar et al. [5] in 2013 tested the prevalence of fingerprinting in the wild,scanning the top million Alexa sites with a focus on font probing. Their system,
FPDetective, found 404 of the top million sites using JavaScript font probing,and discovered some previously unknown commercial fingerprinting providers.
They also found fingerprinting scripts that disguised themselves, for example byremoving themselves from the DOM after execution.
A further study by Acar et al. [4] in 2014 measured the prevalence of canvas
fingerprinting, evercookies, and “cookie syncing” in the wild. They found canvas
fingerprinting in use by 5% of the top 100,000 Alexa sites, mostly because ofthird-party advertisement code. They found instances of evercookies restoring
ordinary HTTP cookies and vice versa, and discovered a new evercookie vector
used by trackers. They quantified the effect of cookie syncing, the sharing ofidentifying tokens across domain in circumvention of the same-origin policy.
Previous work has used the measurement of bounding boxes as a means ofdetecting what fonts are installed, and in turn using the list of installed fonts
as a fingerprint feature. The technique we describe in this work is different: its
output is not a list of font names, but a list of individual glyph dimensions. It
does not require a list of candidate font names known in advance. While it may
be possible to infer some characteristics of the target system, such as the list of
installed fonts, from a font-metric fingerprint, that is not the main goal. The goalis only to hash as much variation as possible into some kind of unique identifier.
Glyph dimensions have the potential to be more sensitive than font names (asthe “same” named font may in fact be different on different systems), but theyalso may miss obscure fonts that are never selected by the browser unless asked
for by name. Of course, there is no reason for a tracker to limit itself to one kindof fingerprinting. In this study we consider font metric fingerprinting in isolation,with the understanding that it can be combined with other techniques for better
performance.

3

Methodology

We collected measurements through a web page with a JavaScript program that
inserts code points into the DOM and measures the dimensions of their corresponding glyphs. The program renders in turn 125,776 Unicode code points overthe course of a few minutes. The list consists of every code point in every assigned
block of Unicode 7.0.0 [25], with the exception that only the first 256 code points
are included from the two Supplementary Private Use Area blocks (U+F0000–
U+FFFFF and U+100000–U+10FFFF), which would otherwise contain 65,536
code points each. The code points cover every writing system known to Unicode.
Each code point is drawn six times, once with no font specified (default),then once in each of the five generic CSS families (sans-serif, serif, monospace,cursive, fantasy) [14, Section 15.3.1]. Generic font family names are usually used
in a CSS rule to express a rough idea of how text should look, when no specificmatching named font is found. These generic CSS family names are mapped toconcrete fonts at the browser’s discretion, depending in part on user preferences
and what fonts are available. Fonts were rendered very large, with CSS stylefont-size: 10000%, in order to better distinguish small differences in dimensions. At this size, typical dimensions for the letter ‘A’ in the default style are
1155×1900 pixels. The size of each code point is measured indirectly, by placing
it in a box and measuring the size of the box. The box is emptied before refreshing the browser UI, so the user does not actually see anything appear onscreen.
Thus, fingerprinting can occur without the user’s awareness.
We recruited users from Amazon Mechanical Turk and did not impose any restrictions on participation (e.g., geographic region, completion rate, etc.) in orderto yield a diverse sample. For each submission, we recorded only the browser’s
User-Agent string, the elapsed time, and the height and width in pixels of every
code point in every font style. Participants were paid $0.25 each. In order todetect duplicate submissions by the same user, the web page set a cookie witha randomly generated token and a lifetime of 30 days.
Following Eckersley [8], we use entropy as the measure of variation. For avector of categorical values S, the probability of observing a particular value v; that is, the number of observations of that value divided
is PS (v) = |x∈S:x=v||S|
by the length of the vector. The entropy of S is the sum of the entropies of all
the distinct values it comprises:
H(S) = −X

PS (v) log2 PS (v).

v∈S

We will be considering the case where the entries of S are the observed dimensions of a certain code point across all experiment submissions. If we think of
the data set as a matrix with one row for every user submission and one column
for every code point, an individual S is one of the columns.
In order to compute conditional entropy given a set of code points alreadymeasured, we will partition the submissions (rows of the matrix) into equivalence
sets according to equality in the already-measured code points, so that two
submissions are in the same equivalence set if and only if all their corresponding
measured code points have the same dimensions. We consider a column of thepartitioned matrix not as a single vector, but a set S of vectors, one for eachpartition. The entropy of S is the sum of the entropies of each of its constituent
vectors, each scaled by its length.
H(S) = −

|S|

X
P
S∈S

T ∈S |T |H(S).

Such partitions may be further subdivided along additional code points, until all
partitions contain elements that are equal in every code point not already measured, at which point the remaining conditional entropy is zero and no further
distinctions can be made.

