6 ms·

TOR browser on highest security level, javascript disabled and windowed returns: Almost! (You can most certainly be tracked.)

thepete2 7y ago
I've just tried the same, but the HTTP header user agent and the javascript one are different. Maybe TOR varies some attributes?
segfaultbuserr 7y ago
I tried it myself in Tor Browser, and I think this conclusion "You can most certainly be tracked" is highly misleading. Without JavaScript, the only information collected by the website is the headers sent by the browser, listed below... > User agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 (all time: 2.19% / 30 days: 10.80%) > Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 (all time: 52.15% / 30 days: 37.04%) > Content encoding: gzip, deflate, br (all time: 66.35% / 30 days: 92.02%) > Upgrade Insecure Requests: 1 (all time: 27.33% / 30 days: 85.86%) > Referer: https://amiunique.org/ https://amiunique.org/ (all time: 16.55% / 30 days: 60.97%) > JavaScript disabled (all time: 4.70% / 30 days: 14.09%) Surely, there are ways to track users without JavaScript, but none of them is inspected by the website. The website only inspects the headers, and from the listed information above, the tracker doesn't learn anything more than "This user is running the latest release of Tor Browser with JavaScript disabled", and at least 100,000 people are doing it right now. But because the sample size of this website is limited, it only sees the fact that these attributes seem to be a very small percentage of the overall traffic, while ignoring the fact that these headers are generic, it makes the conclusion. > "You can most certainly be tracked" Which is misleading. A Tor Browser with JavaScript disabled is still one of the most difficult browsers to track. The website actually tells you that, > But only 1440 browsers out of the 1560340 observed browsers (<0.01 %) have exactly the same fingerprint as yours. If you are the only person using the latest version of Tor Browser to access this website with JavaScript disabled, yes, you can be tracked as a "Tor user without JavaScript", and if you enter personal information, your identity can be crosstracked between websites (if you are still the only Tor user with JavaScript disabled). Otherwise, not much. Interestingly, when a new Tor Browser release comes out, there will always be an user to upgrade the browser before everyone else, then goes to a fingerprint testing website, tests the browser, and says "OMG! I'm unique and trackable!". In this case, don't panic, just keep using it, you won't be unique anymore within a week.
- FabHK 7y ago
  Worth noting that by default, the Tor Browser has JavaScript enabled (only disabled on non-HTTPS sites).

thepete2 7y ago

I've just tried the same, but the HTTP header user agent and the javascript one are different. Maybe TOR varies some attributes?

segfaultbuserr 7y ago

I tried it myself in Tor Browser, and I think this conclusion "You can most certainly be tracked" is highly misleading. Without JavaScript, the only information collected by the website is the headers sent by the browser, listed below... > User agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 (all time: 2.19% / 30 days: 10.80%) > Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 (all time: 52.15% / 30 days: 37.04%) > Content encoding: gzip, deflate, br (all time: 66.35% / 30 days: 92.02%) > Upgrade Insecure Requests: 1 (all time: 27.33% / 30 days: 85.86%) > Referer: https://amiunique.org/ https://amiunique.org/ (all time: 16.55% / 30 days: 60.97%) > JavaScript disabled (all time: 4.70% / 30 days: 14.09%) Surely, there are ways to track users without JavaScript, but none of them is inspected by the website. The website only inspects the headers, and from the listed information above, the tracker doesn't learn anything more than "This user is running the latest release of Tor Browser with JavaScript disabled", and at least 100,000 people are doing it right now. But because the sample size of this website is limited, it only sees the fact that these attributes seem to be a very small percentage of the overall traffic, while ignoring the fact that these headers are generic, it makes the conclusion. > "You can most certainly be tracked" Which is misleading. A Tor Browser with JavaScript disabled is still one of the most difficult browsers to track. The website actually tells you that, > But only 1440 browsers out of the 1560340 observed browsers (<0.01 %) have exactly the same fingerprint as yours. If you are the only person using the latest version of Tor Browser to access this website with JavaScript disabled, yes, you can be tracked as a "Tor user without JavaScript", and if you enter personal information, your identity can be crosstracked between websites (if you are still the only Tor user with JavaScript disabled). Otherwise, not much. Interestingly, when a new Tor Browser release comes out, there will always be an user to upgrade the browser before everyone else, then goes to a fingerprint testing website, tests the browser, and says "OMG! I'm unique and trackable!". In this case, don't panic, just keep using it, you won't be unique anymore within a week.

FabHK 7y ago
Worth noting that by default, the Tor Browser has JavaScript enabled (only disabled on non-HTTPS sites).