De-anonymization of VPN and Proxy Users through User Agent and Browser Fingerprints

I want to clarify right away: in this article, I use "User agent" as a generalized term for the information collected by websites. While this is not entirely accurate from a terminology standpoint, it is simple and understandable for readers.

I have already touched upon the threat of uniqueness in the course, and now it is time to consider the practical use of uniqueness for de-anonymization. Many untrained users find this topic intimidating due to its complexity, but in reality, it is not that complicated.

Each of you travels across websites and uses special software called a browser for this purpose. We work with different browsers: some use Chrome, others use Safari, some have Yandex.Browser, the most sensible use Mozilla, while some still use Internet Explorer. But even if three people have the same browser, for example, Mozilla Firefox, one might be using Windows, another macOS, and the third Linux Mint. One updates the browser on time, while another still uses an outdated version; one has the browser language set to English, while another has it set to Russian.

Websites need information about your browser: for example, the browser language to understand which version of a multilingual site to show you; the resolution to determine whether to provide a mobile or standard version of the site.

Websites can see a lot, even your system time, which is often used for a simple check of the presence of VPN, or proxy. Suppose you are using a VPN and your IP address indicates that you are in the glorious city of Washington. However, your system time and the Russian language of your browser suggest that you are more likely somewhere in the European part of Russia.

You can view information about your browser at this link.

And so the website has received information about you: the type and version of the browser, the type of operating system, the language, system time, screen resolution, and some other technical information. How many people do you think have all this data matching? In fact, there are not so few, and some combinations can amount to millions.

Naturally, there can be no talk of uniqueness; it is only about narrowing down the circle. Additional indicators are needed to make this website visitor even more unique, and this is where fingerprints come into play: Canvas, WebGL, and audio fingerprint.