4

Results

We received 1,022 submissions. After removing 6 that had a duplicate cookie,
there remained 1,016. The maximum entropy possible, if every submission weredistinct, is therefore log2 (1016) = 9.989 bits. Table 1 shows how the submissions
broke down with respect to operating system and web browser. Our user sample
was drawn from Mechanical Turk users and its composition is not representativeof that of the web as a whole.
Table 1. Operating systems and web browsers parsed from User-Agent strings.
523 51% Windows 7
245 24% Windows 8
80 8% other Windows (XP or Vista)
72 7% OS X 10.9
40 4% other OS X (10.5–10.8 or 10.10)
39 4% GNU/Linux other than Android
10 1% Android
7 1% iOS504 50% Chrome 36
241 24% Firefox 31
155 15% Chrome 37
41 4% other Chrome (6–35 or 38–39)
31 3% other Firefox (9–30 or 32–34)
27 3% Safari (4–8)
17 2% Internet Explorer (9–11)

Considering 4-tuples (OS, OS version, browser, browser version), there were
94 distinct OS+browser combinations, having an entropy of 4.151 bits. There
were 48 (5%) unique combinations, and 28 (3%) were in a set of size 2. The
largest set of identical OS+browser combinations, Chrome 36 on Windows 7,
contained 281 elements.
The User-Agent string is more variable than OS+browser, as it may containadditional information such as the browser’s minor release number. The UserAgent is also useful as a trivial baseline of fingerprintability. Within the input setof 1,016, there were 175 distinct User-Agent strings, having an entropy of 5.148
bits. There were 116 submissions (11%) with a unique User-Agent, and another42 (4%) that were in a set of size 2. The most common User-Agent appeared 220
times, and was “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36”; i.e., Chrome 36 on
64-bit Windows 7.
Now, on to the fingerprinting attack. There were 444 distinct complete fontmetric measurements, having an entropy of 7.599 bits. There were 349 submissions (34%) that were identified uniquely by font metrics, and another 84 (8%)
that were in a set of size 2. The largest anonymity set contained 61 submissions, 50 of which also shared the most common User-Agent (the others wereslight variations: 32-bit Windows instead of 64-bit, or a different micro-releaseof Chrome). The most common User-Agent appeared 220 times; we observed 46
different font fingerprints for it, 29 of them unique.
Two or more fingerprinting techniques may be combined in order to extract
more variation. The combination of font metrics and User-Agent, where two
fingerprints are considered equal only if their User-Agents are equal and all theircorresponding font metrics are equal, leads to 531 distinct submissions and an
entropy of 8.058 bits. 440 of those (43%) are identified uniquely, and another 76

are in a set of size 2. The largest anonymity set contained 51 elements, whichhappened to be Chrome 36 on Windows 8.1.
Table 2. Code points with the most and least individual entropy.
individual
entropyrank(bits) code point name
#1
2
3
4
5
6
7
8
9
10
11
.
.
.
125,766
125,767
125,768
125,769
125,770
125,771
125,772
125,773
125,774
125,775
125,776

4.908178
4.798824
4.698577
4.698577
4.698577
4.698577
4.657576
4.652798
4.646632
4.640043
4.640043.
.
.
2.573742
2.573742
2.573742
2.573742
2.481283
2.462760
2.462760
0.156341
0.000000
0.000000
0.000000

U+20B9
U+20B8
U+FBEE
U+FBF0U+FBF2
U+FBF4
U+F002
U+F001
U+FD3D
U+FBF8
U+FBFB.
.
.
U+202A
U+202B
U+202D
U+202E
U+202C
U+000C
U+000D
U+00AD
U+0009U+000A
U+0020INDIAN RUPEE SIGNTENGE SIGNARABIC LIGATURE YEH WITH HAMZA ABOVE WITH WAW ISOLATED FORM
ARABIC LIGATURE YEH WITH HAMZA ABOVE WITH U ISOLATED FORM
ARABIC LIGATURE YEH WITH HAMZA ABOVE WITH OE ISOLATED FORM
ARABIC LIGATURE YEH WITH HAMZA ABOVE WITH YU ISOLATED FORM

Private Use Area
Private Use Area
ARABIC LIGATURE ALEF WITH FATHATAN ISOLATED FORM
ARABIC LIGATURE YEH WITH HAMZA ABOVE WITH E INITIAL FORM
ARABIC LIGATURE UIGHUR KIRGHIZ YEH WITH HAMZA ABOVEWITH ALEF MAKSURA INITIAL FORM

LEFT-TO-RIGHT EMBEDDINGRIGHT-TO-LEFT EMBEDDING
LEFT-TO-RIGHT OVERRIDERIGHT-TO-LEFT OVERRIDEPOP DIRECTIONAL FORMATTINGFORM FEED (FF)CARRIAGE RETURN (CR)SOFT HYPHENCHARACTER TABULATION
LINE FEED (LF)
SPACE

Table 2 shows the code points with the greatest and least individual entropy
across all submissions. The top of the list includes many code points from theCurrency Symbols, Private Use Area, Arabic, and Georgian blocks of Unicode.
The Private Use Area block is one in which font designers are free to do what
they like; the meanings of the code points is left unspecified. The bottom of thelist has mostly whitespace and control characters. Only three code points wereidentical in every submission, always having a size of 0×0: U+0009 CHARACTER TABULATION, U+000A LINE FEED, and U+0020 SPACE. All three
are considered “inter-element whitespace” in HTML [18, Section 3.2.4] and do
not count as text when they are the only thing appearing in an element. There
are two other inter-element whitespace characters, U+000C FORM FEED and
U+000D CARRIAGE RETURN; all submissions had them with zero width (except for one oddball Chrome 36 with a width of 1), and some browsers givethem zero height while others give them the line height. The only code pointwith less entropy than a whitespace character was was U+00AD SOFT HYPHEN, with 0.156 bits, which apparently renders at 0×0 in all browsers but
Internet Explorer, where it has nonzero height.
The full suite of 125,776 code points took a mean time to test of 570 seconds
with a standard deviation of 394. The shortest test took 70 seconds and thelongest 50 minutes. Figure 2 shows the distribution of elapsed times. Part ofFrequency

60
40
20
0
0

1000
2000
Elapsed time (seconds)

3000

Fig. 2. Time taken to measure all code points in all styles.

the variance is definitely attributable to differing CPU speeds, and disk latency
as seldom-used font files are dredged off of disk. The test likely took longer forusers who moved the tab it was running in to the background. The spike ataround 500 seconds is probably explained by the throttling that browsers apply
to timers running in background tabs [24, 27]: the program tests 256 code points
in a batch, and if the browser throttles to one batch per second, it takes about
125776/256 = 491.3125 seconds to test all batches.
Though our data collection experiment took many minutes, fingerprinting
requires only milliseconds. We found a subset of 43 code points that suffices
to account for all the variation found in the complete set. The reduced subset
is shown in Table 3 and a sample fingerprint using it is in Appendix A. We
constructed the subset using a greedy algorithm that first selected the code point
having the highest individual entropy, then the one with the highest conditional
entropy given that the first code point had already been measured, and so on
until only uniform, zero-entropy subsets remained.
It is important to remember that entropy measurement is limited by sample
size. For example, we measured 5.148 bits of entropy for the User-Agent from ourpopulation of 1,016 browsers, while the Panopticlick experiment [8] measured
10.0 bits from a population of about 470,000. We have measured 7.599 bitsof entropy in font metric measurements, out of a theoretical maximum 9.989.
Before running this experiment, we had done a preliminary test of 496 browsers(under slightly different conditions: Unicode 6.3.0 and font-size: 2000%) andmeasured 7.080 bits of entropy out of a theoretical maximum of 8.954. We expect
the entropy to continue to grow, though from the limited sample size it is notpossible to say whether or where variability will hit a plateau. Figures 4 and 5
in Section 6 give a rough idea of how entropy may be expected to increase withsample size.

5

Sources of variation

We have seen that the dimensions of individual glyphs can vary widely, and thatsome code points are more variable than others. Figure 3 compares the variation

Table 3. Code points with the greatest conditional information gain. These 43 code
points suffice to capture all the variation of the full set of 125,776. The conditional
entropy on each line measures the variation remaining conditioned on the code points
on preceding lines already having been measured. Note that the selected code points
do not simply appear in order of increasing rank; at each step the algorithm chooses
one, the measurement of which gives the most additional information. Slanted typeindicates a Unicode block name when a code point is not individually named. There isnothing magic about the set shown here; many others would do just as well. A sample
fingerprint using this code point set appears in Appendix A.
individual conditional
entropy
entropyrank(bits)(bits) code point name
#1
190
18
933
6,715
2
194
676
5,876
367
100,605
90,5386,029
7,176
62,37155,549101,598683
55,755
5,872
122,695
297
806
7,967
3

4.908178
4.223916
4.607439
4.008738
3.794592
4.798824
4.215221
4.063433
3.892304
4.137402
3.440790
3.517391
3.879878
3.763447
3.549727
3.603737
3.429199
4.063107
3.598234
3.894021
3.894021
4.163269
4.028184
3.702500
4.698577

4.908178
0.843608
0.496079
0.2641010.217025
0.173474
0.120687
0.075592
0.067049
0.060762
0.045069
0.035899
0.028690
0.028359
0.025836
0.022298
0.020307
0.015840
0.015405
0.014138
0.012554
0.011433
0.010647
0.010586
0.010389

U+20B9
U+2581
U+20BA
U+A73D
U+FFFD
U+20B8
U+05C6
U+1E9E
U+097F
U+F003
U+1CDA
U+17DD
U+23AE
U+0D02
U+0B82
U+115A
U+2425
U+302E
U+A830
U+2B06
U+21E4
U+20BD
U+2C7B
U+20B0U+FBEEINDIAN RUPEE SIGNLOWER ONE EIGHTH BLOCK
TURKISH LIRA SIGNLATIN SMALL LETTER AYREPLACEMENT CHARACTERTENGE SIGNHEBREW PUNCTUATION NUN HAFUKHALATIN CAPITAL LETTER SHARP S
DEVANAGARI LETTER BBA
Private Use Area
VEDIC TONE DOUBLE SVARITAKHMER SIGN ATTHACAN
INTEGRAL EXTENSIONMALAYALAM SIGN ANUSVARATAMIL SIGN ANUSVARA
HANGUL CHOSEONG KIYEOK-TIKEUT
SYMBOL FOR DELETE FORM TWO
HANGUL SINGLE DOT TONE MARKNORTH INDIC FRACTION ONE QUARTERUPWARDS BLACK ARROWLEFTWARDS ARROW TO BAR
RUBLE SIGNLATIN LETTER SMALL CAPITAL TURNED EGERMAN PENNY SIGN

