main.tex

%% bare_conf.tex
%% V1.3
%% 2007/01/11
%% by Michael Shell
%% See:
%% http://www.michaelshell.org/
%% for current contact information.
%%
%% This is a skeleton file demonstrating the use of IEEEtran.cls
%% (requires IEEEtran.cls version 1.7 or later) with an IEEE conference paper.
%%
%% Support sites:
%% http://www.michaelshell.org/tex/ieeetran/
%% http://www.ctan.org/tex-archive/macros/latex/contrib/IEEEtran/
%% and
%% http://www.ieee.org/

%%*************************************************************************
%% Legal Notice:
%% This code is offered as-is without any warranty either expressed or
%% implied; without even the implied warranty of MERCHANTABILITY or
%% FITNESS FOR A PARTICULAR PURPOSE! 
%% User assumes all risk.
%% In no event shall IEEE or any contributor to this code be liable for
%% any damages or losses, including, but not limited to, incidental,
%% consequential, or any other damages, resulting from the use or misuse
%% of any information contained here.
%%
%% All comments are the opinions of their respective authors and are not
%% necessarily endorsed by the IEEE.
%%
%% This work is distributed under the LaTeX Project Public License (LPPL)
%% ( http://www.latex-project.org/ ) version 1.3, and may be freely used,
%% distributed and modified. A copy of the LPPL, version 1.3, is included
%% in the base LaTeX documentation of all distributions of LaTeX released
%% 2003/12/01 or later.
%% Retain all contribution notices and credits.
%% ** Modified files should be clearly indicated as such, including  **
%% ** renaming them and changing author support contact information. **
%%
%% File list of work: IEEEtran.cls, IEEEt
ran_HOWTO.pdf, bare_adv.tex,
%%                    bare_conf.tex, bare_jrnl.tex, bare_jrnl_compsoc.tex
%%*************************************************************************

% *** Authors should verify (and, if needed, correct) their LaTeX system  ***
% *** with the testflow diagnostic prior to trusting their LaTeX platform ***
% *** with production work. IEEE's font choices can trigger bugs that do  ***
% *** not appear when using other class files.                            ***
% The testflow support page is at:
% http://www.michaelshell.org/tex/testflow/



% Note that the a4paper option is mainly intended so that authors in
% countries using A4 can easily print to A4 and see how their papers will
% look in print - the typesetting of the document will not typically be
% affected with changes in paper size (but the bottom and side margins will).
% Use the testflow package mentioned above to verify correct handling of
% both paper sizes by the user's LaTeX system.
%
% Also note that the "draftcls" or "draftclsnofoot", not "draft", option
% should be used if it is desired that the figures are to be displayed in
% draft mode.
%
\documentclass[conference]{IEEEtran}
\usepackage{blindtext, graphicx}
% Add the compsoc option for Computer Society conferences.
%
% If IEEEtran.cls has not been installed into the LaTeX system files,
% manually specify the path to it like:
% \documentclass[conference]{../sty/IEEEtran}





% Some very useful LaTeX packages include:
% (uncomment the ones you want to load)


% *** MISC UTILITY PACKAGES ***
%
%\usepackage{ifpdf}
% Heiko Oberdiek's ifpdf.sty is very useful if you need conditional
% compilation based on whether the output is pdf or dvi.
% usage:
% \ifpdf
%   % pdf code
% \else
%   % dvi code
% \fi
% The latest version of ifpdf.sty can be obtained from:
% http://www.ctan.org/tex-archive/macros/latex/contrib/oberdiek/
% Also, note that IEEEtran.cls V1.7 and later provides a builtin
% \ifCLASSINFOpdf conditional that works the same way.
% When switching from latex to pdflatex and vice-versa, the compiler may
% have to be run twice to clear warning/error messages.






% *** CITATION PACKAGES ***
%
%\usepackage{cite}
% cite.sty was written by Donald Arseneau
% V1.6 and later of IEEEtran pre-defines the format of the cite.sty package
% \cite{} output to follow that of IEEE. Loading the cite package will
% result in citation numbers being automatically sorted and properly
% "compressed/ranged". e.g., [1], [9], [2], [7], [5], [6] without using
% cite.sty will become [1], [2], [5]--[7], [9] using cite.sty. cite.sty's
% \cite will automatically add leading space, if needed. Use cite.sty's
% noadjust option (cite.sty V3.8 and later) if you want to turn this off.
% cite.sty is already installed on most LaTeX systems. Be sure and use
% version 4.0 (2003-05-27) and later if using hyperref.sty. cite.sty does
% not currently provide for hyperlinked citations.
% The latest version can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/cite/
% The documentation is contained in the cite.sty file itself.






