Browser Fingerprint：Plugin

Plug-ins and browser add-ons are not to be confused. An add-on is a browser extension that you can usually download from a place like the Chrome Store. The add-on runs in the browser process. Examples of browser add-ons are AdBlock and Chostery.

Plug-ins, by contrast, are usually pre-installed in a browser or downloaded from a third-party website. Examples of plug-ins are Flash and Widevine. Plug-ins typically run in a separate process that has all the rights of the currently active user, which can lead to various vulnerabilities.

Risk of opening the plugin

Some plug-ins, such as Flash or Widevine, have a documented API that allows it to retrieve a variety of uniquely identifiable data points from the mother machine. Other plug-ins may also have such an API, whether public or private, which could pose a threat to online privacy. Because plug-ins are essentially closed-source binaries, there is no reliable way to assess what security vulnerabilities a plug-in might have.

Prints are generated by enumeration

Another risk comes from browser plug-in enumeration. Even if a website cannot or will not retrieve uniquely identifiable data through the plug-in API, it can still collect uniquely identifiable data in the form of a plug-in list. A list of plug-ins with each version can significantly narrow down the segments to which the user belongs. Multiple browsing sessions can be linked together individually based on this data, or combined with other data points. This is how the Migratory Bird Browser simulates plug-in fingerprints.

The default plugin in Firefox and Chrome By default, Firefox does not have plugins installed. Chrome comes with four bundles:

Chrome PDF Chrome PDF viewer Native client (Native client) Widevine Content Decryption Module (Widevine Content decryption Module)