55,35856,251
102,938
33
73,091
96,023
99,164
55,11654,880125,759
869
6,702
7,849
872
962
99,57755,774102,4393.616671
3.5832203.382354
4.593589
3.523493
3.486238
3.449583
3.618169
3.620506
2.831178
4.020008
3.796600
3.708330
4.018562
4.004011
3.445643
3.596681
3.404409

0.007269
0.006550
0.005807
0.005638
0.005521
0.003839
0.003839
0.003553
0.003194
0.002712
0.002712
0.002712
0.001969
0.001969
0.001969
0.001969
0.001969
0.001969

U+F810U+FFFF
U+007F
U+10A0
U+1D790
U+0700
U+1950
U+3095
U+532D
U+061C
U+20E3
U+FFF9U+0218
U+058F
U+08E4
U+09B3
U+1C50
U+2619

Private Use Area
Specials
DELETEGEORGIAN CAPITAL LETTER AN

ARABIC LIGATURE YEH WITH HAMZA ABOVEWITH WAW ISOLATED FORM

MATHEMATICAL SANS-SERIF BOLD ITALIC CAPITAL ALPHASYRIAC END OF PARAGRAPHTAI LE LETTER KA
HIRAGANA LETTER SMALL KACJK Unified Ideographs
ARABIC LETTER MARKCOMBINING ENCLOSING KEYCAPINTERLINEAR ANNOTATION ANCHORLATIN CAPITAL LETTER S WITH COMMA BELOWARMENIAN DRAM SIGNARABIC CURLY FATHA
Bengali
OL CHIKI DIGIT ZERO
REVERSED ROTATED FLORAL HEART BULLET

7.599160 bits total entropy

observed in two selected code points. There is variation even within the samebrowser on the same operating system. In this section we explore the causes ofthese phenomena.
Text rendering is a subtle and complex part of a web browser. Even in the
Latin alphabet, layout is more than simply stacking boxes together: considerations such as ligatures, kerning, and combining characters come into play.
Some other writing systems are even more complex, causing browsers to rely
on OS-provided libraries for text layout. These libraries, including Pango on
GNU/Linux, Graphics Device Interface (GDI) or DirectWrite on Windows, andCore Text on Mac OS X, are independent code bases and do not behave identically. Browsers additionally impose their own customizations atop the base text
rendering.
The fonts that are installed by default are different on different operating
systems. This fact, combined with the differences in layout engines, contributeto a strong per-OS fingerprinting effect. To disguise this effect completely would
be difficult, and in Section 6 we assume that OS and browser are inherently
fingerprintable, and only seek to reduce further fingerprintability.
Even systems having the “same” named fonts installed may be fingerprintablebecause they have different revisions of the same font. For example, both Debian
7.6 and Ubuntu 14.04 include the DejaVu fonts, but Debian has version 2.33
of the font and Ubuntu has version 2.34. We found that there are detectabledifferences in some code points rendered using DejaVu, including some which
are listed in the DejaVu changelog [1] as having been added or modified inversion 2.34.
Different font rendering settings can distinguish end-user systems. We tracked
down one-pixel differences in the width of 134 code points, on two systems thatwere configured very similarly (Tor Browser 4.0-alpha-1 on Debian “jessie”, withthe same font files and libraries), to different font hinting settings.
Six of the 43 points selected by our distinguishing algorithm and shown in
Table 3 are currency symbols. Here they are shown along with their unconditional
entropies and ranks:
individual
entropyrank(bits) code point name
#1
2
18
297
872
7,967

4.908178
4.798824
4.607439
4.163269
4.018562
3.702500

U+20B9
U+20B8
U+20BA
U+20BD
U+058F
U+20B0INDIAN RUPEE SIGNTENGE SIGNTURKISH LIRA SIGN
RUBLE SIGNARMENIAN DRAM SIGNGERMAN PENNY SIGN

The code points corresponding to the rupee and tenge signs are the two mostentropic overall, and other currency symbols form a hotspot of high entropy. Fiveof those listed (all but U+20B0) are in the top 1% overall. It may be that relative
newness of the glyphs which these code points represent contributes to theirvariability. The sign for the Kazakhstani tenge was approved by the National
Bank of Kazakhstan in 2007 and added to Unicode 5.2 in 2009 [26]. The Indianrupee sign was presented by the Government of India and added to Unicode 6.0

