Employees of Mozilla results of a study on the possibility of identifying users based on their browsing profiles, which may be visible to third parties and websites. An analysis of 52,000 browsing profiles provided by Firefox users who participated in the experiment showed that site visit preferences are unique to each user and remain consistent. The uniqueness of the resulting browsing history profiles was 99%. Furthermore, the high degree of uniqueness of the profiles is maintained even if the sample is limited to just a hundred popular sites.
The possibility of re-identification was tested during a two-week experiment — data about visits in the first week were attempted to be matched with data from the second week. It was found that 50% of users who visited 50 or more different domains could be re-identified. When visiting 150 or more different domains, the rate of re-identification increased to 80%. The check was conducted on a sample of 10,000 websites to simulate data that large content providers might gather (for example, Google can monitor visits to 9,823 sites out of these 10,000, Facebook to 7,348, Verizon to 5,500).
This feature allows large owners of popular resources to quite likely identify users. For example, companies like Google, Facebook, and Twitter, whose widgets are placed on third-party sites, can theoretically re-identify around 80% of users.
Previously opened sites can also be identified indirectly, for example, by iterating through popular domain codes in JavaScript while assessing the difference in loading delays of resources — if a site has been recently accessed by a user, the resource will be served almost instantly from the browser cache. Methods for determining opened pages could previously involve caching HSTS settings (when accessing a site with HSTS, the HTTP request was immediately redirected to HTTPS without an attempt to reach it via HTTP) and the state of the CSS property 'visited'.
Similar methods for determining browsing history based on CSS were used in a similar study, From 2009 to 2011. This study showed the possibility of identifying 42% of users when checking 50 pages and 70% when checking 500 pages. Mozilla's research. and clarified the findings of the previous publication, significantly improving the accuracy of visit history identification while increasing the number of checked domains from 6000 to 10000 (data were obtained on 660000 domains, but a sample of the 10 thousand most popular domains was used for identification assessment).
Source: opennet.ru
