4 ms·

Is there any solid guide to preventing browser fingerprinting? Or is the only protection constantly changing your accept headers + user agent?

by relkor 11y ago

legind 11y ago
"For day-to-day use, the best options are to run tools like Privacy Badger or Disconnect that will block some (but unfortunately not all) of the domains that try to perform fingerprinting, and/or to use a tool like NoScript for Firefox, which greatly reduces the amount of data available to fingerprinters." https://panopticlick.eff.org/about#defend-against https://panopticlick.eff.org/about#defend-against
- rocky1138 11y ago
  Will blocking them at the HOSTS file level decrease exposure as well? My gut says yes, but I wanted to check. Also, does this test check for that and/or give points for that? Here is the HOSTS file I use to block ads: http://winhelp2002.mvps.org/hosts.txt http://winhelp2002.mvps.org/hosts.txt
  - XzetaU8 11y ago
    If you're on Linux i recommend 'Hosts-Update'[1], it's a bash script that generates a Host file from multiple sources: http://adaway.org/hosts.txt http://adaway.org/hosts.txt http://hosts-file.net/ad_servers.txt http://hosts-file.net/ad_servers.txt http://malwaredomains.lehigh.edu/files/justdomains http://malwaredomains.lehigh.edu/files/justdomains http://pgl.yoyo.org/adservers http://pgl.yoyo.org/adservers http://someonewhocares.org/hosts/hosts http://someonewhocares.org/hosts/hosts http://winhelp2002.mvps.org/hosts.txt http://winhelp2002.mvps.org/hosts.txt http://www.malwaredomainlist.com/hostslist/hosts.txt http://www.malwaredomainlist.com/hostslist/hosts.txt [1]: https://github.com/zant95/hosts-update https://github.com/zant95/hosts-update
  - legind 11y ago
    Yes, our test does work for that and various hosts-based blockers are supported (like AdAway for Android, for example). In order for our test to give accurate results, the host-based blocker has to add our simulated trackers to its block list, which some lists may not have done yet.
cpeterso 11y ago
Mozilla has documented some of the ways trackers can fingerprint users (in 2010): https://wiki.mozilla.org/Fingerprinting https://wiki.mozilla.org/Fingerprinting The Tor project submitted some of their fingerprinting protection patches to Firefox. They can be enabled by setting the "privacy.resistFingerprinting" about:config pref. https://bugzil.la/418986 https://bugzil.la/418986 - Bug 418986 - Resist fingerprinting by preventing exposure of screen and system info And the W3C has shared some information about the obligations of W3C specification authors and working groups of new Web platform features: http://www.w3.org/wiki/images/7/7d/Is_preventing_browser_fingerprinting_a_lost_cause.pdf http://www.w3.org/wiki/images/7/7d/Is_preventing_browser_fin...

Is there any solid guide to preventing browser fingerprinting? Or is the only protection constantly changing your accept headers + user agent?

by relkor 11y ago

Is there any solid guide to preventing browser fingerprinting? Or is the only protection constantly changing your accept headers + user agent?

legind 11y ago

"For day-to-day use, the best options are to run tools like Privacy Badger or Disconnect that will block some (but unfortunately not all) of the domains that try to perform fingerprinting, and/or to use a tool like NoScript for Firefox, which greatly reduces the amount of data available to fingerprinters." https://panopticlick.eff.org/about#defend-against https://panopticlick.eff.org/about#defend-against

rocky1138 11y ago
Will blocking them at the HOSTS file level decrease exposure as well? My gut says yes, but I wanted to check. Also, does this test check for that and/or give points for that? Here is the HOSTS file I use to block ads: http://winhelp2002.mvps.org/hosts.txt http://winhelp2002.mvps.org/hosts.txt
- XzetaU8 11y ago
  If you're on Linux i recommend 'Hosts-Update'[1], it's a bash script that generates a Host file from multiple sources: http://adaway.org/hosts.txt http://adaway.org/hosts.txt http://hosts-file.net/ad_servers.txt http://hosts-file.net/ad_servers.txt http://malwaredomains.lehigh.edu/files/justdomains http://malwaredomains.lehigh.edu/files/justdomains http://pgl.yoyo.org/adservers http://pgl.yoyo.org/adservers http://someonewhocares.org/hosts/hosts http://someonewhocares.org/hosts/hosts http://winhelp2002.mvps.org/hosts.txt http://winhelp2002.mvps.org/hosts.txt http://www.malwaredomainlist.com/hostslist/hosts.txt http://www.malwaredomainlist.com/hostslist/hosts.txt [1]: https://github.com/zant95/hosts-update https://github.com/zant95/hosts-update
- legind 11y ago
  Yes, our test does work for that and various hosts-based blockers are supported (like AdAway for Android, for example). In order for our test to give accurate results, the host-based blocker has to add our simulated trackers to its block list, which some lists may not have done yet.

cpeterso 11y ago

Mozilla has documented some of the ways trackers can fingerprint users (in 2010): https://wiki.mozilla.org/Fingerprinting https://wiki.mozilla.org/Fingerprinting The Tor project submitted some of their fingerprinting protection patches to Firefox. They can be enabled by setting the "privacy.resistFingerprinting" about:config pref. https://bugzil.la/418986 https://bugzil.la/418986 - Bug 418986 - Resist fingerprinting by preventing exposure of screen and system info And the W3C has shared some information about the obligations of W3C specification authors and working groups of new Web platform features: http://www.w3.org/wiki/images/7/7d/Is_preventing_browser_fingerprinting_a_lost_cause.pdf http://www.w3.org/wiki/images/7/7d/Is_preventing_browser_fin...