U+20B9 INDIAN RUPEE SIGN

Dimensions

Dimensions

U+0041 LATIN CAPITAL LETTER A
1155×1900
1155×1840
1156×1840
1155×1841
1155×1920
722×1200
1155×1901
1156×1841
1156×1901
1129×2179
1129×1862
963×1534
1444×2376
1155×1908
1094×1945
1012×1875
1734×2760
1463×2813
1463×2812
1445×2375
1445×2300
1444×2301
1434×2000
1348×2146
1300×2070
1300×2069
1228×1955
1162×2067
1156×1900
1156×1839
1155×1772
1134×1955
1129×1875
1128×1863
1101×2242
1095×1862
1083×1781
1083×1726
1067×1842
1067×1839
1036×2111
1032×2150
1026×1823
1011×1680
1011×1611
1001×1725
997×1877
973×1863
953×1517
939×1497
891×1419
708×1394
705×1169
650×1035
0

100

200

300

Frequency

400873×1900
800×1900
1245×1900
890×1841
800×1841
800×1840
909×2240
874×1840
890×1840
641×1840
1245×1840
939×2163915×1840
1018×1900
1018×1840
796×2572
641×1841
636×1200
1155×1840
832×2145
797×2572
863×2129
800×1920
916×1865
895×2179
882×1862
874×1901
873×1901
873×1840
1244×1901
1156×1840
1092×2376
1018×1908
960×2013
800×1901
667×1534
642×1840
1452×2146
1401×2069
1364×3360
1300×2070
1245×1901
1136×2800
1112×2301
1092×2813
1092×2812
1092×2375
1019×1840
1018×1862
1000×2000
961×1863
952×1875
946×1955
945×2071
939×2204
906×1863
895×1875
890×1949
890×1948
890×1842
890×1839
882×1875
881×2248
874×2111874×1900
874×1839
873×2242
863×2150
850×1955
835×1725
834×1726
832×2092
821×1923
821×1893
819×1781
800×1772
796×2573
795×2011
779×1611
755×1538
742×1534
723×1497
667×1394
636×1169
617×1419
600×1257
448×1447
0

100

200

300

400

Frequency

Fig. 3. Frequencies of particular measured dimensions for two selected code points
in the default style. Measurements of U+0041 (the letter ‘A’) had 54 distinct values,
38 of them unique, with an entropy of 2.575 bits. U+20B9 (the currency symbol ‘|’)took on 87 distinct values, 50 of them unique, with an entropy of 4.288 bits. Note theseveral occurrences of dimensions that differ by one pixel, for example 1155×1840 and
1156×1840, and a “long tail” of infrequently seen dimensions.

in 2010. The Armenian dram sign was added to Unicode 6.1 in 2012; the Turkishlira sign to Unicode 6.2 in 2012; and the ruble sign to Unicode 7.0 in June, 2014.
All these glyphs were newly created symbols, the results of various public designcompetitions. For comparison, a much older currency symbol, U+20AC EURO
SIGN, introduced in Unicode 2.1.2 in 1998, is in the bottom 4% of variability,
at rank #123,190 with 3.301 bits.
The Private Use Area block, U+E000–U+F8FF, has high variability. Font
designers are free to give their own meaning to code points in this block, so what
glyphs are shown depends heavily on what fonts are available.

6

Defenses against fingerprinting

Fingerprinting is made more difficult, in general, by reducing differences acrosssystems; or by making those differences harder to measure.
A simple idea to eliminate variation due to font file availability is to ship a
set of standard fonts with the web browser, and use only those (plus downloadable web fonts), at the exclusion of any other fonts that may be installed on
the system. This approach has been suggested by Mowery and Schacham [16,Section 5] and on the bug trackers of Mozilla [22] and Tor [21].
We tested this idea: during our data-gathering experiment, in addition to
the six generic styles previously mentioned, we tested a style that consisted onlyof standardized @font-face web fonts downloaded from our server. The styleincluded Linux Libertine [13] as an example of an ordinary proportional font, as
well as a version of GNU Unifont [6] specially modified to have a glyph for every
code point tested, in order to prevent any fallback to system fonts.
The effect on fingerprintability is summarized in Table 4, and in Figures 4
and 5. In our experiment, the defense saved about 2.6 bits, reducing entropy tonear the “baseline entropy” of operating system plus browser.
Table 4. Entropy of different variables across the 1,016 submissions. “Standard fonts”
uses the simulated defense discussed in Section 6. “OS+browser” is the 4-tuple (OS,OS version, browser, browser version) extracted from the User-Agent string, without
any other User-Agent information. Lower numbers are better in all columns except“largest set.”
Variable
System fonts and User-Agent
System fontsStandard fonts and User-Agent
User-Agent
Standard fonts
OS+browser

entropy # distinct # unique largest set
8.058 bits
7.599 bits
6.128 bits
5.148 bits
4.957 bits
4.151 bits

531
444
270
175
150
94

440
349
197
116
99
48

51
61
181
220
203
281

Shipping standard fonts is a promising approach, but also a difficult one. It
takes cultural and linguistic understanding to select a set of fonts that will adequately cover the most common writing systems. Font files are large—those cov-

