4 ms·

This is something that's confused me about Tor Browser. How helpful could zoom level possibly be towards fingerprinting a user to a degree where it's of any use

This is something that's confused me about Tor Browser. How helpful could zoom level possibly be towards fingerprinting a user to a degree where it's of any use for targeted advertising and the like? Seeing that a user has a site's zoom set to 90% seems to be close to worthless in terms of narrowing down what cohort they're in, let alone identifying them individually. What am I missing here?

Tmpod 5y ago
> Seeing that a user has a site's zoom set to 90% seems to be close to worthless in terms of narrowing down what cohort they're in, let alone identifying them individually. How so? 90% is by far not the normal zoom level people browser with, so it is a perfectly valid data point to use for fingerprinting. Every single bit of data they can get makes your whole fingerprint more unique.
adhesive_wombat 5y ago
It adds a little bit of information that might help identify you. It may be less than a bit (e.g. if it's set to 100%), but it's still something. You can see the informational content of various fingerprints here: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ Another thing that has less than a bit of content is having cookies enabled. Nearly everyone has cookies enabled, for better or worse, so having them on doesn't add much to a fingerprint. Having them off adds far more. But both add something.
foxfluff 5y ago
> How helpful could zoom level possibly be towards fingerprinting a user It's just another bit of information. Collect enough bits and eventually you'll have a likely-unique id. It doesn't matter what that information is as long as it somehow is about you (and not e.g. random). If you want to fingerprint, you just try to grab every bit of information you can, no matter how irrelevant it is taken on its own. It doesn't need to say anything about a cohort to be useful, it just needs to enable identifying so that they can track you around and eventually combine other information they discover about you in a profile. And it doesn't even need to be 100% accurate; "that person coming from a Telia-owned IP visiting this site again at 2 AM GMT+2 using Firefox Nightly on Linux, with 1440p display and 120% zoom level and no fonts installed" could be two or three guys if I'm lucky but it's probably close enough to not matter for someone who just wants to sell me garbage. If your zoom level were the only thing, then indeed it would be useless. Problem is, browsers leak lots of bits. It's better to try plug all leaks you can than it is to ask whether that particular leak alone is harmful enough.
- KoftaBob 5y ago
  Ah when you put it like that, I see the logic.
mdp2021 5y ago
> close to worthless ... What am I missing here? Differential calculus. One negligibility times by a huge amount equals one discreet amount. One bit here, one bit there, you get a fingerprint of a thoundred bits.

Tmpod 5y ago

> Seeing that a user has a site's zoom set to 90% seems to be close to worthless in terms of narrowing down what cohort they're in, let alone identifying them individually. How so? 90% is by far not the normal zoom level people browser with, so it is a perfectly valid data point to use for fingerprinting. Every single bit of data they can get makes your whole fingerprint more unique.

adhesive_wombat 5y ago

It adds a little bit of information that might help identify you. It may be less than a bit (e.g. if it's set to 100%), but it's still something. You can see the informational content of various fingerprints here: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ Another thing that has less than a bit of content is having cookies enabled. Nearly everyone has cookies enabled, for better or worse, so having them on doesn't add much to a fingerprint. Having them off adds far more. But both add something.

foxfluff 5y ago

> How helpful could zoom level possibly be towards fingerprinting a user It's just another bit of information. Collect enough bits and eventually you'll have a likely-unique id. It doesn't matter what that information is as long as it somehow is about you (and not e.g. random). If you want to fingerprint, you just try to grab every bit of information you can, no matter how irrelevant it is taken on its own. It doesn't need to say anything about a cohort to be useful, it just needs to enable identifying so that they can track you around and eventually combine other information they discover about you in a profile. And it doesn't even need to be 100% accurate; "that person coming from a Telia-owned IP visiting this site again at 2 AM GMT+2 using Firefox Nightly on Linux, with 1440p display and 120% zoom level and no fonts installed" could be two or three guys if I'm lucky but it's probably close enough to not matter for someone who just wants to sell me garbage. If your zoom level were the only thing, then indeed it would be useless. Problem is, browsers leak lots of bits. It's better to try plug all leaks you can than it is to ask whether that particular leak alone is harmful enough.

KoftaBob 5y ago
Ah when you put it like that, I see the logic.

mdp2021 5y ago

> close to worthless ... What am I missing here? Differential calculus. One negligibility times by a huge amount equals one discreet amount. One bit here, one bit there, you get a fingerprint of a thoundred bits.