% *** GRAPHICS RELATED PACKAGES ***
%
\ifCLASSINFOpdf
  % \usepackage[pdftex]{graphicx}
  % declare the path(s) where your graphic files are
  % \graphicspath{{../pdf/}{../jpeg/}}
  % and their extensions so you won't have to specify these with
  % every instance of \includegraphics
  % \DeclareGraphicsExtensions{.pdf,.jpeg,.png}
\else
  % or other class option (dvipsone, dvipdf, if not using dvips). graphicx
  % will default to the driver specified in the system graphics.cfg if no
  % driver is specified.
  % \usepackage[dvips]{graphicx}
  % declare the path(s) where your graphic files are
  % \graphicspath{{../eps/}}
  % and their extensions so you won't have to specify these with
  % every instance of \includegraphics
  % \DeclareGraphicsExtensions{.eps}
\fi
% graphicx was written by David Carlisle and Sebastian Rahtz. It is
% required if you want graphics, photos, etc. graphicx.sty is already
% installed on most LaTeX systems. The latest version and documentation can
% be obtained at: 
% http://www.ctan.org/tex-archive/macros/latex/required/graphics/
% Another good source of documentation is "Using Imported Graphics in
% LaTeX2e" by Keith Reckdahl which can be found as epslatex.ps or
% epslatex.pdf at: http://www.ctan.org/tex-archive/info/
%
% latex, and pdflatex in dvi mode, support graphics in encapsulated
% postscript (.eps) format. pdflatex in pdf mode supports graphics
% in .pdf, .jpeg, .png and .mps (metapost) formats. Users should ensure
% that all non-photo figures use a vector format (.eps, .pdf, .mps) and
% not a bitmapped formats (.jpeg, .png). IEEE frowns on bitmapped formats
% which can result in "jaggedy"/blurry rendering of lines and letters as
% well as large increases in file sizes.
%
% You can find documentation about the pdfTeX application at:
% http://www.tug.org/applications/pdftex





% *** MATH PACKAGES ***
%
%\usepackage[cmex10]{amsmath}
% A popular package from the American Mathematical Society that provides
% many useful and powerful commands for dealing with mathematics. If using
% it, be sure to load this package with the cmex10 option to ensure that
% only type 1 fonts will utilized at all point sizes. Without this option,
% it is possible that some math symbols, particularly those within
% footnotes, will be rendered in bitmap form which will result in a
% document that can not be IEEE Xplore compliant!
%
% Also, note that the amsmath package sets \interdisplaylinepenalty to 10000
% thus preventing page breaks from occurring within multiline equations. Use:
%\interdisplaylinepenalty=2500
% after loading amsmath to restore such page breaks as IEEEtran.cls normally
% does. amsmath.sty is already installed on most LaTeX systems. The latest
% version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/required/amslatex/math/





% *** SPECIALIZED LIST PACKAGES ***
%
%\usepackage{algorithmic}
% algorithmic.sty was written by Peter Williams and Rogerio Brito.
% This package provides an algorithmic environment fo describing algorithms.
% You can use the algorithmic environment in-text or within a figure
% environment to provide for a floating algorithm. Do NOT use the algorithm
% floating environment provided by algorithm.sty (by the same authors) or
% algorithm2e.sty (by Christophe Fiorio) as IEEE does not use dedicated
% algorithm float types and packages that provide these will not provide
% correct IEEE style captions. The latest version and documentation of
% algorithmic.sty can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/algorithms/
% There is also a support site at:
% http://algorithms.berlios.de/index.html
% Also of interest may be the (relatively newer and more customizable)
% algorithmicx.sty package by Szasz Janos:
% http://www.ctan.org/tex-archive/macros/latex/contrib/algorithmicx/




% *** ALIGNMENT PACKAGES ***
%
%\usepackage{array}
% Frank Mittelbach's and David Carlisle's array.sty patches and improves
% the standard LaTeX2e array and tabular environments to provide better
% appearance and additional user controls. As the default LaTeX2e table
% generation code is lacking to the point of almost being broken with
% respect to the quality of the end results, all users are strongly
% advised to use an enhanced (at the very least that provided by array.sty)
% set of table tools. array.sty is already installed on most systems. The
% latest version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/required/tools/


%\usepackage{mdwmath}
%\usepackage{mdwtab}
% Also highly recommended is Mark Wooding's extremely powerful MDW tools,
% especially mdwmath.sty and mdwtab.sty which are used to format equations
% and tables, respectively. The MDWtools set is already installed on most
% LaTeX systems. The lastest version and documentation is available at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/mdwtools/


% IEEEtran contains the IEEEeqnarray family of commands that can be used to
% generate multiline equations as well as matrices, tables, etc., of high
% quality.


