Catalogue · Section 05 · Entry
Cao et al. — (Cross-)Browser Fingerprinting
ACTIVE
Cao et al. — (Cross-)Browser Fingerprinting is a paper catalogued in section 05 of this register. NDSS 2017. Identifying a machine across two different browsers via OS and hardware features. At the last field check its address answered, which is the whole of what ACTIVE means for an entry with no repository behind it.
The fields this state was derived from
| Field | Value at this printing |
|---|---|
| http_status | 200 |
| fetched_at | 2026-08-14T09:12:00Z |
| endpoint | HEAD https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/cross-browser-fingerprinting-os-and-hardware-level-features/ |
| rubric_edition | 2nd, in force since 2026-08-14 |
This entry has no repository, so there is no API field a browser can re-read across origins. Its state comes from the register's own link check, printed above with the instant it was made.
Why it reads ACTIVE
No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Shipping. Safe to build on today.
Under the superseded first edition
UNSTATED
ACTIVE
No repository. The first edition had no link liveness sweep and therefore no field to read here.
The rubric in force · The superseded first edition · Errata leaf
What Cao et al. — (Cross-)Browser Fingerprinting actually does
Identifies the same machine across two different browsers by reaching for features that belong to the operating system and the hardware rather than to the browser — fonts, graphics rendering, audio processing.
What can and cannot be measured about Cao et al. — (Cross-)Browser Fingerprinting
This entry has no repository, so none of the usual repository fields exist for it — no push date, no release tag, no archive flag, no licence identifier. Its state comes from one measurement only: the register requested the address and recorded what came back. Anything in the range 200 to 399 makes a non-repository entry ACTIVE, and that clause is the one the first edition of the rubric did not have at all, which is why paper entries carried no state under it.
Read that for exactly what it is. It says the thing is reachable. It does not say the paper is current, because no HTTP status can carry that. Where a stronger signal exists — a repository, a version, a dated revision — this register prefers it, and where one does not, it prints the weaker signal and names it as weak rather than dressing it up.
Where Cao et al. — (Cross-)Browser Fingerprinting sits in this catalogue
Cao et al. — (Cross-)Browser Fingerprinting is filed in section 05, academic papers & technical writeups, whose scope is this: The peer-reviewed and specification-grade literature this field is built on, preferring open mirrors over publishers that block automated clients. An entry sits in exactly one section here. Where a project could defensibly go in two, it is placed where a reader would look for it first rather than where it fits most tidily, and that is an editorial decision rather than a measured one.
Filed beside it in the same section: Gómez-Boix et al. — Hiding in the Crowd (ACTIVE), Mowery & Shacham — Pixel Perfect (ACTIVE), Nikiforakis et al. — Cookieless Monster (ACTIVE). Comparing an entry against its own section-mates is more informative than comparing it against the catalogue as a whole, because everything in a section is answering roughly the same question and the differences left over are the ones that matter.
There is no licence field, because there is no source to licence — this is a paper rather than a code repository. It is grouped instead with every other entry the rubric marks ACTIVE, which is the axis that actually distinguishes entries of this kind from one another.
What to settle before you adopt Cao et al. — (Cross-)Browser Fingerprinting
This is the result that breaks the assumption that a separate browser is a separate identity. If your isolation model relies on switching browsers, this paper is the one that tests it.
Questions readers ask about Cao et al. — (Cross-)Browser Fingerprinting
Answered from this entry's own fields, at the field check printed above and at no other instant.
Is Cao — cross-browser fingerprinting still maintained?
Cao et al. — (Cross-)Browser Fingerprinting has no repository, so this register cannot answer that from a commit history. What it can do is request the address and record the result, which is what produced ACTIVE. Shipping. Safe to build on today.
What else in this registry does the job Cao — cross-browser fingerprinting does?
No substitution edge is declared for this entry, which means nobody has stated one rather than that none exists. The nearest comparison available is the rest of section 05, where everything is answering roughly the same question on the same printed fields.
What licence is Cao — cross-browser fingerprinting under?
The question does not apply — Cao et al. — (Cross-)Browser Fingerprinting is a paper rather than source code, so this register records the licence field as not applicable rather than inventing one. Terms of use, where they exist, are the publisher's to state at the address above.
Why did the state recorded for Cao — cross-browser fingerprinting change?
Because the rules changed, not because the world did. The same field data reads UNSTATED under the superseded first edition and ACTIVE under the edition in force. Both derivations are printed on this page, and the entry appears on this printing's errata leaf with the superseded value struck rather than deleted.
The literature in section 05 keeps arriving at the same finding from different directions: what gets a browser caught is not rarity but contradiction between its own signals. Donut Browser is built around that result rather than around the older one — the Wayfern fork spoofs at engine level over CDP so the values a page reads are coherent with each other, and a pre-launch gate refuses to start a profile whose proxy geography disagrees with its fingerprint.
curl -fsSL https://donutbrowser.com/install.sh | sh
macOS (DMG, Homebrew cask donut), Windows (installer and portable), Linux (deb, rpm, AppImage, with APT and RPM repositories at repo.donutbrowser.com), and a Nix flake. Desktop only — there is no mobile build target. Ten shipped languages. Source, AGPL-3.0 · its own entry, judged by the same rubric · the keepers' disclosure.