Entropy in bits H (S )1089.989 bits Maximum entropy

67.599 bits System fonts

44.957 bits Standard fonts

2

4.151 bits OS+browser

0
0

250

500
750
Sample size N

1000

Mean anonymity set size N /2H (S )Fig. 4. How entropy in different variables changes for different sample sizes. The blackline is log2 (N ), the maximum entropy possible if all browsers were measurably different.
For each N , we formed a vector S composed of N individual submissions sampled withreplacement from the overall population of 1,016, and computed the entropy of S in different variables. We repeated the sampling ten times for each N . The red line “Systemfonts” shows the effectiveness of font metric fingerprinting with no countermeasures.
The blue line “Standard fonts” shows a simulation of the standard-font defense described in Section 6. The difference between the red and blue lines, 7.599−4.957 = 2.642
bits, is the reduction in entropy achieved through the simulation of standardized fonts.
The green line “OS+browser” is the entropy of only the OS and browser componentsof the User-Agent, with other information stripped away; it represents a lower boundon entropy achievable if we assume that different OSes and browsers are intrinsicallydistinguishable by some means. The entropy of User-Agent is not shown but would beslightly above “Standard fonts,” 5.148 bits at the right side.

60
57.2 OS+browser

40

32.7 Standard fonts
5.2 System fonts

20
1.0 Maximum entropy

0
0

250

500
750
Sample size N

1000

Fig. 5. Another view of the same data. This plot shows N/2H(S) , where H is theentropy function. This quantity is the (geometric) mean size of the anonymity set thata random element finds itself a part of. (See Appendix B for a proof.) With maximum
entropy, every element would be the sole member of its own anonymity set.

ering east Asian scripts, for example, can be several megabytes uncompressed—
adding to the size of downloads. Including fonts with the browser requires thebrowser developer to assume ongoing maintenance and expertise costs previously
held by the operating system developer.
The attack as we have designed it relies on client-side execution of JavaScript.
Simply disabling JavaScript is unlikely to be an effective defense, however. Heiderich et al. [11] show how to use CSS to measure the size of DOM elements, forexample by shrinking a container through animation and causing its contents to
reflow.
Tor Browser already imposes a limit on the number of fonts that can beused to render a document, in order to defend against font enumeration attacks.
Unfortunately this defense is ineffective against the attack we have described,
because the attack uses only generic font names.
Randomizing the size of onscreen glyphs, or just randomizing the sizes reported to JavaScript, would frustrate fingerprinting. One would need to takecare not to allow the randomization to be simply averaged away, and keep inmind that a browser’s randomizing its dimensions is itself a detectable feature.
FireGloves [2] was a proof-of-concept fingerprint-resistant browser extension for
Firefox that randomized the reported size of DOM objects, among other things.
FPBlock [12] proposes to track data that depends on HTML element elements,
and prevent its exfiltration through means such as XMLHttpRequest.
Using a standardized operating system such as Tails [3] is an effective way
to blend in with other users of the same operating system.

7

Future work

We hope to collaborate with the maintainers of Tor Browser to develop anddeploy a patch along the lines of the standard-font defense described in Section 6. The Tor Browser maintainers have indicated a willingness to work with
us and a ticket tracks development progress [9]. Tor Browser is a good target for
deployment of a defense, because it already defends against other, more direct
and powerful attacks that are still effective in other browsers, even in private
browsing mode.
Canvas fingerprinting could be strengthened using the information gain–
based selection technique we have used to refine the set of code points tested.
Rather than testing only the 26 letters of the English alphabet, canvas fingerprinting could test carefully selected code points from Unicode.
Our technique could perhaps be strengthened by testing more than one code
point at a time, using combinations designed to reveal differences in the handling of ligatures, kerning, combining characters, right-to-left text, and otherfont features. Font technologies such as OpenType [10] support a large numberof features that are being made available to CSS [7].

8Conclusion

We have presented and evaluated a new web fingerprinting attack based on
measuring the onscreen size of font glyphs. We conducted a user experiment totest nearly the entire repertoire of Unicode in various CSS font styles, and thendeveloped a narrow set of code points that can quickly and effectively fingerprint
web users. We simulated a standard-font defense against fingerprinting. Font
metric–based fingerprinting can supplement other techniques in order to increase
their effectiveness.

9

Source code

Source code for the web experiment and analysis programs is available in a Git
repository at https://repo.eecs.berkeley.edu/git-anon/users/fifield/fontfp.git.

10

Acknowledgments

We thank Mike Perry for suggesting the idea of testing what code points lackfont coverage as a means of fingerprinting, and for guidance during developmentof the test code; Gunes Acar for extensive conversation on this technique andfingerprinting in general; Georg Koppen for comments on a draft of this paperand on the history of font measurement; Alex Kantchelian for advice regarding
information gain measurements; Kamil Jozwiak, Benjamin Smedberg, and John
Daggett for help regarding fonts in Firefox; and the tor-assistants mailing list
for help testing Tor Browser.

