4 ms·

Surely user agents could give out way less information (virtually none in fact?).

Fnoord 7y ago
Yes, but it will break functionality because servers use it to apply hacks on the website before the content is served. WebRTC is another one which you can disable. JavaScript, in general, as well, requiring uMatrix. Chrome leaks the extensions you use, Firefox does not (AFAIK). As for blocking canvas, see [1] To test your fingerprinting I can recommend IPleak [2] The problem of this all is, its a usability nightmare. [1] https://addons.mozilla.org/en-US/android/addon/canvasblocker/ https://addons.mozilla.org/en-US/android/addon/canvasblocker... [2] https://www.ipleak.net https://www.ipleak.net
- tinus_hn 7y ago
  They’ll manage. Just standardize to a fixed value.
- 1024core 7y ago
  > Chrome leaks the extensions you use, Sure... "leak", wink wink.
Jonnax 7y ago
Yes it really should. Chrome on Android reports your phone model and build number. If you're using a lessor known phone with a carrier specific ROM, then you're in a really tiny population.
zaarn 7y ago
Not without breaking Grandma's favorite online banking website.
wongarsu 7y ago
You can't get around giving nearly the entirey of the User Agent string simply thorugh feature detection (well, except for the phone model when on mobile). Canvas and WebGL can be fixed by limiting their functionality, or at least that's what Firefox does in the aforementioned mode. Canvas could conceivably be fixed to just behave the same everywhere, but for WebGL you have to limit it to some common denominator to hide the GPU model, so privacy nessesitates less functionality. The list of plugins can be spoofed to be empty. Screen resolution (or more importantly, window size) has to be somewhat accurate because lots of websites use it for responsive design. Firefox can round the window size to the nearest multiple of 200x100 which doesn't break too many things, but that's still far from giving the same value for everyone. https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting
- zzzcpan 7y ago
  > Canvas could conceivably be fixed to just behave the same everywhere, but for WebGL you have to limit it to some common denominator to hide the GPU model You can just measure performance of those things then.
- bartimus 7y ago
  Unless two browsers are identical there's almost always a way to detect some particularity.
  - wongarsu 7y ago
    Just giving the same value for everyone on the latest version of Firefox using Windows 10 with a maximized window on a 1920p display would seriously hamper fingerprinting. It can still be enough when used with other information (IP, visited sites etc), but at least it would dilute the signal a lot.
    - bartimus 7y ago
      Section 3.2 'Advancing fingerprinting' shows some more ways you can find particularities which will be hard to hide.
  - munk-a 7y ago
    And even if the browsers are identical there are still some ways to detect different user based on client side behavior (assuming JS is enabled, or some particularly crazy CSS)
mobjack 7y ago
User agents are not that great of tracking. If you use a common device and browser kept up to date to the latest versions, then you are not going to be unique. Using Safari on an iPhone will make you similar to 30% of web traffic. Browsers also update all the time changing the user agent so it isn't that reliable tracking over extended periods of time. The am I unique websites seem to compare your user agent to a database with outdated browser versions from the past data, making your score look much scarier than it really is. If you keep things up to date, chances are that you are not that unique.

Yes, but it will break functionality because servers use it to apply hacks on the website before the content is served. WebRTC is another one which you can disable. JavaScript, in general, as well, requiring uMatrix. Chrome leaks the extensions you use, Firefox does not (AFAIK). As for blocking canvas, see [1] To test your fingerprinting I can recommend IPleak [2] The problem of this all is, its a usability nightmare. [1] https://addons.mozilla.org/en-US/android/addon/canvasblocker/ https://addons.mozilla.org/en-US/android/addon/canvasblocker... [2] https://www.ipleak.net https://www.ipleak.net

tinus_hn 7y ago
They’ll manage. Just standardize to a fixed value.
1024core 7y ago
> Chrome leaks the extensions you use, Sure... "leak", wink wink.

Jonnax 7y ago

Yes it really should. Chrome on Android reports your phone model and build number. If you're using a lessor known phone with a carrier specific ROM, then you're in a really tiny population.

zaarn 7y ago

Not without breaking Grandma's favorite online banking website.

wongarsu 7y ago

You can't get around giving nearly the entirey of the User Agent string simply thorugh feature detection (well, except for the phone model when on mobile). Canvas and WebGL can be fixed by limiting their functionality, or at least that's what Firefox does in the aforementioned mode. Canvas could conceivably be fixed to just behave the same everywhere, but for WebGL you have to limit it to some common denominator to hide the GPU model, so privacy nessesitates less functionality. The list of plugins can be spoofed to be empty. Screen resolution (or more importantly, window size) has to be somewhat accurate because lots of websites use it for responsive design. Firefox can round the window size to the nearest multiple of 200x100 which doesn't break too many things, but that's still far from giving the same value for everyone. https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting

zzzcpan 7y ago
> Canvas could conceivably be fixed to just behave the same everywhere, but for WebGL you have to limit it to some common denominator to hide the GPU model You can just measure performance of those things then.
bartimus 7y ago
Unless two browsers are identical there's almost always a way to detect some particularity.
- wongarsu 7y ago
  Just giving the same value for everyone on the latest version of Firefox using Windows 10 with a maximized window on a 1920p display would seriously hamper fingerprinting. It can still be enough when used with other information (IP, visited sites etc), but at least it would dilute the signal a lot.
  - bartimus 7y ago
    Section 3.2 'Advancing fingerprinting' shows some more ways you can find particularities which will be hard to hide.
- munk-a 7y ago
  And even if the browsers are identical there are still some ways to detect different user based on client side behavior (assuming JS is enabled, or some particularly crazy CSS)

mobjack 7y ago

User agents are not that great of tracking. If you use a common device and browser kept up to date to the latest versions, then you are not going to be unique. Using Safari on an iPhone will make you similar to 30% of web traffic. Browsers also update all the time changing the user agent so it isn't that reliable tracking over extended periods of time. The am I unique websites seem to compare your user agent to a database with outdated browser versions from the past data, making your score look much scarier than it really is. If you keep things up to date, chances are that you are not that unique.