%\usepackage{eqparbox}
% Also of notable interest is Scott Pakin's eqparbox package for creating
% (automatically sized) equal width boxes - aka "natural width parboxes".
% Available at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/eqparbox/





% *** SUBFIGURE PACKAGES ***
%\usepackage[tight,footnotesize]{subfigure}
% subfigure.sty was written by Steven Douglas Cochran. This package makes it
% easy to put subfigures in your figures. e.g., "Figure 1a and 1b". For IEEE
% work, it is a good idea to load it with the tight package option to reduce
% the amount of white space around the subfigures. subfigure.sty is already
% installed on most LaTeX systems. The latest version and documentation can
% be obtained at:
% http://www.ctan.org/tex-archive/obsolete/macros/latex/contrib/subfigure/
% subfigure.sty has been superceeded by subfig.sty.



%\usepackage[caption=false]{caption}
%\usepackage[font=footnotesize]{subfig}
% subfig.sty, also written by Steven Douglas Cochran, is the modern
% replacement for subfigure.sty. However, subfig.sty requires and
% automatically loads Axel Sommerfeldt's caption.sty which will override
% IEEEtran.cls handling of captions and this will result in nonIEEE style
% figure/table captions. To prevent this problem, be sure and preload
% caption.sty with its "caption=false" package option. This is will preserve
% IEEEtran.cls handing of captions. Version 1.3 (2005/06/28) and later 
% (recommended due to many improvements over 1.2) of subfig.sty supports
% the caption=false option directly:
%\usepackage[caption=false,font=footnotesize]{subfig}
%
% The latest version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/subfig/
% The latest version and documentation of caption.sty can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/caption/




% *** FLOAT PACKAGES ***
%
%\usepackage{fixltx2e}
% fixltx2e, the successor to the earlier fix2col.sty, was written by
% Frank Mittelbach and David Carlisle. This package corrects a few problems
% in the LaTeX2e kernel, the most notable of which is that in current
% LaTeX2e releases, the ordering of single and double column floats is not
% guaranteed to be preserved. Thus, an unpatched LaTeX2e can allow a
% single column figure to be placed prior to an earlier double column
% figure. The latest version and documentation can be found at:
% http://www.ctan.org/tex-archive/macros/latex/base/



%\usepackage{stfloats}
% stfloats.sty was written by Sigitas Tolusis. This package gives LaTeX2e
% the ability to do double column floats at the bottom of the page as well
% as the top. (e.g., "\begin{figure*}[!b]" is not normally possible in
% LaTeX2e). It also provides a command:
%\fnbelowfloat
% to enable the placement of footnotes below bottom floats (the standard
% LaTeX2e kernel puts them above bottom floats). This is an invasive package
% which rewrites many portions of the LaTeX2e float routines. It may not work
% with other packages that modify the LaTeX2e float routines. The latest
% version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/sttools/
% Documentation is contained in the stfloats.sty comments as well as in the
% presfull.pdf file. Do not use the stfloats baselinefloat ability as IEEE
% does not allow \baselineskip to stretch. Authors submitting work to the
% IEEE should note that IEEE rarely uses double column equations and
% that authors should try to avoid such use. Do not be tempted to use the
% cuted.sty or midfloat.sty packages (also by Sigitas Tolusis) as IEEE does
% not format its papers in such ways.





% *** PDF, URL AND HYPERLINK PACKAGES ***
%
%\usepackage{url}
% url.sty was written by Donald Arseneau. It provides better support for
% handling and breaking URLs. url.sty is already installed on most LaTeX
% systems. The latest version can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/misc/
% Read the url.sty source comments for usage information. Basically,
% \url{my_url_here}.





