11 ms·

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org https://panopticlick.eff.org with the latest Fire

Can someone paste their results (or at least bits of fingerprinting entropy) from https://panopticlick.eff.org https://panopticlick.eff.org with the latest Firefox? With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). With Safari on iOS I get 11.71 bits of entropy, with the most entropic value being my screen size and color depth.

numakerg 7y ago
Panopticlick says I have "strong protection against Web tracking" but amiunique.org says I'm unique. Though amiunique also claims my TOR is fingerprint is one of six.
- godelski 7y ago
  I get very different results from each. Some don't quite make sense to me. For example, amiunique says Timezone 3.37%. Panopticlick says 1 in 16, so half as bad. But how the hell is that timezone so identifying? I live on the west coast, how is that timezone so identifying?
gruez 7y ago
>With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). That's actually pretty good, considering tor browser (which has resistfingerprinting enabled) with default window size (1000x1000) has 14.82 bits of entropy.
mlok 7y ago
I have 3 more bits of identifying information than you. (block fingerprinting enabled)
Twirrim 7y ago
Interestingly enough, uBlock Origin actually stops that site from working, seems to break the fingerprinting step. If i disable uBlock, I get 16.63 bits of identifying information. Likewise the canvas fingerprint is the biggest, in my case 1 in 101154.
- Wowfunhappy 7y ago
  Can anyone explain why canvas fingerprinting is so difficult to eradicate without breaking canvas?
  - ggreer 7y ago
    You can draw with different fonts and background colors, then grab the raw pixel values and hash them. The hash will be different depending on the versions of fonts installed, the OS, the GPU, the browser's text rendering algorithms, and the subpixel order/orientation of the display. See https://en.wikipedia.org/wiki/Canvas_fingerprinting https://en.wikipedia.org/wiki/Canvas_fingerprinting for more info.
    - Wowfunhappy 7y ago
      Thanks. I'd read the Wikipedia page, I'm just not clear why this process is allowed (or more importantly, why it can't be removed). Is there a legitimate use case for being able to read back pixels?
      - PaulBGD_ 7y ago
        A lot actually, for example you can do easy image resizing (like taking a selected image and resizing before uploading to the server.)
      - laughinghan 7y ago
        Literally any kind of image or photo manipulation, from an MS Paint-like webapp to Instagram-like photo filters.
        deleted 7y ago
        [deleted]
      - kevingadd 7y ago
        There are many legitimate uses. Vendors have experimented with making canvas readback opt-in (with a popup) but I don't know if it'll ever ship because it simply breaks too many websites. Sometimes it's used at page load to generate variants of a single image to reduce file sizes, or used by games to prepare image assets before they start up.
user17843 7y ago
Firefox Fingerprinting protection has nothing to do with real fingerprinting protection, and does not afffect panopticlick results in any way. It just bloocks a couple of known scripts based on the disconnect list. Of course they don't tell us in their marketing posts.
- danShumway 7y ago
  Firefox deploys two different forms of fingerprint protection: 1) blocking known fingerprinting scripts. 2) blocking underlying techniques. The second is the one people here are talking about, and it can be enabled by going to your settings and turning on resistFingerprinting. Keep in mind it will do things like normalize your time zone and decrease timer precision.
  - user17843 7y ago
    Nope. The linked mozilla blog post clearly talks about the fingerprinting settings, and the comment I replied to did not specify anything related to "blocking underlying techniques".
    - danShumway 7y ago
      This entire thread is filled with people comparing browser results on a site that breaks down underlying fingerprint techniques, while asking questions like, "is there a way for me to disable WebGL?", and "I wonder if they block localhost port scanning?". I understand what the original posted link is talking about, but the specific thread you're currently on is very clearly talking about more than whether or not Panoptoclick's tracking script is blocked. They're talking about how well different browsers can resist the techniques it uses[0]. Why else would anyone be comparing their results to Tor? [0]: https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting
      - jrochkind1 7y ago
        If the thing in the OP doesn't do what a bunch of the comments here are discussing -- it is indeed important to point that out. I had assumed it did, cause why else would we be discussing it here, and neither the OP post nor the FF setting are very clear about what it does. So I would have been thinking it was protecting me.
abdullahkhalids 7y ago
17.62 bits on firefox, 11.0 on Tor, 17.63 on chrome. On firefox, the big contributors are HTTP headers (my native language is announced), hash of WebGl fingerprint and time zone. On Tor big contributors are hash of webGL fingerprint, screen size. On chrome, they are system fonts, hash of canvas fingerprint, user agent, and time zone. I am not too concerned about the fingerprinting in firefox since I have strict blocking on, ublock origin, and separate containers for facebook and google. Based on the small amount of data facebook has on me, all the blocking is working pretty well.
- herrvogel- 7y ago
  > Based on the small amount of data facebook has on me ... How did you get all data, that facebook has on you?
  - abdullahkhalids 7y ago
    Settings -> In list of links on the right, Your Facebook Information -> Access Your Information -> At the bottom, Information About You -> Ads
- Perceptes 7y ago
  Similar results for me. Does anyone know if it's possible to turn off WebGL, and if so, how? AFAIK I never use it for anything and I'd rather have increased anonymity. (Assuming disabling it prevents it from being used for fingerprinting.) Edit: Answering my own question. In `about:config`, change the `webgl.disabled` preference from `false` to `true`. This reduced the "bits of identifying information" from WebGL from 11.26 to 2.56. Edit 2: Apparently the CanvasBlocker add-on is a better solution as it randomizes the data used for fingerprinting on each read, and works for several exploitable APIs, not just WebGL. https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/ https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
  - deleted 7y ago
    [deleted]
  - 7y ago
clairity 7y ago
mine is ~17. language, platform, screen size, time zone, user agent, and plugin info are the most identifying. anyone know of a list of the most used values for these so we could lower our uniqueness by setting our browser values to them?
