案例研究：在隐私政策中披露间接设备指纹
Case Study: Disclosure of Indirect Device Fingerprinting in Privacy Policies
摘要：
在线跟踪的最新发展使个人更难检测和阻止跟踪器。一些网站已经部署了间接跟踪方法，试图通过要求浏览器执行与安全无关的任务来唯一识别设备。一种类型的间接跟踪，Canvas指纹识别，使浏览器渲染图形记录渲染统计作为唯一标识符。在这项工作中，我们观察如何在隐私政策中披露间接设备指纹识别方法，并考虑披露是否足以使网站访问者阻止跟踪方法。我们将这些披露与相同网站上直接指纹识别方法的披露进行比较。我们的案例研究分析了一种间接指纹技术，画布指纹。我们使用现有的指纹识别技术的自动检测器来保守地检测其在Alexa Top 500网站上的使用，这些网站迎合了美国消费者，我们检查了由此产生的28个网站的隐私政策。间接指纹识别的披露在具体性上各不相同。没有人描述了足够粒度的具体方法来了解网站使用Canvas指纹识别。相反，许多网站确实提供了有关直接指纹识别方法使用的足够详细信息，以允许网站访问者可靠地检测和阻止这些技术。我们的结论是，间接指纹识别方法往往难以检测，并没有确定与隐私政策的特异性。这使得间接指纹更难阻止，因此有可能破坏目前个人和网站之间的暂时停战，以直接指纹。本文阐述了指纹识别方法的差异，并解释了为什么技术专家，技术律师和政策制定者需要理解间接指纹识别的挑战。
英文摘要：
Recent developments in online tracking make it harder for individuals to detect and block trackers. Some sites have deployed indirect tracking methods, which attempt to uniquely identify a device by asking the browser to perform a seemingly-unrelated task. One type of indirect tracking, Canvas fingerprinting, causes the browser to render a graphic recording rendering statistics as a unique identifier. In this work, we observe how indirect device fingerprinting methods are disclosed in privacy policies, and consider whether the disclosures are sufficient to enable website visitors to block the tracking methods. We compare these disclosures to the disclosure of direct fingerprinting methods on the same websites. Our case study analyzes one indirect fingerprinting technique, Canvas fingerprinting. We use an existing automated detector of this fingerprinting technique to conservatively detect its use on Alexa Top 500 websites that cater to United States consumers, and we examine the privacy policies of the resulting 28 websites. Disclosures of indirect fingerprinting vary in specificity. None described the specific methods with enough granularity to know the website used Canvas fingerprinting. Conversely, many sites did provide enough detail about usage of direct fingerprinting methods to allow a website visitor to reliably detect and block those techniques. We conclude that indirect fingerprinting methods are often difficult to detect and are not identified with specificity in privacy policies. This makes indirect fingerprinting more difficult to block, and therefore risks disturbing the tentative armistice between individuals and websites currently in place for direct fingerprinting. This paper illustrates differences in fingerprinting approaches, and explains why technologists, technology lawyers, and policymakers need to appreciate the challenges of indirect fingerprinting.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