% *** Do not adjust lengths that control margins, column widths, etc. ***
% *** Do not use packages that alter fonts (such as pslatex).         ***
% There should be no need to do such things with IEEEtran.cls V1.6 and later.
% (Unless specifically asked to do so by the journal or conference you plan
% to submit to, of course. )


% correct bad hyphenation here
\hyphenation{op-tical net-works semi-conduc-tor}


\begin{document}
%
% paper title
% can use linebreaks \\ within to get better formatting as desired
\title{Browser Fingerprinting in Tor Browser}


% author names and affiliations
% use a multiple column layout for up to three different
% affiliations
\author{\IEEEauthorblockN{Heeraj H Nair}
\IEEEauthorblockA{Amrita School Of Engineering\\
Amritapuri\\
Email: heerajhnair@am.students.amrita.edu}}

% conference papers do not typically use \thanks and this command
% is locked out in conference mode. If really needed, such as for
% the acknowledgment of grants, issue a \IEEEoverridecommandlockouts
% after \documentclass

% for over three affiliations, or if they all won't fit within the width
% of the page, use this alternative format:
% 
%\author{\IEEEauthorblockN{Michael Shell\IEEEauthorrefmark{1},
%Homer Simpson\IEEEauthorrefmark{2},
%James Kirk\IEEEauthorrefmark{3}, 
%Montgomery Scott\IEEEauthorrefmark{3} and
%Eldon Tyrell\IEEEauthorrefmark{4}}
%\IEEEauthorblockA{\IEEEauthorrefmark{1}School of Electrical and Computer Engineering\\
%Georgia Institute of Technology,
%Atlanta, Georgia 30332--0250\\ Email: see http://www.michaelshell.org/contact.html}
%\IEEEauthorblockA{\IEEEauthorrefmark{2}Twentieth Century Fox, Springfield, USA\\
%Email: homer@thesimpsons.com}
%\IEEEauthorblockA{\IEEEauthorrefmark{3}Starfleet Academy, San Francisco, California 96678-2391\\
%Telephone: (800) 555--1212, Fax: (888) 555--1212}
%\IEEEauthorblockA{\IEEEauthorrefmark{4}Tyrell Inc., 123 Replicant Street, Los Angeles, California 90210--4321}}




% use for special paper notices
%\IEEEspecialpapernotice{(Invited Paper)}




% make the title area
\maketitle


\begin{abstract}
%\boldmath
In this proposal, We investigate the extent of device fingerprinting possible in Tor browser via the different JavaScript API. We even examine how much perlavent are the older fingerprinting technique. We will also examine all the Javascript API's for finding new fingerprinting technique. We will try to produce a unique hash with the help of these results which will help the users to track without the help of cookies. We will be analyzing the Tor browser bug trac issues and some side channel attacks. After the end of the research we will come with add-on which will defend with the privacy issues in firefox. We will also propose our idea on how the defence can be made to defend this issue for Tor browser.
\end{abstract}
% IEEEtran.cls defaults to using nonbold math in the Abstract.
% This preserves the distinction between vectors and scalars. However,
% if the journal you are submitting to favors bold math in the abstract,
% then you can use LaTeX's standard command \boldmath at the very start
% of the abstract to achieve this. Many IEEE journals frown on math
% in the abstract anyway.

% Note that keywords are not normally used for peerreview papers.
\begin{IEEEkeywords}
Tor, Fingerprinting, Tracking
\end{IEEEkeywords}






% For peer review papers, you can put extra information on the cover
% page as needed:
% \ifCLASSOPTIONpeerreview
% \begin{center} \bfseries EDICS Category: 3-BBND \end{center}
% \fi
%
% For peerreview papers, this IEEEtran command inserts a page break and
% creates the second title. It will be ignored for other modes.
\IEEEpeerreviewmaketitle



\section{Introduction}
Web advertisers and analytic collect large volume of data based on our Internet browsing pattern. These type of data help them to make user profile which eventually reveals your user location, incomes, family status, interests and much about you. Identification of user can lead to showing higher prices, blocking some services or data and even directing to misleading information.

Most of the users to defend tracking usually delete their cookies but the tracking technologies are much evolved practice of deleting cookies have become less effective to users who is defending using deleting cookies. Many defencing tactics have been evolved in the recent years such as 'incognito' mode or private browsing, use of VPN or IP masking techniques, use of extensions and adds-on such as Ghostery, Disconnect, HTTPS everywhere etc.

But most of the defensive technique fail if the advertiser use the method of fingerprinting. Browser fingerprinting is a technique of uniquely identifying the individual user by the unique pattern of information collected which often includes browser type and version, operating system and version, screen resolution, font detection, plugins, time zones, languages, battery usage, hardware configurations and many more.

