Remote work is here to stay, but many are still unaware of one of the biggest threats plaguing it: browser fingerprinting.
It’s a quiet yet sophisticated act that can erode privacy and leak company data. This can then, of course, be used in targeted attacks.
Anyone involved in remote work, from company heads to IT managers to the workers themselves, must understand browser fingerprinting and how to prevent it.
What browser fingerprinting is — and why it matters
Browser fingerprinting refers to how websites collect small, seemingly ordinary, harmless bits of information about their users. Collected information typically includes user data such as:
- Screen resolution.
- Installed fonts.
- Time zone.
- System language.
- Device and operating system details.
- Graphics rendering quirks.
- Browser plugins and extensions.
This information creates a unique “profile” about the user. This profile can then be used to identify the device.
Unlike cookies, fingerprints cannot be easily deleted, for they are not stored locally. They are generated by analyzing how your browser responds to certain web scripts and commands.
Because of this, fingerprinting is particularly resilient. It allows those behind the fingerprinting to store profiles for long periods, often without the user’s knowledge.
How trackers and attackers use it
In many ways, fingerprinting is a necessity. Websites need to know, for example, a user’s screen resolution to display the website properly. It’s also used as a vital security tool: banks, gaming platforms, and e-commerce sites all use it to detect bots, flag suspicious logins, or prevent credit card theft.
However, cybercriminals and advertisers did not take long to realize that they could also benefit from fingerprinting. With fingerprinting’s stealth and accuracy, they can track users across the web without their consent. Here’s how they do it.
1. A script collects your “fingerprint” on one site
When you load a page, a fingerprinting script collects various data points about you, as mentioned above.
A unique “hash” — essentially a short code representing your configuration—is then created, which serves as your profile.
2. That fingerprint is stored in a database
The script’s owner — the site itself, an ad network, or an analytics company — saves your fingerprint, timestamp, IP address, and other identifiers they can gather.
3. The same script appears on another site
If you visit another site that loads the same tracking script (for example, an ad from the same network), the script runs again, collects the new fingerprint, and compares it to the fingerprints already in the database.
If the fingerprint matches one already stored, the tracker knows you’re the same person (or at least the same device) they saw before. That is even if:
- You’ve cleared your cookies.
- You’re using private browsing mode.
- You’re on a new IP address.
5. Profiles are built over time
The script owner can then link your visits across many sites and build a behavioral profile of the pages you visit, your interests, shopping habits, and even daily activity patterns. They can then use this for targeted advertising, analytics, or worse, cyberattacks.
With both legitimate websites and more malicious parties using fingerprinting, studies show that up to 84% of users can be identified from their browser information alone.
The risks for remote teams
Since remote workers often log in to corporate apps, systems, and tools, browser fingerprinting can pose several risks for their companies:
-
Persistent tracking of employee activity
If third parties collect fingerprints from corporate devices, they could potentially monitor work-related patterns across the remote workers’ website visits. This information can then be used by competitor businesses.
Details such as a user’s browser, OS, and used plugins give attackers clues for how to make their phishing attempts more likely to succeed. For example, their phishing email may include the details above to personalize the message and make it look more legitimate.
-
Regulatory and compliance concerns
Under data privacy laws such as the EU’s GDPR and ePrivacy Directive, companies can potentially be liable for leaking their remote workers’ details, even if they are not behind the fingerprinting script.
Practical mitigation strategies
Despite the seemingly overwhelming prevalence of fingerprinting, there are still several ways organizations can effectively protect their privacy.
1. Use browsers and tools that limit fingerprinting
Certain browsers have built-in fingerprinting defenses, such as Brave, Firefox (with “Resist Fingerprinting” enabled), or Tor Browser for sensitive work.
Reputable extensions such as Privacy Badger, CanvasBlocker, or uBlock Origin can also aid.
Note: These measures help standardize or limit the data your browser exposes, though they may affect site compatibility. Test them before deploying organization-wide.
2. Separate work and personal activity
Corporate accounts, tools, and logins should be handled on a dedicated browser profile, container, or even a separate device. This reduces the chance that remote workers’ casual browsing is linked to their business activities.
3. Use VPNs strategically
While a VPN will not block fingerprinting, IP addresses are typically used to solidify the fingerprint into a full-fledged user profile. VPNs offer an easy way for remote workers to hide their IP addresses. Read here for an information source on VPNs.
4. Standardize device configurations
Ideally, all devices and browsers in the corporate network have uniform fonts, extensions, and display settings (among other typically-fingerprinted data points). This reduces variability, making each user harder to distinguish. Avoid unnecessary add-ons, third-party scripts, or other customizations that increase uniqueness.
5. Build awareness and test regularly
Ensure that everyone in the organization—especially IT groups and remote workers—is educated about fingerprinting and its risks.
Additionally, run periodic tests (e.g., EFF’s Cover Your Tracks) to measure devices’ uniqueness (and vulnerability to fingerprinting). Use the results to refine controls and close any gaps.
For better or worse, fingerprinting will not go away. However, companies can remain private, safe, and competitive through the five key mitigation methods above.