- incompatible 7y ago
  Likewise. It makes no difference whether I enable or disable the Fingerprinters checkbox. Maybe due to the "uBlock Origin stops it from working" mentioned elsewhere, or some other glitch. Disabling uBlock Origin on panopticlick.eff.org didn't make a difference.
samirm 7y ago
> 9.93 bits of identifying information. with this new setting turned on + uBlock Origin + NoScript
- messe 7y ago
  If you haven't already, change your user agent to get it down further.
  - dmos62 7y ago
    Following this advice, I discovered an extension that automatically spoofs the user agent and does some other things. Haven't tested yet, but it seems to be actively maintained. Since I'm on the topic, other two lesser known extension I have are CanvasBlocker (fakes canvas fingerprinting (or disables it)) and Privacy Badger (heuristically detects and disables trackers; complements ublock).
  - kevin_thibedeau 7y ago
    You have to stick with known popular user agents. To mitigate tracking by UA you need a randomized user agent that changes periodically. Panopticlick won't be able to account for that in its stats. It's not a good idea to switch UA on every request since it will be hard to diagnose breakage caused by a site that rejects particular UAs.
    - qiqitori 7y ago
      I dunno... "Periodically changing user agent" sounds pretty unique if you ask me. Especially if the extension isn't super-clever and changes the user agent for accesses that happen on the same page. And the fingerprinter could be super clever and look for features that your purported browser isn't supposed to support... And if your browser does support them, that's a strong identifier.
    - mobjack 7y ago
      Unless you use some obscure browser, it is better to use your real user agent. If you keep your browser and operating system up to date, chances are it will be one of the most popular ones. Your UA will correlate with other means of fingerprinting you making you more common. Being clever can make things worse. For example, the most common UA is from an iPhone, but the most common screen width is 1920 pixel. If you decide to make your UA an iPhone with a 1920 pixel screen, then you will be easily identified.
wybiral 7y ago
I wonder if these fingerprint checks look for the more stealthy and sinister approaches, like localhost port scanning [1] and specific CSS selector behavior...? [1] https://twitter.com/davywtf/status/1132026581038190592 https://twitter.com/davywtf/status/1132026581038190592
- qiqitori 7y ago
  There's so much fingerprinting that can't really be disabled. Think about it: Performance - Single-threaded CPU performance - Multi-threaded CPU performance - WebGL performance - Video performance - Network performance (how long does it take to transfer data to various locations, what's the lag, is the lag consistent, etc.) - (Maybe) Time it takes to execute certain JavaScript functions User behavior - How does the user use their mouse when navigating web pages? - Not at all? - Jerky movements? - Smooth movements? - If the user uses the keyboard, do they appear to be advanced keyboard users, do they have an IME, etc. - Does the user press X buttons on tiny annoying popups that wouldn't interfere with the page's browsing experience? - Does the user appear to block access to certain resources? (ad blocker) - Does the user's workplace/country/etc. appear to block anything?
  - pstch 7y ago
    True, in the current situation, we can only "limit" fingerprinting. This is the result of the characteristics of the sandbox we use for the Web. Remove Javascript, and most of these problems go away. This is why I stay attached to making simple HTTP apps that don't require JS, but this is clearly not the direction the web is going at this time.
ouid 7y ago
I think it's funny that panopticlick gives me a little red X for not allowing trackers from companies that have "promised" not to track me. I have no incentive to do so, as I do not get any sort of compensation if they are found to be in violation of those terms.
- rjf72 7y ago
  Just sticking this comment here since I think most people would like to see how the site works. People are interpreting the numbers incorrectly, as I also did at first even though it says at the top exactly how they're measuring these numbers. Your entropy is determined exclusively based upon the people that have used the site in the past 45 days. For now that number is about 204k. So for instance if you see something has an etropy of 9.08 (as my user agent does) you'd also see that it says 1 in 542.15 browsers have this value. 2^9.08 ~= 542.15. The ~ there only because the thousandths and onward digits are not showing. My exact entropy would be about 9.08254825596. All that means is that of the ~204k people that have used the site in the past 45 days, 377 had the same user agent. The problem with this is that the people using this site are going to be a heavily biased sample. And so by tuning to reduce your entropy, you are not actually reducing your trackability but instead making yourself look more like the subset of people that are actively using this site. And this becomes an even bigger problem since I do imagine this site is actively shared on more technically orientated sites, such as this one. But the settings of technically orientated users are often going to vary somewhat significantly from the settings of the other 99% of users. The point of this is that by working to reduce your entropy on this site you may, ironically, end up making yourself more trackable. So the numbers should be taken not as a measurement of trackability, but rather as an interesting insight of your browser/setting differences/similarities of other users with the site. --- Also, 100% agreed on the silliness of them marking you down for not allowing cookies marked Do Not Track friendly. Until such things are enforced, in code and ubiquitously, they're meaningless unenforceable promises that rely on tracking and advertising corporations never lying.
groovecoder 7y ago
Please note: the fingerprinting protection in this blog post is different from the resistFingerprinting about:config pref which would affect your entropy bits on panopticlick.
everdrive 7y ago
"Currently, we estimate that your browser has a fingerprint that conveys at least 17.66 bits of identifying information." However, some of the information sent by my (stock browser) is clearly false: User Agent: Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0 Platform: Linux x86_64 I didn't mess with my user agent, so I assume this is related "resistfingerprinting" in about:config.
vbezhenar 7y ago
Firefox with uBlock Origin and JavaScript disabled: 9.81 bits, one in 900.21 browsers. Google Chrome with uBlock Origin: at least 17.68 bits, unique among the 209,744. iPhone 8, Safari, some adblocker: the same (unique). Probably I should update OS, I'm using pretty old version.

