7 ms·

Any tips on fighting browser fingerprinting?

jacquesm 11y ago
Anonymizing proxy.
rickycook 11y ago
on the topic of chaff, I use an extension that rotates randomly between combinations of {Windows,OS X,Linux}, {Firefox,chrome} and various versions of those things. though sadly this doesn't work alone, because it only solves the stuff sent to server (but is far more pleasing to screw with them than to just send nothing). you still have to use noscript to stop things like the canvas font rendering trick :(
- listic 11y ago
  What is this extension?
  - pacbard 11y ago
    I have used user agent switcher in the past. It sounds like the extension that rickycook was referring to.
- rasz_pl 11y ago
  that still leaves over 100 bits if info on the table, resolution, fonts installed, localstorage, indexed storage, cookies etc.
- wahsd 11y ago
  Does it cycle through user-agents? I could see an extension that rotates through those contributing nicely to creating noise.
anonbanker 11y ago
get a cryptostorm (or cryptofree) account.
jmnicolas 11y ago
The only real bullet proof solution I can think of is to use Qubes (or VMPlayer / VirtualBox on a more common OS) to launch a new VM every browsing session. You loose your browser preferences and bookmarks though. You could organize your bookmarks in a local HTML file so your browser don't "broadcast" them.
- superuser2 11y ago
  Nope. If you're using Qubes you are (as far as an ad network is concerned) a young middle to upper class white male with an interest in technology and computer security who probably lives near the Bay Area or another tech hub (depending on GeoIP). That's exactly what an advertiser would be tracking you to find out, and you just put it in the user agent string. The only way to defeat browser fingerprinting is for everyone (or a lot of people including you) to use exactly the same version of the same browser on the same platform on the same device configured the same way. Even the, which browser-device-screen resolution-version cohort you are part of probably says a lot about your demographic. It's easy to hide in 2560x1440 Macs running latest Chrome under Yosemite. Not so much on Ubuntu Phone in middle America.
  - hellbanner 11y ago
    Couldn't you just use a browser that doesn't send user-agent?
    - strmpnk 11y ago
      The lack of one itself is a datapoint.
  - rdtsc 11y ago
    You use a random user agent. I use this one for example: https://github.com/dillbyrne/random-agent-spoofer https://github.com/dillbyrne/random-agent-spoofer
    - hundchenkatze 11y ago
mcarrano 11y ago
Haven't used it myself but you may want to check out - https://github.com/ghostwords/chameleon https://github.com/ghostwords/chameleon

Anonymizing proxy.

on the topic of chaff, I use an extension that rotates randomly between combinations of {Windows,OS X,Linux}, {Firefox,chrome} and various versions of those things. though sadly this doesn't work alone, because it only solves the stuff sent to server (but is far more pleasing to screw with them than to just send nothing). you still have to use noscript to stop things like the canvas font rendering trick :(

listic 11y ago
What is this extension?
- pacbard 11y ago
  I have used user agent switcher in the past. It sounds like the extension that rickycook was referring to.
rasz_pl 11y ago
that still leaves over 100 bits if info on the table, resolution, fonts installed, localstorage, indexed storage, cookies etc.
wahsd 11y ago
Does it cycle through user-agents? I could see an extension that rotates through those contributing nicely to creating noise.

anonbanker 11y ago

get a cryptostorm (or cryptofree) account.

jmnicolas 11y ago

The only real bullet proof solution I can think of is to use Qubes (or VMPlayer / VirtualBox on a more common OS) to launch a new VM every browsing session. You loose your browser preferences and bookmarks though. You could organize your bookmarks in a local HTML file so your browser don't "broadcast" them.

superuser2 11y ago
Nope. If you're using Qubes you are (as far as an ad network is concerned) a young middle to upper class white male with an interest in technology and computer security who probably lives near the Bay Area or another tech hub (depending on GeoIP). That's exactly what an advertiser would be tracking you to find out, and you just put it in the user agent string. The only way to defeat browser fingerprinting is for everyone (or a lot of people including you) to use exactly the same version of the same browser on the same platform on the same device configured the same way. Even the, which browser-device-screen resolution-version cohort you are part of probably says a lot about your demographic. It's easy to hide in 2560x1440 Macs running latest Chrome under Yosemite. Not so much on Ubuntu Phone in middle America.
- hellbanner 11y ago
  Couldn't you just use a browser that doesn't send user-agent?
  - strmpnk 11y ago
    The lack of one itself is a datapoint.
- rdtsc 11y ago
  You use a random user agent. I use this one for example: https://github.com/dillbyrne/random-agent-spoofer https://github.com/dillbyrne/random-agent-spoofer
  - hundchenkatze 11y ago

mcarrano 11y ago

Haven't used it myself but you may want to check out - https://github.com/ghostwords/chameleon https://github.com/ghostwords/chameleon