More that 2 Million of daily users use anonymous services such as Tor to defend client's privacy from his destination. Tor communicated through multiple number of relays using numerous number of encryptions such that none of the relays will be revealed the client's identity and destination. But still the advertisers can still cause privacy issues by using Browser fingerprinting.Tor browser has done series of patches to enhanse their privacy, they are using a component Tor button which takes care of Application level security and privacy concerns in Firefox. To protect against Tor exit Node eavesdropper, it includes HTTPS-Everywhere and to protect from optional defense against javascript and other potential exploit vectors using NoScript.

Tor browser doesn't support some APIs such as Battery API, Network Connection API and plugins such as Flash. Fingerprinting techniques like Font Fingerprinting are defended by disabling all the attempts to enumerate the system font by limiting the number of fonts in the system. Moreover the image data from the canvas is returned blank to defend against canvas Fingerprinting technique. But some of the browser properties has to released that are given same values and the properties that uncover the identity are simply disabled.

According to 2015 study, 90\% .onion sites are distinguishable from the regular sites. We will also be dealing with side channel attacks, side channel attacks are based on the information gained from the physical implementation rather than brute force or theoretical weakness. 

\section{Background and Related work}
\section*{Background}
Krishnamurthy and Wills on their paper, Privacy Diffusion on the web[2] have done a longitudinal study where they have shown that tracking on the web have steadily increased and more an more techniques are formed in the coming years which implies there should be more study done on the area of privacy.

Privacy techniques has quite evolved in the past 10 years. Ten years back, for tracking the users HTTP cookies were used then it went towards Flash cookies. With the evolution of web and introduction of HTML5 the trackers or the third party advertisers started using HTML5 storage such as localStorage, sessionStorage, indexedDB and ETag for tracking users. But the limitation with the HTTP cookie user delete cookies within 30 days. 

With the advancement of web tracking third party trackers and advertisers started focusing on browser fingerprinting. Browser fingerprinting is one of most used way of tracking user's nowadays. Many of the API such as battery API, network API, WebGL, Canvas, browser properties, plugins and many other propeties are being used for uniquely identifying the users. Beyond that there are even some research where the login leaks can identify which social network the users are currently logged in. Nowadays extensions and adds on have become a part of web browser, by loading the URI schema and event handlers we can make user profile which make the advertiser know which extensions are being used by a user.

Many of the browser fingerprinting techniques such as canvas fingerprinting, font and plugin enumeration, extension detection and other tracking issues which are still prevalent in browsers such as Mozilla, chrome etc. But these issues have defense in the case of tor browser.  the Some of side channels attacks and some other fingerprinting techniques such as os fingerprinting using math function, getClientRects fingerprinting and audio fingerprinting are still present. Canvas Fingerprinting[1] which one of the major fingerprinting techniques which is been used by big companies has defense technique with Tor Browser but  it doesn't automatically deny canvas Fingerprinting or block it. It gives a prompt or user a access to whether allow it or not.

\section{Design and Model foI for Tor Browser}
Tor browser is based on Mozilla Extended Support Release(ESR) Firefox branch. But there are many patches been applied to enhance the security and privacy. Some of the famous security features include HTTPS everywhere, which automatically switches thousands of sites from HTTP to HTTPS. Many of the patches are even done in Firefox and even the Tor browser features is augmented through the Tor browser extension. As a part of protection against Tor Exit Node eavesdroping, they have used HTTPS-Everywhere and to provide optional defense against javascript they have user NoSript and even they have made many modification in several of Firefox settings.

Privacy requirements help in reducing the privacy risk and ability of user's activity of one website to be linked with the user's activity of the another website without any knowledge of the user. 

 - Cross-Origin Identifier Unlinkability :  
Users activity must not be linked from one origin by any other origin without user interation and approval. This is mainly due to authentication tokens, browser identifiers and shared state.

 - Cross-Origin Fingerprinting Unlinkability : Users activity must not be linked from one origin to another origin by any of the third party from fingerprinting browser behaviour

 - Long-Term Unlinkability : browser should clear all its linkable state such authentication tokens and browser state and obtain a fresh identity.
 
Tor browser is not using any addons such as Addblock Plus, Ghostery, Priv3 which are actually avoided because they believe these are not going to ensure any privacy protection, Tor believe the development should be in general solution. (Give the dom change paper xhound) One of the research which happened in recent years showed that both extension and addons usage can be another fingerprinting vector as they can identifed using chrom URI and they produce change in the DOM which can lead us to easily who which extension they are using.  