References
1. DejaVu fonts full changelog (version 2.34), http://dejavu-fonts.org/wiki/Fullchangelog
2. FireGloves, http://fingerprint.pet-portal.eu/?menu=6
3. Tails, https://tails.boum.org/
4. Acar, G., Eubank, C., Englehardt, S., Juarez, M., Narayanan, A., Diaz, C.: The
Web never forgets: Persistent tracking mechanisms in the wild. In: Proceedingsof the 21st ACM conference on Computer and Communications Security (CCS2014) (November 2014), https://securehomes.esat.kuleuven.be/∼gacar/persistent/
the web never forgets.pdf
5. Acar, G., Juarez, M., Nikiforakis, N., Diaz, C., Gürses, S., Piessens, F., Preneel, B.:
FPDetective: Dusting the web for fingerprinters. In: Proceedings of the 20th ACM
conference on Computer and Communications Security (CCS 2013) (November2013), https://www.cosic.esat.kuleuven.be/publications/article-2334.pdf
6. Czyborra, R.: GNU Unifont, http://unifoundry.com/unifont.html
7. Daggett, J.: CSS fonts module level 3. Candidate recommendation, W3C (Oct2013), http://www.w3.org/TR/2013/CR-css-fonts-3-20131003/

8. Eckersley, P.: How unique is your web browser? In: Proceedings of the 10th Privacy
Enhancing Technologies Symposium. pp. 1–18 (July 2010), https://panopticlick.
eff.org/browser-uniqueness.pdf
9. Fifield, D.: #13313: Enable bundled fonts in Tor Browser (Oct 2014), https://trac.
torproject.org/projects/tor/ticket/13313
10. FontShop International: OpenType user guide (Apr 2012), https://www.fontfont.
com/staticcontent/downloads/FF OT User Guide.pdf
11. Heiderich, M., Niemietz, M., Schuster, F., Holz, T., Schwenk, J.: Scriptless attacks: Stealing the pie without touching the sill. In: Proceedings of the 2012
ACM Conference on Computer and Communications Security. pp. 760–771. CCS
2012, ACM, New York, NY, USA (2012), http://www.nds.rub.de/media/emma/veroeffentlichungen/2012/08/16/scriptlessAttacks-ccs2012.pdf
12. Kim, D.: Detection and prevention of web-based device fingerprinting (May 2014),
http://www.cs.utexas.edu/∼dkim/papers/webfingerprint-poster sp14.pdf, poster
presented at the 2014 IEEE Symposium on Security and Privacy
13. Libertine Open Fonts Project: Linux Libertine, http://www.linuxlibertine.org/
14. Lie, H.W., Çelik, T., Bos, B., Hickson, I.: Cascading style sheets level 2 revision 1(CSS 2.1) specification. W3C recommendation, W3C (Jun 2011), http://www.w3.
org/TR/2011/REC-CSS2-20110607
15. Mowery, K., Bogenreif, D., Yilek, S., Shacham, H.: Fingerprinting information in
JavaScript implementations. In: Wang, H. (ed.) Proceedings of W2SP 2011. IEEE
Computer Society (May 2011), https://cseweb.ucsd.edu/∼hovav/dist/jspriv.pdf
16. Mowery, K., Shacham, H.: Pixel perfect: Fingerprinting canvas in HTML5. In:
Fredrikson, M. (ed.) Proceedings of W2SP 2012. IEEE Computer Society (May2012), https://cseweb.ucsd.edu/∼hovav/dist/canvas.pdf
17. Mulazzani, M., Reschl, P., Huber, M., Leithner, M., Schrittwieser, S., Weippl,
E.: Fast and reliable browser identification with javascript engine fingerprinting.
In: Web 2.0 Workshop on Security and Privacy (W2SP) (5 2013), http://www.
sba-research.org/wp-content/uploads/publications/jsfingerprinting.pdf
18. Navara, E.D., Berjon, R., Leithead, T., O’Connor, E., Pfeiffer, S., Faulkner, S.:
HTML5. Candidate recommendation, W3C (Feb 2014), http://www.w3.org/TR/
2014/CR-html5-20140731/
19. Nikiforakis, N., Kapravelos, A., Joosen, W., Kruegel, C., Piessens, F., Vigna, G.:
Cookieless monster: Exploring the ecosystem of web-based device fingerprinting.
In: Proceedings of the 2013 IEEE Symposium on Security and Privacy. pp. 541–555.
SP ’13, IEEE Computer Society, Washington, DC, USA (2013), https://seclab.cs.
ucsb.edu/media/uploads/papers/sp2013 cookieless.pdf
20. Patel, L.: JavaScript/CSS font detector (Mar 2007), http://www.lalit.org/lab/
javascript-css-font-detect/
21. Perry, M.: #2872: Limit the fonts available in TorBrowser (Apr 2011), https://trac.torproject.org/projects/tor/ticket/2872
22. Perry, M.: Bug 732096 - Add a preference to prevent local font enumeration, comment 18 (Mar 2012), https://bugzilla.mozilla.org/show bug.cgi?id=732096#c18
23. Perry, M., Clark, E., Murdoch, S.: The design and implementation of the Tor
Browser. Tech. rep. (Mar 2013), https://www.torproject.org/projects/torbrowser/
design/24. Russell, K.: Issue 66078: Background tabs with webgl slow down browser due
to missing flow control (Dec 2010), https://code.google.com/p/chromium/issues/detail?id=66078
25. Unicode, Inc.: Blocks (Unicode character database) (Apr 2014), http://www.
unicode.org/Public/7.0.0/ucd/Blocks.txt

26. Unicode, Inc.: DerivedAge (Unicode character database) (May 2014), http://www.
unicode.org/Public/7.0.0/ucd/DerivedAge.txt
27. Zbarsky, B.: Bug 633421 - Clamp setTimeout/setInterval to something higher than
10ms in inactive tabs (Feb 2011), https://bugzilla.mozilla.org/show bug.cgi?id=
633421A

Sample fingerprint

This is a sample font metric fingerprint using the fast code point testing set ofTable 3. The system represented is Tor Browser (Firefox 24.8.0) in Tails 1.1.1 [3].
The fingerprint can be hashed into a single short identifier rather than being
stored in the long form shown here.

