Browser Fingerprint Security: Storage & Submission

TL;DR

Storing browser fingerprints securely requires encryption at rest and in transit. Submitting them to endpoints should be done over HTTPS with robust authentication, rate limiting, and careful consideration of data minimisation.

1. Understanding Browser Fingerprints

Browser fingerprints are unique identifiers created from a user’s browser settings, installed plugins, fonts, operating system, and other characteristics. They can be used for tracking and identification. Because they aren’t cookies, standard cookie-blocking techniques don’t prevent them.

2. Secure Storage of Browser Fingerprints

1. Encryption at Rest: Never store fingerprints in plain text. Use a strong encryption algorithm like AES-256.
   • Key Management: Protect your encryption keys! Store them separately from the data, ideally using a Hardware Security Module (HSM) or a secure key management service.
   • Database Encryption: If storing in a database, use database-level encryption features if available.
2. Hashing: Before encrypting, consider hashing the fingerprint with a salt.

   # Example using Python and hashlib (for demonstration only - production code needs proper key handling)
   import hashlib
   salt = 'your_unique_salt'
   hash_object = hashlib.sha256((fingerprint + salt).encode())
   hashed_fingerprint = hash_object.hexdigest()
   

3. Regular Key Rotation: Change your encryption keys periodically to limit the impact of a potential compromise.
4. Access Control: Limit access to fingerprint data to only those who absolutely need it. Use role-based access control (RBAC).

3. Secure Submission of Browser Fingerprints

1. HTTPS: Always transmit fingerprints over HTTPS (TLS 1.2 or higher) to encrypt data in transit.
   • Valid SSL/TLS Certificate: Ensure your certificate is valid and properly configured.
2. Authentication & Authorization: Verify the identity of the submitting client (e.g., your web application) before accepting fingerprints.
   • API Keys: Use strong API keys with appropriate permissions.
   • Mutual TLS: For higher security, consider mutual TLS authentication where both the client and server verify each other’s certificates.
3. Rate Limiting: Implement rate limiting to prevent abuse and denial-of-service attacks.

   # Example using Nginx configuration
   limit_req_zone $binary_remote_addr zone=fingerprint_limit:10m rate=5r/s;
   ...
   location /submit-fingerprint {
     limit_req zone=fingerprint_limit burst=10 nodelay;
     ... 
   }

4. Input Validation & Sanitisation: Validate and sanitise the fingerprint data before storing it to prevent injection attacks.
   • Length Checks: Ensure the fingerprint is within expected length limits.
   • Character Restrictions: Allow only permitted characters.
5. Data Minimisation: Only collect and submit the minimum amount of data necessary.
   • Avoid unnecessary details: Don’t store information that isn’t critical for your use case.
6. Logging & Monitoring: Log all fingerprint submissions, including timestamps, IP addresses, and authentication status. Monitor logs for suspicious activity.

4. Additional Considerations

1. Regular Security Audits: Conduct regular security audits of your storage and submission processes to identify vulnerabilities.
2. Privacy Policy: Be transparent with users about how you collect, store, and use their browser fingerprints in your privacy policy.
3. Compliance: Ensure compliance with relevant data privacy regulations (e.g., GDPR, CCPA).