There are 3 diffginerent security level in Tor browser - high, medium and low. In High Javascript is disabled by default. In some sites Javascript is enabled performance optimizations are disabled. Scripts on some sites may run slower.HTML5 video and audio media become click to play via NoScript. Some mechanism of displaying math equations, some font rendering features, some  types of images are disabled. In medium, same things are implied but Javascript is only disabled in non-HTTPS sites. Low level is most usable level in Tor browser. It doesn't block Javascript. 

In Torbrowser the Firefox proxy settings use Tor directly as a SOCKS proxy. To prevent WebRTC at the compile time it is disabled. All the plugins such as flash are disabled in Tor browser. Firefox addons can perform arbitary activity including bypassing Tor, that is reason there is addons whitelist. It doesn't even load any system wide extensions[7]. Tor browser have all information written inside the bundle directory. Tor even disables third party cookies and all the cache enteries are isolated from URL bar domain. Similar to canvas can be used for Fingerprinting the WebGL is also used for fingerprinting, there was recent research which even suggested that WebGL can be even used for Cross Browser Fingerprinting. The defense stratergies used by Tor browser helps us to protect from the issue of privacy. 

Operating system fingerprinting is not considered a big problem in privacy even though tor browser has reduced the entropy of finding the os to 2 bits. At least 3 HTML5 API Battery API, the Network Connection API and sensor API are disabled in the current browser because of fingerprinting. Even the mozilla services are disabled in Tor to make non of the mozilla services are contacted. Some of the feature in javascript functions like readers view and connection state has been disabled. 


% needed in second column of first page if using \IEEEpubid
%\IEEEpubidadjcol

% An example of a floating figure using the graphicx package.
% Note that \label must occur AFTER (or within) \caption.
% For figures, \caption should occur after the \includegraphics.
% Note that IEEEtran v1.7 and later has special internal code that
% is designed to preserve the operation of \label within \caption
% even when the captionsoff option is in effect. However, because
% of issues like this, it may be the safest practice to put all your
% \label just after \caption rather than within \caption{}.
%
% Reminder: the "draftcls" or "draftclsnofoot", not "draft", class
% option should be used if it is desired that the figures are to be
% displayed while in draft mode.
%
%\begin{figure}[!t]
%\centering
%\includegraphics[width=2.5in]{myfigure}
% where an .eps filename suffix will be assumed under latex, 
% and a .pdf suffix will be assumed for pdflatex; or what has been declared
% via \DeclareGraphicsExtensions.
%\caption{Simulation Results}
%\label{fig_sim}
%\end{figure}

% Note that IEEE typically puts floats only at the top, even when this
% results in a large percentage of a column being occupied by floats.


% An example of a double column floating figure using two subfigures.
% (The subfig.sty package must be loaded for this to work.)
% The subfigure \label commands are set within each subfloat command, the
% \label for the overall figure must come after \caption.
% \hfil must be used as a separator to get equal spacing.
% The subfigure.sty package works much the same way, except \subfigure is
% used instead of \subfloat.
%
%\begin{figure*}[!t]
%\centerline{\subfloat[Case I]\includegraphics[width=2.5in]{subfigcase1}%
%\label{fig_first_case}}
%\hfil
%\subfloat[Case II]{\includegraphics[width=2.5in]{subfigcase2}%
%\label{fig_second_case}}}
%\caption{Simulation results}
%\label{fig_sim}
%\end{figure*}
%
% Note that often IEEE papers with subfigures do not employ subfigure
% captions (using the optional argument to \subfloat), but instead will
% reference/describe all of them (a), (b), etc., within the main caption.


% An example of a floating table. Note that, for IEEE style tables, the 
% \caption command should come BEFORE the table. Table text will default to
% \footnotesize as IEEE normally uses this smaller font for tables.
% The \label must come after \caption as always.
%
%\begin{table}[!t]
%% increase table row spacing, adjust to taste
%\renewcommand{\arraystretch}{1.3}
% if using array.sty, it might be a good idea to tweak the value of
% \extrarowheight as needed to properly center the text within the cells
%\caption{An Example of a Table}
%\label{table_example}
%\centering
%% Some packages, such as MDW tools, offer better commands for making tables
%% than the plain LaTeX2e tabular which is used here.
%\begin{tabular}{|c||c|}
%\hline
%One & Two\\
%\hline
%Three & Four\\
%\hline
%\end{tabular}
%\end{table}


% Note that IEEE does not put floats in the very first column - or typically
% anywhere on the first page for that matter. Also, in-text middle ("here")
% positioning is not used. Most IEEE journals use top floats exclusively.
% Note that, LaTeX2e, unlike IEEE journals, places footnotes above bottom
% floats. This can be corrected via the \fnbelowfloat command of the
% stfloats package.

