4 ms·

The "browser window prefers a specific size" part is infuriating to say the least. I wonder what the person who came up with this detail was thinking. Can't you

The "browser window prefers a specific size" part is infuriating to say the least. I wonder what the person who came up with this detail was thinking. Can't you just leave the window size up to the user but still keep the other changes? I'd like to believe that all the other changes still contribute plenty towards obscuring the fingerprint, but there's no way I can adjust to manually having to resize the browser window every time I open a new one.

333c 4y ago
I'm not sure this would work, in general. A page will often render slightly differently based on the size of the window, so whatever size is "reported" to the webpage would end up being how big the page is rendered.
- daneel_w 4y ago
  Only if there's active use of e.g. JavaScript or some server-side scripting that needs the info for some processing, for example using JavaScript to place a floating modal flush against bottom/right corner. The browser itself doesn't need to relay the dimensions "to the webpage" in order for HTML/CSS to render as any specific size, nor to achieve responsive/scaling UI design that adjusts to the window size.
  - rhn_mk1 4y ago
    It does, via media queries that include resources loaded at specific shapes.
    - daneel_w 4y ago
      What I'm trying to convey is that it's a misunderstanding that the server renders the page for the browser, and that reporting innerHeight/Width properties to the web server ("the webpage") is a requirement for having anything pop up on the screen.
enkrs 4y ago
The TOR browser (based on FF) has this implemented for some time now. It resizes the window by a large (I think 50px) grid instead of single pixels. That way the window sizes are adjustable by the user, but still less unique than pixel adjusted.
- daneel_w 4y ago
  It's an interesting solution, but if I were to guess I think the users who surf with anything but a full-size window are in minority.
  - input_sh 4y ago
    I'm not sure if that's still the case, but I definitely remember Tor Browser throwing a warning you when you try maximising the window for this reason.
  - jeroenhd 4y ago
    I use tree style tabs and though my browser is full screened, I sometimes get popups from people and websites trying to be clever, thinking that the only reason a window seems full screen but isn't must obviously be those darned dev tools. I quickly close websites like that (and blacklist them in my pihole if they're particularly offensive in their messaging) but for people like me these protections do actually help.
  - gruez 4y ago
    Right, but there are different monitor sizes out there (1366x768, 1920x1080, 2560x1440, 3840x2160) so that's still a fingerprinting vector. In addition, because of various user settings (eg. whether they're using compact theme or not, various OS settings), "full screen" on a 1920x1080 monitor for one person might result in a different viewport size for another. That also becomes another fingerprinting vector.
    - daneel_w 4y ago
      It's mainly a problem for macOS users, since we tend to adjust the application dock to quite individual preference. Windows users will with full-size window mostly end up in the same few groups. Linux users to a lesser degree.

333c 4y ago

I'm not sure this would work, in general. A page will often render slightly differently based on the size of the window, so whatever size is "reported" to the webpage would end up being how big the page is rendered.

daneel_w 4y ago
Only if there's active use of e.g. JavaScript or some server-side scripting that needs the info for some processing, for example using JavaScript to place a floating modal flush against bottom/right corner. The browser itself doesn't need to relay the dimensions "to the webpage" in order for HTML/CSS to render as any specific size, nor to achieve responsive/scaling UI design that adjusts to the window size.
- rhn_mk1 4y ago
  It does, via media queries that include resources loaded at specific shapes.
  - daneel_w 4y ago
    What I'm trying to convey is that it's a misunderstanding that the server renders the page for the browser, and that reporting innerHeight/Width properties to the web server ("the webpage") is a requirement for having anything pop up on the screen.

enkrs 4y ago

The TOR browser (based on FF) has this implemented for some time now. It resizes the window by a large (I think 50px) grid instead of single pixels. That way the window sizes are adjustable by the user, but still less unique than pixel adjusted.

daneel_w 4y ago
It's an interesting solution, but if I were to guess I think the users who surf with anything but a full-size window are in minority.
- input_sh 4y ago
  I'm not sure if that's still the case, but I definitely remember Tor Browser throwing a warning you when you try maximising the window for this reason.
- jeroenhd 4y ago
  I use tree style tabs and though my browser is full screened, I sometimes get popups from people and websites trying to be clever, thinking that the only reason a window seems full screen but isn't must obviously be those darned dev tools. I quickly close websites like that (and blacklist them in my pihole if they're particularly offensive in their messaging) but for people like me these protections do actually help.
- gruez 4y ago
  Right, but there are different monitor sizes out there (1366x768, 1920x1080, 2560x1440, 3840x2160) so that's still a fingerprinting vector. In addition, because of various user settings (eg. whether they're using compact theme or not, various OS settings), "full screen" on a 1920x1080 monitor for one person might result in a different viewport size for another. That also becomes another fingerprinting vector.
  - daneel_w 4y ago
    It's mainly a problem for macOS users, since we tend to adjust the application dock to quite individual preference. Windows users will with full-size window mostly end up in the same few groups. Linux users to a lesser degree.