6 ms·

It's not possible to block browser fingerprinting since it's a range of techniques and heuristics based on numerous features. There's no "turn off fingerprintin

It's not possible to block browser fingerprinting since it's a range of techniques and heuristics based on numerous features. There's no "turn off fingerprinting" button you can just press.

sillysaurusx 4y ago
Whonix says hello. https://www.whonix.org/ https://www.whonix.org/ I was planning to use it exclusively when I was working on a system to fight cartels, so I got pretty deep into these kinds of questions. Whonix has its own problems but it's the best solution available. The communities are interesting too. One fellow was trying to download map data, which confused me initially. Why was he so fixated on maps? It's because if you're in the middle of a warzone, there's obviously no cell service, and it might be a few weeks before you reach an area with wifi. Remarkably prescient given that this was 2013 or so. But you're right in general that there's no way to do it that isn't a pain in the ass for most people. "I can't resize my browser window? Really?"
- staticassertion 4y ago
  I'm sure that the techniques used in Whonix can reduce the number of valuable features used in fingerprinting but you can't "solve" fingerprinting without every single user switching over to something like this.
mdp2021 4y ago
It is possible to enable obstacles to fingerprinting. In Firefox, it is configuration entry privacy.resistFingerprinting Some details (the list is not exhaustive): > * Your timezone is reported to be UTC; * Not all fonts installed on your computer are available to webpages; * The browser window prefers to be set to a specific size; * Your browser reports a specific, common version number and operating system; * Your keyboard layout and language is disguised; * Your webcam and microphone capabilities are disguised; * The Media Statistics Web API reports misleading information; * Any Site-Specific Zoom settings are not applied; * The WebSpeech, Gamepad, Sensors, and Performance Web APIs are disabled, etc.
- roughly 4y ago
  I’ve got this enabled - the only one that’s been more than a mild pain in the ass is the UTC timezone change. Always takes a minute to remember why a site is telling me my appointment is at 2:30 in the morning.
  - jszymborski 4y ago
    Is there a way to reset the timezone but have all the other protections? Timezone provides pretty low information relative to the pain it causes me when I show up to my meeting 5 hours later.
    - m463 4y ago
      I have tried and tried to override this on a site-by-site basis I tried setting: privacy.resistFingerprinting.exemptedDomains to the domain privacy.resistFingerprinting.testGranularityMask -> 4 I still get utc in slack
    - 35mm 4y ago
      Just move to London
      - __tmk__ 4y ago
        UK has daylight savings time. Better move to Iceland instead. They're always on UTC.
na85 4y ago
It's certainly possible to curtail fingerprinting. Why is my browser reporting my resolution to the server? Why can't you just serve me HTML and let me render it how I damn well please?
- staticassertion 4y ago
  Sounds like a really unique, fingerprintable way to browse.
- fiddlerwoaroof 4y ago
  > Why is my browser reporting my resolution to the server The browser doesn’t need to report anything by default. You can get a reasonable estimate with CSS + JavaScript (e.g. using media queries to modify some observable properties on the basis of the screen width and then report what those properties are via a call to fetch)
wraptile 4y ago
It's not binary but it's unfair to say "it can't be done" it absolute can be made significantly better. The strongest fingerprinting techniques use a lot of computing (e.g. font, canvas analysis) so they are expensive to use - no one wants to slow down their visitors by several seconds. The weaker fingerprint techniques can be easily patched and mocked it's just that it's a constant effort to keep up with them. All it would take is 1 major browser to enable it by default to distrubt whole fingerprinting ecosystem to the point where it would be too expensive to effectively fingerprint people.

It's not possible to block browser fingerprinting since it's a range of techniques and heuristics based on numerous features. There's no "turn off fingerprinting" button you can just press.

sillysaurusx 4y ago

Whonix says hello. https://www.whonix.org/ https://www.whonix.org/ I was planning to use it exclusively when I was working on a system to fight cartels, so I got pretty deep into these kinds of questions. Whonix has its own problems but it's the best solution available. The communities are interesting too. One fellow was trying to download map data, which confused me initially. Why was he so fixated on maps? It's because if you're in the middle of a warzone, there's obviously no cell service, and it might be a few weeks before you reach an area with wifi. Remarkably prescient given that this was 2013 or so. But you're right in general that there's no way to do it that isn't a pain in the ass for most people. "I can't resize my browser window? Really?"

staticassertion 4y ago
I'm sure that the techniques used in Whonix can reduce the number of valuable features used in fingerprinting but you can't "solve" fingerprinting without every single user switching over to something like this.

mdp2021 4y ago

It is possible to enable obstacles to fingerprinting. In Firefox, it is configuration entry privacy.resistFingerprinting Some details (the list is not exhaustive): > * Your timezone is reported to be UTC; * Not all fonts installed on your computer are available to webpages; * The browser window prefers to be set to a specific size; * Your browser reports a specific, common version number and operating system; * Your keyboard layout and language is disguised; * Your webcam and microphone capabilities are disguised; * The Media Statistics Web API reports misleading information; * Any Site-Specific Zoom settings are not applied; * The WebSpeech, Gamepad, Sensors, and Performance Web APIs are disabled, etc.

roughly 4y ago
I’ve got this enabled - the only one that’s been more than a mild pain in the ass is the UTC timezone change. Always takes a minute to remember why a site is telling me my appointment is at 2:30 in the morning.
- jszymborski 4y ago
  Is there a way to reset the timezone but have all the other protections? Timezone provides pretty low information relative to the pain it causes me when I show up to my meeting 5 hours later.
  - m463 4y ago
    I have tried and tried to override this on a site-by-site basis I tried setting: privacy.resistFingerprinting.exemptedDomains to the domain privacy.resistFingerprinting.testGranularityMask -> 4 I still get utc in slack
  - 35mm 4y ago
    Just move to London
    - __tmk__ 4y ago
      UK has daylight savings time. Better move to Iceland instead. They're always on UTC.

na85 4y ago

It's certainly possible to curtail fingerprinting. Why is my browser reporting my resolution to the server? Why can't you just serve me HTML and let me render it how I damn well please?

staticassertion 4y ago
Sounds like a really unique, fingerprintable way to browse.
fiddlerwoaroof 4y ago
> Why is my browser reporting my resolution to the server The browser doesn’t need to report anything by default. You can get a reasonable estimate with CSS + JavaScript (e.g. using media queries to modify some observable properties on the basis of the screen width and then report what those properties are via a call to fetch)

wraptile 4y ago

It's not binary but it's unfair to say "it can't be done" it absolute can be made significantly better. The strongest fingerprinting techniques use a lot of computing (e.g. font, canvas analysis) so they are expensive to use - no one wants to slow down their visitors by several seconds. The weaker fingerprint techniques can be easily patched and mocked it's just that it's a constant effort to keep up with them. All it would take is 1 major browser to enable it by default to distrubt whole fingerprinting ecosystem to the point where it would be too expensive to effectively fingerprint people.