\section*{Related Work}
One of the recent paper from KU Leuven university[5] talks about some attacks in Tor browser which can deanonymize the user in Tor browser which can find out the IP address of the user. One of the attack mentioned by them was Cross Session Events in which if an devicechange event happen it would fire in all browsing context even in incognito mode, which can help in identifying and is an privacy issue. As a consequence of this the specification was altered to only fire the event on tabs that were either previously given permission to access media devices, or that are active. Otherwise this can even result in Cross browser fingerprinting. Similarly online/offline, languagechange, devicemotion, Battery had also some privacy issues of Cross Session Events. But some of these issues such as online/offline changes is already given protection in Tor browser. Some side channel issues such as the convert channel issue are also discussed in the research. Some of the website such as browser leaks which can be used for understanding the known techniques of fingerprinting in different browsers.

\section*{Previous findings}
We were looking to into bugtraq of Tor browser we were able to find different ways of fingerprinting Tor browser. Some of the Javascript API which were responsible for fingerprinting were removed from the Tor browser but inspite of that there are some API which is needed for the proper functioning of website. For example Math in Javascript, which is an important function in the case of web which will be used by many developers. With the help of Math one can do OS fingerprinting. If the value of Math.tan(-1e300) is -1.4214488238747245 then the os it is Linux machine and if the value is then -4.987183803371025 then it is Windows machine.

Some of the low hanging fingerprinting targets would be the User-agent, Accept-* headers, pipeline usage, request orderings and what are the custom filters which are being used for privacy protection. Javascript Date object reveals OS type can be used for OS Fingerprinting, the result or the date format returned is different for different OS. 

JavaScript API can be used get the size of the screen and window even though some efforts are been made by Tor browser to give protection. Till now correct patch regarding the screen width is not available. Canvas fingerprinting have certain defense in the case of Tor browser but actually in spite of forcefully stopping it, it asks the user as a prompt whether they wanted to block the canvas fingerprinting or not. 

Font fingerprinting can be even done in the current version of Tor browser but they have reduced the fingerprinting effect by reducing the number of fonts being used in the system.
CSS media queries can be used by the third party trackers for getting more information about the desktop size, widget size, display type, DPI, user agent type about the user which was formerly more available to JavaScript.

Website traffic fingerprinting is an attempt to recognize the encrypted traffic patterns of specific websites, this may take in place between user and guard node. There has been many researches and papers in this area providing defenses and protection for example: using random padding in CSS, Js and other files by using comments which will make attacker job of fingerprinting website very difficult. 

\begin{center}
 \begin{tabular}{|c|c|c|} 
 \hline
 Techniques & Defense(tb) & Privacy in others  \\ [0.5ex] 
 \hline\hline
 Canvas Fingerprinting & Yes & No \\ [1ex]
 \hline
 WebGL Fingerprinting & Yes & No \\ [1ex]
 \hline
 Extension detection & Yes & No \\ [1ex]
 \hline
 Font Enumeration & Partial & No  \\ [1ex]
 \hline
 OS Fingerprinting & No & No \\ [1ex]
 \hline
 Simultaneous event & No & No \\ [1ex] 
 \hline
 Convert Channel & No & No \\ [1ex] 
 \hline
\end{tabular}
\end{center}

\section{Timeline}
We will be testing all the issues which are present in the Tor bugtrac. Mostly the open issues will be given more priority. We will be testing the results in different operating system such as Linux, Windows and Mac Os. We will be also be evaluating the privacy concerns of all the JavaScript API's about the 742 API's listed in the w3c for finding the privacy issues in the Tor browser.

Next step would be using the data for making a hash which could help in identifying the user's uniquely. Already there are many known methods for OS fingerprinting and even for Tor browser version fingerprinting and tails version fingerprinting. We will be also using some of the methods which has privacy issues in Tor browser for fingerprinting.

Last part of the research is the defense, we will behave to blacklist or remove some of the JavaScript API. We will also have to choose methods of padding or some way of confusing the third parties such that more false positive arise such that extent of fingerprinting goes down.