numakerg 7y ago

Panopticlick says I have "strong protection against Web tracking" but amiunique.org says I'm unique. Though amiunique also claims my TOR is fingerprint is one of six.

godelski 7y ago
I get very different results from each. Some don't quite make sense to me. For example, amiunique says Timezone 3.37%. Panopticlick says 1 in 16, so half as bad. But how the hell is that timezone so identifying? I live on the west coast, how is that timezone so identifying?

gruez 7y ago

>With the fancy new anti-fingerprinting Safari on macOS Mojave I get just over 14.5 bits of entropy with the most entropic source being my canvas fingerprint (1 in 600). That's actually pretty good, considering tor browser (which has resistfingerprinting enabled) with default window size (1000x1000) has 14.82 bits of entropy.

mlok 7y ago

I have 3 more bits of identifying information than you. (block fingerprinting enabled)

Twirrim 7y ago

Interestingly enough, uBlock Origin actually stops that site from working, seems to break the fingerprinting step. If i disable uBlock, I get 16.63 bits of identifying information. Likewise the canvas fingerprint is the biggest, in my case 1 in 101154.

Wowfunhappy 7y ago
Can anyone explain why canvas fingerprinting is so difficult to eradicate without breaking canvas?
- ggreer 7y ago
  You can draw with different fonts and background colors, then grab the raw pixel values and hash them. The hash will be different depending on the versions of fonts installed, the OS, the GPU, the browser's text rendering algorithms, and the subpixel order/orientation of the display. See https://en.wikipedia.org/wiki/Canvas_fingerprinting https://en.wikipedia.org/wiki/Canvas_fingerprinting for more info.
  - Wowfunhappy 7y ago
    Thanks. I'd read the Wikipedia page, I'm just not clear why this process is allowed (or more importantly, why it can't be removed). Is there a legitimate use case for being able to read back pixels?
    - PaulBGD_ 7y ago
      A lot actually, for example you can do easy image resizing (like taking a selected image and resizing before uploading to the server.)
    - laughinghan 7y ago
      Literally any kind of image or photo manipulation, from an MS Paint-like webapp to Instagram-like photo filters.
      - deleted 7y ago
        [deleted]
    - kevingadd 7y ago
      There are many legitimate uses. Vendors have experimented with making canvas readback opt-in (with a popup) but I don't know if it'll ever ship because it simply breaks too many websites. Sometimes it's used at page load to generate variants of a single image to reduce file sizes, or used by games to prepare image assets before they start up.

