Bye Spy

Limits

What a web page cannot test

Tracking techniques Bye Spy leaves out, and why a single page visit cannot measure them fairly.

Bye Spy runs in your browser, from one page, in about twenty seconds. Some tracking techniques cannot be measured fairly under those conditions: they need infrastructure a page doesn't have, take hours to play out, or depend on details that change too often to test. The report lists them under What this page doesn't test; this page explains each in more depth. Being left out of the test says nothing about how serious a technique is.

DNS leaks

Before connecting to a site, your device asks a DNS resolver for its address. The resolver sees every name you look up and the address you ask from, usually unencrypted, and on a typical home connection it belongs to your internet provider[1]. A DNS leak is when those lookups bypass a VPN and go to the provider's resolver anyway. Detecting it takes a DNS server of the test's own: the page asks for a never-seen name under a domain the test controls, and the test's authoritative server logs which resolver came asking. Bye Spy runs no DNS server, so it cannot see your resolver.

TLS and HTTP/2 fingerprints

How a browser opens an encrypted connection is itself a fingerprint. The TLS ClientHello lists cipher suites, extensions, curves and formats in an order that identifies the browser and its version: JA3 (Salesforce, 2017) hashes these fields[2], and JA4 (FoxIO, 2023) sorts them first, so the fingerprint survives browsers that shuffle extension order[3]. HTTP/2 adds its own: the settings, window sizes, priorities and header order a client sends. Akamai researchers fingerprinted more than 40,000 user agents this way from passive traffic alone[4]. These fingerprints are read by servers and CDNs, mostly for bot detection, and no script is involved. Measuring them takes a server that records each connection's handshake; Bye Spy's server does not, so it cannot see these fingerprints.

HSTS and favicon supercookies

HSTS supercookies abuse the list of sites a browser has been told to reach only over HTTPS. A tracker sets HSTS on some of 32 subdomains to spell out a 32-bit identifier, then later requests all 32 over plain HTTP and sees which were upgraded. Sam Greenhalgh demonstrated this publicly in 2015[5]; WebKit later limited which hosts can set HSTS and ignored upgrades for third-party trackers[6], and Firefox partitions HSTS state by site since version 85[7]. Reading it back needs plain-HTTP subresources, which current browsers block or upgrade with warnings, so a fair test is no longer possible from an HTTPS page.

Favicon supercookies use the separate cache browsers keep for site icons. Solomos and colleagues showed that a redirect chain through subdomains could write a 32-bit identifier into it, readable again in about two seconds, surviving the clearing of browsing data and private windows[8]. The interesting case, whether the identifier survives clearing site data, cannot be tested within one run.

CNAME cloaking

A site can point one of its own subdomains (say metrics.shop.example) at a tracking company with a DNS CNAME record. To the browser, the tracker is now first-party: it receives the site's first-party cookies and escapes third-party blocking. Dimova and colleagues found CNAME-based trackers on 9.98% of the 10,000 most popular sites, and cookies leaking to them on 95% of the sites that used them[9]. uBlock Origin in Firefox can uncloak these requests, because Firefox lets extensions resolve DNS[10], and Safari caps cookies set through cloaked responses at seven days[11]. Testing it would take DNS records on a real first-party site pointing at a real tracker.

Bounce tracking and identifier smuggling

A link can route you through a tracker's domain for a fraction of a second on the way to its destination (a bounce), letting the tracker read and set its own first-party cookie. An identifier can also be carried in the link itself and stored by the destination (UID smuggling). Randall and colleagues found UID smuggling on 8.1% of the unique navigation paths they crawled, and bounce tracking without it on another 2.7%[12]; Koop and colleagues had measured redirect tracking at scale earlier[13]. Browsers answer by deleting the state of domains that only ever appear as bounces: Safari since ITP 2.0 (2018)[14], Firefox with Strict tracking protection since version 133 (2024)[15], and Chrome when third-party cookies are blocked[16]. The deletion happens hours or days later, long after a test run ends. Bye Spy does test the part that happens at once: whether click identifiers are stripped from links.

Extension detection

Extensions change pages and expose files, and both can be detected. Sjösten and colleagues detected more than half of the 1,000 most popular free Chrome extensions from their web-accessible resources[17]; Carnus fingerprinted 29,428 extensions from their behaviour and showed that a person's set of extensions, matched against public reviews, can help identify them[18]. Whether a given extension is detectable depends on its internals, which change with every release, so a fair, general test is not possible. The irony is not lost: privacy extensions are among the most detectable.

VPN, proxy and Tor detection

Sites can label an address as a VPN exit, a data-centre proxy or a Tor exit node by matching it against lists. Tor publishes its exits; commercial services sell the rest. The answer says how you connect, not who you are, and it needs lists the test would have to keep up to date. Bye Spy shows your address and, through the WebRTC check, whether your real address leaks past a VPN.