U+20B9
U+2581
U+20BA
U+A73D
U+FFFD
U+20B8
U+05C6
U+1E9E
U+097F
U+F003
U+1CDA
U+17DD
U+23AE
U+0D02
U+0B82
U+115A
U+2425
U+302E
U+A830
U+2B06
U+21E4
U+20BD
U+2C7B
U+20B0U+FBEE
U+F810U+FFFF
U+007F
U+10A0
U+1D790
U+0700
U+1950
U+3095
U+532D
U+061C
U+20E3
U+FFF9U+0218
U+058F
U+08E4
U+09B3
U+1C50
U+2619default
sans-serif
serif
monospace cursive
fantasy636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
769×1200 769×1200 769×1200 602×1200 769×1200 769×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
824×1200 818×1200 824×1200 818×1200 818×1200 818×1200
1025×1200 1025×1200 1025×1200 602×1200 1025×1200 1025×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
307×1200 441×1200 307×1200 441×1200 441×1200 441×1200
829×1200 769×1200 829×1200 769×1200 769×1200 769×1200
524×1598 524×1598 524×1598 524×1598 524×1598 524×1598
1000×1226 977×1200 1000×1226 1000×1219 977×1200 977×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
0×20020×20020×20020×18560×20020×2002521×1200 521×1200 521×1200 602×1200 521×1200 521×1200
886×1472 886×1472 886×1472 886×1472 886×1472 886×1472
763×2000 763×2000 763×2000 763×2000 763×2000 763×2000
1000×1226 1000×1219 1000×1226 1000×1219 1000×1219 1000×1219
500×1200 500×1200 500×1200 500×1200 500×1200 500×1200
0×12260×12190×12260×12190×12190×1219636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
838×1200 838×1200 838×1200 838×1200 838×1200 838×1200
838×1200 838×1200 838×1200 602×1200 838×1200 838×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
491×1200 491×1200 491×1200 491×1200 491×1200 491×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
500×1200 500×1200 500×1200 500×1200 500×1200 500×1200
16×1200
16×1200
16×1200 1000×1230
16×1200
16×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
600×1200 600×1200 600×1200 602×1200 600×1200 600×1200
723×1200 840×1200 723×1200 840×1200 840×1200 840×1200
774×1200 774×1200 774×1200 774×1200 774×1200 774×1200
1000×1200 1000×1200 1000×1200 1000×1200 1000×1200 1000×1200
500×1200 500×1200 500×1200 500×1200 500×1200 500×1200
1000×1200 1000×1200 1000×1200 1000×1200 1000×1200 1000×1200
16×1200
16×1200
16×1200 1000×1230
16×1200
16×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
0×12000×12000×12000×12000×12000×12000×12000×12000×1200 602×1200
0×12000×1200685×1200 635×1200 685×1200 602×1200 635×1200 635×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
636×1200 636×1200 636×1200 602×1200 636×1200 636×1200
500×1200 500×1200 500×1200 500×1200 500×1200 500×1200
896×1200 896×1200 896×1200 602×1200 896×1200 896×1200

B

Mean anonymity set size from entropy

This appendix contains a proof of the claim in Figure 5, that an entropy measurement implies a mean anonymity set size. Refer to Section 3 for notation.
Claim. Let S be a vector of categorical values with N elements and k distinct
values v1 , . . . , vk . For i ∈ 1, . . . , k, let ci signify the number of times vi appears in S: PS (vi ) = ci /N . Then the quantity N/2H(S) , shown in Figure 5, is
1
Q
k
ci N
; that is, the geometric mean of the vector that results from replaci=1 ci
ing each element of S with the number of times that element appears (a vector
where each ci appears ci times).
Proof.
N/2H(S)=N/2(−Pk)

i=1 PS (vi ) log2 PS (vi )cicii=1 N log2 N

Pk=N · 2(
=N

k
Y

)

ci
ci
2( N log2 N )

i=1

=N

c
k 
Y
ci  Ni

i=1

BecausePk

i=1 ci = N ,

Qk

i=1 N

N

N
ci

! N1

i

=N

i=1

N ci

= N N , and so

k
Y
cci

! N1

i

k
ci
i=1 ci

N

Qk
=N

N ci
i=1
Q

=N

k
Y
cci

 N1
=

k
Y

ci
i=1 ci
NN

! N1

! N1
cci i

.

i=1

t
u