user17843 7y ago

Firefox Fingerprinting protection has nothing to do with real fingerprinting protection, and does not afffect panopticlick results in any way. It just bloocks a couple of known scripts based on the disconnect list. Of course they don't tell us in their marketing posts.

danShumway 7y ago
Firefox deploys two different forms of fingerprint protection: 1) blocking known fingerprinting scripts. 2) blocking underlying techniques. The second is the one people here are talking about, and it can be enabled by going to your settings and turning on resistFingerprinting. Keep in mind it will do things like normalize your time zone and decrease timer precision.
- user17843 7y ago
  Nope. The linked mozilla blog post clearly talks about the fingerprinting settings, and the comment I replied to did not specify anything related to "blocking underlying techniques".
  - danShumway 7y ago
    This entire thread is filled with people comparing browser results on a site that breaks down underlying fingerprint techniques, while asking questions like, "is there a way for me to disable WebGL?", and "I wonder if they block localhost port scanning?". I understand what the original posted link is talking about, but the specific thread you're currently on is very clearly talking about more than whether or not Panoptoclick's tracking script is blocked. They're talking about how well different browsers can resist the techniques it uses[0]. Why else would anyone be comparing their results to Tor? [0]: https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting
    - jrochkind1 7y ago
      If the thing in the OP doesn't do what a bunch of the comments here are discussing -- it is indeed important to point that out. I had assumed it did, cause why else would we be discussing it here, and neither the OP post nor the FF setting are very clear about what it does. So I would have been thinking it was protecting me.

abdullahkhalids 7y ago

17.62 bits on firefox, 11.0 on Tor, 17.63 on chrome. On firefox, the big contributors are HTTP headers (my native language is announced), hash of WebGl fingerprint and time zone. On Tor big contributors are hash of webGL fingerprint, screen size. On chrome, they are system fonts, hash of canvas fingerprint, user agent, and time zone. I am not too concerned about the fingerprinting in firefox since I have strict blocking on, ublock origin, and separate containers for facebook and google. Based on the small amount of data facebook has on me, all the blocking is working pretty well.

herrvogel- 7y ago
> Based on the small amount of data facebook has on me ... How did you get all data, that facebook has on you?
- abdullahkhalids 7y ago
  Settings -> In list of links on the right, Your Facebook Information -> Access Your Information -> At the bottom, Information About You -> Ads
Perceptes 7y ago
Similar results for me. Does anyone know if it's possible to turn off WebGL, and if so, how? AFAIK I never use it for anything and I'd rather have increased anonymity. (Assuming disabling it prevents it from being used for fingerprinting.) Edit: Answering my own question. In `about:config`, change the `webgl.disabled` preference from `false` to `true`. This reduced the "bits of identifying information" from WebGL from 11.26 to 2.56. Edit 2: Apparently the CanvasBlocker add-on is a better solution as it randomizes the data used for fingerprinting on each read, and works for several exploitable APIs, not just WebGL. https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/ https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
- deleted 7y ago
  [deleted]
- 7y ago

clairity 7y ago

mine is ~17. language, platform, screen size, time zone, user agent, and plugin info are the most identifying. anyone know of a list of the most used values for these so we could lower our uniqueness by setting our browser values to them?

incompatible 7y ago
Likewise. It makes no difference whether I enable or disable the Fingerprinters checkbox. Maybe due to the "uBlock Origin stops it from working" mentioned elsewhere, or some other glitch. Disabling uBlock Origin on panopticlick.eff.org didn't make a difference.

samirm 7y ago

> 9.93 bits of identifying information. with this new setting turned on + uBlock Origin + NoScript

