3 ms·

Is there any tool that tries to prevent fingerprinting by unifying browsers' behavior into one single promoted "common" one? Well, completely preventing is prob

Is there any tool that tries to prevent fingerprinting by unifying browsers' behavior into one single promoted "common" one? Well, completely preventing is probably impossible, but at least lower the number of unique properties. E.g. a software-only... err... shim (or how should I call it?) for canvas and audio APIs, and only allow fast native one to a trusted whitelisted parties. And an uniform list of fonts and plugins, despite of what's actually installed. Of course, I know about NoScript. It can't be mass-used as a "just install this and you're good" strategy, thus doesn't help much - the fingerprints would still remain quite unique. Yet, if something is less obtrusive - just slow at times (and then it asks "hey, this site does something fancy with canvas, maybe allow it to speed up at the cost of your privacy?") may work.

aw3c2 10y ago
Tor Browser does a lot of that.
tunap 10y ago
Blender, firefox plug-in, sends generic user-agent characteristics to mitigate some fingerprinting techniques. "Blend into the crowd": https://addons.mozilla.org/en-US/firefox/addon/blender-1/ https://addons.mozilla.org/en-US/firefox/addon/blender-1/
- ljk 10y ago
  one of the reviews Out of date 2/5 stars Language spoofing no longer works (assuming it ever worked). Chosen user-agent, etc is pretty out of date. Should choose the same ones as the Tor Browser Bundle or something how accurate is this? is this extension still worth it?
  - tunap 10y ago
    Perhaps, somewhat...? It does claim to additionally spoof fonts, OS and browser metrics. It has not been updated since April and that came after a long maintenance drought preceding it. In the past it did well on the various browser fingerprint detection sites. Today, I am unique with the only difference between Blender enabled and disabled on Panopticlick[1] is the OS & Browser are indeed spoofed in the results and too many fonts to audit... w/ AB+ disabled, NS disabled(all/globally). [1] https://panopticlick.eff.org/ https://panopticlick.eff.org/
niftich 10y ago
Actually, most of the newer techniques depend on server-provided code executed in the client, and those results posted back to the server. Therefore, disabling Javascript and plugins prevents most of them, as it prevents automatic postback, but also the access to APIs that allows that information be collected in the first place. There are ones that'll keep working without Javascript or plugins, like anything coming across in HTTP headers (user-agent, accept, Etag) or on the lower layers (IP address, ciphersuites). Chromium maintains a good Wiki of tracking techniques and possible mitigations [1], Firefox also [2]. Predictably, ones in the lower layers are more difficult and/or impossible to mitigate from a browser; the ones relating to the precise use of HTTP can be mitigated at the cost of breaking automatic HTTP content-negotiation (including mimetypes and language), and caching/state-control semantics. [1] http://www.chromium.org/Home/chromium-security/client-identification-mechanisms http://www.chromium.org/Home/chromium-security/client-identi... [2] https://wiki.mozilla.org/Fingerprinting https://wiki.mozilla.org/Fingerprinting
godshatter 10y ago
Why not a browser that turns off all that crap? Don't send a list of fonts, if I don't have the one you try to use, it should default back to one of the standard ones. Don't report anything about canvas setup, audio, etc. Let them translate silence.

aw3c2 10y ago

Tor Browser does a lot of that.

tunap 10y ago

Blender, firefox plug-in, sends generic user-agent characteristics to mitigate some fingerprinting techniques. "Blend into the crowd": https://addons.mozilla.org/en-US/firefox/addon/blender-1/ https://addons.mozilla.org/en-US/firefox/addon/blender-1/

ljk 10y ago
one of the reviews Out of date 2/5 stars Language spoofing no longer works (assuming it ever worked). Chosen user-agent, etc is pretty out of date. Should choose the same ones as the Tor Browser Bundle or something how accurate is this? is this extension still worth it?
- tunap 10y ago
  Perhaps, somewhat...? It does claim to additionally spoof fonts, OS and browser metrics. It has not been updated since April and that came after a long maintenance drought preceding it. In the past it did well on the various browser fingerprint detection sites. Today, I am unique with the only difference between Blender enabled and disabled on Panopticlick[1] is the OS & Browser are indeed spoofed in the results and too many fonts to audit... w/ AB+ disabled, NS disabled(all/globally). [1] https://panopticlick.eff.org/ https://panopticlick.eff.org/

niftich 10y ago

Actually, most of the newer techniques depend on server-provided code executed in the client, and those results posted back to the server. Therefore, disabling Javascript and plugins prevents most of them, as it prevents automatic postback, but also the access to APIs that allows that information be collected in the first place. There are ones that'll keep working without Javascript or plugins, like anything coming across in HTTP headers (user-agent, accept, Etag) or on the lower layers (IP address, ciphersuites). Chromium maintains a good Wiki of tracking techniques and possible mitigations [1], Firefox also [2]. Predictably, ones in the lower layers are more difficult and/or impossible to mitigate from a browser; the ones relating to the precise use of HTTP can be mitigated at the cost of breaking automatic HTTP content-negotiation (including mimetypes and language), and caching/state-control semantics. [1] http://www.chromium.org/Home/chromium-security/client-identification-mechanisms http://www.chromium.org/Home/chromium-security/client-identi... [2] https://wiki.mozilla.org/Fingerprinting https://wiki.mozilla.org/Fingerprinting

godshatter 10y ago

Why not a browser that turns off all that crap? Don't send a list of fonts, if I don't have the one you try to use, it should default back to one of the standard ones. Don't report anything about canvas setup, audio, etc. Let them translate silence.