\section{Conclusion}
Our work was intended to improve the security of Tor browsers. Tor browser is regarded as the most secure and more private browser, for improving the privacy more researches has to be done in the browser fingerprinting part. In this paper we have intended to show the issues with JavaScript based web fingerprinting in Tor browsers and its implications.

% if have a single appendix
%\appendix[Proof of the Zonklar Equations]
% or
%\appendix  % for no appendix heading
% do not use \section anymore after \appendix, only \section*
% is possibly needed

% use appendices with more than one appendix
% then use \section to start each appendix
% you must declare a \section before using any
% \subsection or using \label (\appendices by itself
% starts a section numbered zero.)
%

% Can use something like this to put references on a page
% by themselves when using endfloat and the captionsoff option.
\ifCLASSOPTIONcaptionsoff
  \newpage
\fi



% trigger a \newpage just before the given reference
% number - used to balance the columns on the last page
% adjust value as needed - may need to be readjusted if
% the document is modified later
%\IEEEtriggeratref{8}
% The "triggered" command can be changed if desired:
%\IEEEtriggercmd{\enlargethispage{-5in}}

% references section

% can use a bibliography generated by BibTeX as a .bbl file
% BibTeX documentation can be easily obtained at:
% http://www.ctan.org/tex-archive/biblio/bibtex/contrib/doc/
% The IEEEtran BibTeX style support page is at:
% http://www.michaelshell.org/tex/ieeetran/bibtex/
%\bibliographystyle{IEEEtran}
% argument is your BibTeX string definitions and bibliography database(s)
%\bibliography{IEEEabrv,../bib/paper}
%
% <OR> manually copy in the resultant .bbl file
% set second argument of \begin to the number of references
% (used to reserve space for the reference number labels box)
\begin{thebibliography}{1}

\bibitem{Pixel Perfect}
Mowery, K., Shacham, H.: Pixel perfect: Fingerprinting canvas in HTML5 In:
Fredrikson, M. (ed.) Proceedings of W2SP 2012. IEEE Computer Society (May
2012), https://cseweb.ucsd.edu/∼hovav/dist/canvas.pdf

\bibitem{Pixel Perfect}
KRISHNAMURTHY, B., AND WILLS, C. Privacy diffusion on the
web: a longitudinal perspective. In Proceedings of the 18th international
conference on World wide web (2009), ACM, pp. 541–
550

\bibitem{Design and Implementation of Tor Browser}
Design and Implementation of Tor Browser.
https://www.torproject.org/projects/torbrowser/design/

\bibitem{Sensor Fingerprinting}
BOJINOV, H., MICHALEVSKY, Y., NAKIBLY, G., AND BONEH,
D. Mobile device identification via sensor fingerprinting. arXiv
preprint arXiv:1408.1416 (2014).

\bibitem{One Side-Channel to Bring Them All and in the Darkness Bind Them:
Associating Isolated Browsing Sessions}
Tom Van Goethem, Wouter Joosen, One Side-Channel to Bring Them All and in the Darkness Bind Them:
Associating Isolated Browsing Sessions, woot17, 2017

\bibitem{Know the Tor browser and tails version}
Get the Tor browser version and tails version, https://github.com/jonaslejon/tor-fingerprint/

\bibitem{XHOUND: Quantifying the Fingerprintability of Browser
 Extensions}
Oleksii Starov and Nick Nikiforakis. XHOUND: Quantifying the Fingerprintability of Browser Extensions. In \textit{Proceedings} of ACM, 2013.
  

\end{thebibliography}



% biography section
% 
% If you have an EPS/PDF photo (graphicx package needed) extra braces are
% needed around the contents of the optional argument to biography to prevent
% the LaTeX parser from getting confused when it sees the complicated
% \includegraphics command within an optional argument. (You could create
% your own custom macro containing the \includegraphics command to make things
% simpler here.)
%\begin{biography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{mshell}}]{Michael Shell}
% or if you just want to reserve a space for a photo:

\begin{IEEEbiography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{picture}}]{John Doe}
\blindtext
\end{IEEEbiography}

% You can push biographies down or up by placing
% a \vfill before or after them. The appropriate
% use of \vfill depends on what kind of text is
% on the last page and whether or not the columns
% are being equalized.

%\vfill

% Can be used to pull up biographies so that the bottom of the last one
% is flush with the other column.
%\enlargethispage{-5in}




% that's all folks
\end{document}