messe 7y ago
If you haven't already, change your user agent to get it down further.
- dmos62 7y ago
  Following this advice, I discovered an extension that automatically spoofs the user agent and does some other things. Haven't tested yet, but it seems to be actively maintained. Since I'm on the topic, other two lesser known extension I have are CanvasBlocker (fakes canvas fingerprinting (or disables it)) and Privacy Badger (heuristically detects and disables trackers; complements ublock).
- kevin_thibedeau 7y ago
  You have to stick with known popular user agents. To mitigate tracking by UA you need a randomized user agent that changes periodically. Panopticlick won't be able to account for that in its stats. It's not a good idea to switch UA on every request since it will be hard to diagnose breakage caused by a site that rejects particular UAs.
  - qiqitori 7y ago
    I dunno... "Periodically changing user agent" sounds pretty unique if you ask me. Especially if the extension isn't super-clever and changes the user agent for accesses that happen on the same page. And the fingerprinter could be super clever and look for features that your purported browser isn't supposed to support... And if your browser does support them, that's a strong identifier.
  - mobjack 7y ago
    Unless you use some obscure browser, it is better to use your real user agent. If you keep your browser and operating system up to date, chances are it will be one of the most popular ones. Your UA will correlate with other means of fingerprinting you making you more common. Being clever can make things worse. For example, the most common UA is from an iPhone, but the most common screen width is 1920 pixel. If you decide to make your UA an iPhone with a 1920 pixel screen, then you will be easily identified.

wybiral 7y ago

I wonder if these fingerprint checks look for the more stealthy and sinister approaches, like localhost port scanning [1] and specific CSS selector behavior...? [1] https://twitter.com/davywtf/status/1132026581038190592 https://twitter.com/davywtf/status/1132026581038190592

qiqitori 7y ago
There's so much fingerprinting that can't really be disabled. Think about it: Performance - Single-threaded CPU performance - Multi-threaded CPU performance - WebGL performance - Video performance - Network performance (how long does it take to transfer data to various locations, what's the lag, is the lag consistent, etc.) - (Maybe) Time it takes to execute certain JavaScript functions User behavior - How does the user use their mouse when navigating web pages? - Not at all? - Jerky movements? - Smooth movements? - If the user uses the keyboard, do they appear to be advanced keyboard users, do they have an IME, etc. - Does the user press X buttons on tiny annoying popups that wouldn't interfere with the page's browsing experience? - Does the user appear to block access to certain resources? (ad blocker) - Does the user's workplace/country/etc. appear to block anything?
- pstch 7y ago
  True, in the current situation, we can only "limit" fingerprinting. This is the result of the characteristics of the sandbox we use for the Web. Remove Javascript, and most of these problems go away. This is why I stay attached to making simple HTTP apps that don't require JS, but this is clearly not the direction the web is going at this time.

ouid 7y ago

I think it's funny that panopticlick gives me a little red X for not allowing trackers from companies that have "promised" not to track me. I have no incentive to do so, as I do not get any sort of compensation if they are found to be in violation of those terms.

rjf72 7y ago
Just sticking this comment here since I think most people would like to see how the site works. People are interpreting the numbers incorrectly, as I also did at first even though it says at the top exactly how they're measuring these numbers. Your entropy is determined exclusively based upon the people that have used the site in the past 45 days. For now that number is about 204k. So for instance if you see something has an etropy of 9.08 (as my user agent does) you'd also see that it says 1 in 542.15 browsers have this value. 2^9.08 ~= 542.15. The ~ there only because the thousandths and onward digits are not showing. My exact entropy would be about 9.08254825596. All that means is that of the ~204k people that have used the site in the past 45 days, 377 had the same user agent. The problem with this is that the people using this site are going to be a heavily biased sample. And so by tuning to reduce your entropy, you are not actually reducing your trackability but instead making yourself look more like the subset of people that are actively using this site. And this becomes an even bigger problem since I do imagine this site is actively shared on more technically orientated sites, such as this one. But the settings of technically orientated users are often going to vary somewhat significantly from the settings of the other 99% of users. The point of this is that by working to reduce your entropy on this site you may, ironically, end up making yourself more trackable. So the numbers should be taken not as a measurement of trackability, but rather as an interesting insight of your browser/setting differences/similarities of other users with the site. --- Also, 100% agreed on the silliness of them marking you down for not allowing cookies marked Do Not Track friendly. Until such things are enforced, in code and ubiquitously, they're meaningless unenforceable promises that rely on tracking and advertising corporations never lying.

groovecoder 7y ago

Please note: the fingerprinting protection in this blog post is different from the resistFingerprinting about:config pref which would affect your entropy bits on panopticlick.

everdrive 7y ago

"Currently, we estimate that your browser has a fingerprint that conveys at least 17.66 bits of identifying information." However, some of the information sent by my (stock browser) is clearly false: User Agent: Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0 Platform: Linux x86_64 I didn't mess with my user agent, so I assume this is related "resistfingerprinting" in about:config.

vbezhenar 7y ago

Firefox with uBlock Origin and JavaScript disabled: 9.81 bits, one in 900.21 browsers. Google Chrome with uBlock Origin: at least 17.68 bits, unique among the 209,744. iPhone 8, Safari, some adblocker: the same (unique). Probably I should update OS, I'm using pretty old version.