This is little more than an opinion piece. AFAICT, the only "vulnerability" is that with JS on, it can detect the Operating System. At some point it claims it

This is little more than an opinion piece. AFAICT, the only "vulnerability" is that with JS on, it can detect the Operating System. At some point it claims it can also detect screen size > However, there are not too many people using the same OS and same screen size and visiting the same sites at around the same time. You will likely stand out. but both my tests and themselves contradict that: > On a normal desktop browser, the Window Size is smaller than the Screen Size. (Mobile devices may show a Windows Size that is larger than the Screen Size.) To prevent screen profiling, the TOR-Browser sets them to be the same size. Note that detecting Tor Browser is doable from the User-Agent, so there's no point in setting Window Size = Screen Size. Definitely not "exploiting", and I suspect that's why it couldn't get a reply from security MLs, which see a lot of these. Flagged.