Behavioural tracking

How you type and move the pointer is characteristic enough to authenticate people, a result as old as keystroke-dynamics research in the late 1990s[19], and fraud-prevention services score sessions on these behaviours. Session-replay scripts go further and record everything you do on a page: in 2017, Englehardt, Acar and Narayanan found them on 482 of the 50,000 most popular sites, capturing text typed into forms, sometimes including passwords and card numbers[20]. Any script on a page can observe input events, and no browser setting stops it. What can stop it is blocking the scripts: four session-recording services are among the real tracker servers Bye Spy tests.

Beyond the browser

Tracking has been moving to where a browser test cannot see it at all:

  • Server-to-server reporting. Instead of a pixel in your browser, a site's server sends events to an ad platform directly: Meta's Conversions API and Google's server-side tagging are designed for this[21][22]. Blocking and partitioning in the browser have nothing to act on.
  • Identity-based tracking. When you sign in or enter an email address, sites can derive a pseudonymous identifier from it and share it with partners, as in Unified ID 2.0[23]. It links you as reliably as a cookie, across devices too.
  • First-party data. Whatever a site learns from your account, purchases and visits is its own, subject to law rather than to browser engineering.

A perfect score means your browser withholds what a browser can withhold. These channels are why it cannot mean more.

References

  1. S. Bortzmeyer. RFC 7626, "DNS Privacy Considerations." IETF, 2015. rfc-editor.org/rfc/rfc7626
  2. J. Althouse, J. Atkinson, J. Atkins. JA3, Salesforce, 2017. github.com/salesforce/ja3
  3. J. Althouse. "JA4+ Network Fingerprinting." FoxIO, September 2023, republished by APNIC; JA4+ source code. blog.apnic.net/2023/11/22/ja4-network-fingerprinting, github.com/FoxIO-LLC/ja4
  4. E. Shuster, O. Segal, A. Fridman. "Passive Fingerprinting of HTTP/2 Clients." Akamai, Black Hat Europe 2017. blackhat.com/docs/eu-17/materials/eu-17-Shuster-Passive-Fingerprinting-Of-HTTP2-Clients-wp.pdf
  5. The Register. "HTTPS can be set as your SUPERCOOKIE." 6 January 2015. theregister.com/2015/01/06/https_can_be_set_as_your_supercookie
  6. B. Fulgham. "Protecting Against HSTS Abuse." WebKit blog, 16 March 2018. webkit.org/blog/8146
  7. Mozilla Security Blog. "Firefox 85 Cracks Down on Supercookies." 26 January 2021. blog.mozilla.org/security/2021/01/26/supercookie-protections
  8. K. Solomos, J. Kristoff, C. Kanich, J. Polakis. "Tales of Favicons and Caches: Persistent Tracking in Modern Browsers." NDSS, 2021. ndss-symposium.org/ndss-paper/tales-of-favicons-and-caches-…
  9. Y. Dimova, G. Acar, L. Olejnik, W. Joosen, T. Van Goethem. "The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion." PoPETs 2021(3). arXiv:2102.09301
  10. uBlock Origin 1.25.0 release notes. github.com/gorhill/uBlock/releases/tag/1.25.0
  11. J. Wilander. "CNAME Cloaking and Bounce Tracking Defense." WebKit blog, 12 November 2020. webkit.org/blog/11338
  12. A. Randall et al. "Measuring UID Smuggling in the Wild." ACM IMC, 2022. arXiv:2203.10188
  13. M. Koop, E. Tews, S. Katzenbeisser. "In-Depth Evaluation of Redirect Tracking and Link Usage." PoPETs 2020(4).
  14. J. Wilander. "Intelligent Tracking Prevention 2.0." WebKit blog, 4 June 2018. webkit.org/blog/8311
  15. Mozilla. Firefox 133.0 release notes, November 2024. firefox.com/en-US/firefox/133.0/releasenotes
  16. MDN. "Bounce tracking mitigations." developer.mozilla.org/…/Bounce_tracking_mitigations
  17. A. Sjösten, S. Van Acker, A. Sabelfeld. "Discovering Browser Extensions via Web Accessible Resources." ACM CODASPY, 2017. doi:10.1145/3029806.3029820
  18. S. Karami, P. Ilia, K. Solomos, J. Polakis. "Carnus: Exploring the Privacy Threats of Browser Extension Fingerprinting." NDSS, 2020. ndss-symposium.org/ndss-paper/carnus-…
  19. F. Monrose and A. Rubin. "Authentication via Keystroke Dynamics." ACM CCS, 1997.
  20. S. Englehardt, G. Acar, A. Narayanan. "No boundaries: Exfiltration of personal data by session-replay scripts." Freedom to Tinker, Princeton CITP, 15 November 2017. blog.citp.princeton.edu/2017/11/15/…
  21. Meta for Developers. Conversions API. developers.facebook.com/documentation/ads-commerce/conversions-api
  22. Google. Server-side tagging. developers.google.com/tag-platform/tag-manager/server-side
  23. Unified ID 2.0 documentation. unifiedid.com/docs/intro

See what your browser gives away.

Run the test