5

We have a number of different concepts related to "fingerprints" on this site:

  1. Physical fingerprints, e.g. for use in biometric authentication.
  2. Fingerprinting software (and hardware?), i.e. trying to determine what software or what version is running by observing it's behaviour.
  3. Fingerprinting users, alá the Panopticlick. Note that this is different from the above point, in that it aims to identify a specific instance of the software, and not just a specific software.

There might be more categories. For instance, I am not sure where this question would fit in. Anyway, our tags do not match these concepts very well:

  • (63 questions):

    In information security, a fingerprinting algorithm uniquely identifies the hardware, software or data. Just as human fingerprints uniquely identify people for practical purposes. This fingerprint may be used in penetration tests or for vulnerability management.

  • (92 questions):

    Gaining information about current version of an application or operating system in order to find a vulnerability.

  • (17 questions)

How could we sort this out? Here are a few thoughts, but I will leave it to the answers to outline full solutions:

  • There should probably be a specific tag for physical fingerprints. I know, there is , but that is a very broad area.
  • Since the word "fingerprint" is ambiguos, we should avoid it in tag names without qualifiers. E.g. there could be and , but no .
  • I think 2 and 3 should probably be separated in different tags, but I am note sure how to do that or what the proper terminology is.
5
  • 1
    I was actually just thinking about writing a canonical question/answer for browser and device fingerprinting. That would help clear up the tags as well as reduce the amount of duplicate questions. Regarding the tags alone, I personally think there should be a [biometrics] tag, and a [fingerprinting] tag. The latter would deal with software fingerprinting, OS fingerprinting, device fingerprinting, etc.
    – forest
    May 1, 2018 at 3:59
  • @forest Yay for canonical questions! :-) Don't you think a separate [device-fingerprinting] would be good?
    – Anders
    May 1, 2018 at 9:28
  • Device fingerprinting is often a part of browser fingerprinting, though. WebGL fingerprinting and AudioContext fingerprinting both fingerprint the individual device, but are still in the superset of browser fingerprinting.
    – forest
    May 1, 2018 at 9:29
  • @forest I thought "device fingerprinting" and "browser fingerprinting" were the same thing? Wikipedia seems to agree, but I admit that is not exactly the ultimate source of truth.
    – Anders
    May 1, 2018 at 9:33
  • Perhaps the definitions are ambiguous. As I've used it (and heard it used), browser fingerprinting can include things like HSTS supercookies or CSS history leaks, whereas device fingerprinting is more related to hardware fingerprinting. Maybe the ambiguity is the best reason to keep the various types of fingerprinting under one label, and only excise biometrics (which is a distinct field).
    – forest
    May 1, 2018 at 9:37

2 Answers 2

Reset to default
4

This is an updated proposal, based on discussion between @forest and me (see comments and edit history):

  • :

    Gaining information about current version of an application, operating system or hardware in order to find a vulnerability.

  • :

    Device fingerprinting (or browser fingerprinting) is a technique to uniquely identify a client by analyzing it's behaviour. This can be used to track users without cookies.

  • Questions about physical fingerprints still fall under .

Comments or further thoughts are welcome.

9
  • What would fingerprinting a remote server's hardware (e.g. on the Ethernet layer) fall under?
    – forest
    May 3, 2018 at 7:00
  • @forest Yeah, that is a good question. I think perhaps [software-fingerprinting] should be named something else so it could include that, but I don't know what. The main point is that I think we need to separate fingerprinting individual client device and fingerprinting server version.
    – Anders
    May 3, 2018 at 7:05
  • What about a [service-fingerprinting] and a [device-fingerprinting]? And then biometric fingerprinting could just stay as [biometrics] (since biometric fingerprinting and biometric authentication are different, but both part of biometrics).
    – forest
    May 3, 2018 at 7:19
  • @forest I like [service-fingerprinting] a lot, and I can live without the [biometric-fingerprint] tag.
    – Anders
    May 3, 2018 at 7:58
  • So [service-fingerprinting], [device-fingerprinting], and [biometrics]?
    – forest
    May 3, 2018 at 7:59
  • 1
    @forest Yeah, sounds good. Maybe I should edit this answer to reflect that, and we can leave it for a while to see if any more opinions come in.
    – Anders
    May 3, 2018 at 10:01
  • @forest See edit. Let me know if I got something wrong.
    – Anders
    May 4, 2018 at 7:55
  • Looks fine to me!
    – forest
    May 5, 2018 at 1:53
  • 2
    Read the discussion and the edit history and upvoted afterwards!
    – Tom K.
    May 9, 2018 at 12:30
1

My opinion is to separate all of these into just two tags: and .

The fingerprinting tag can include subjects related to device fingerprinting, browser fingerprinting, and OS fingerprinting. Basically any technique to uniquely identify a client or otherwise reduce its anonymity set through analysis of its behavior. The biometrics tag can be used for biometrics itself which covers anything from biometric authentication to biometric fingerprinting. Since fingerprinting terminology is sometimes a little ambiguous, and people do not always use the correct narrow definitions (for example, OS fingerprinting is often limited to only discovering what class of OS is running and nothing else), having tags for different forms of fingerprinting seems excessive.

I think that a literal fingerprint as used for authentication should fall under .

3
  • What about e.g. "How to determine what version of X is running on a server?" where X is Apache, Joomla, PHP, whatever? That's not "uniquely identify a client", but it is commonly refered to as fingerprinting. Should that also be the same tag?
    – Anders
    May 2, 2018 at 7:58
  • Not sure I am trying to make a point here, just asking for clarification.
    – Anders
    May 2, 2018 at 7:58
  • @Anders I think that would fall under fingerprinting as well, but server fingerprinting rather than client fingerprinting. A different service-fingerprinting and client-fingerprinting could be created, if people could be trusted to actually use them correctly. The main thing that could differentiate the questions would be the addition of an nmap tag (if someone wants to find out what service version their target is running), or an anonymity tag (if someone wants to make sure their browser configuration doesn't reduce their anonymity set due to fingerprinting).
    – forest
    May 2, 2018 at 7:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .