3 ms·

Browser Fingerprinting: How to Stay Private

18 points by WallyFunk 4y ago

autoexec 4y ago
There are two approaches to dealing with fingerprinting I've seen. The first is to hand over a ton of data to fingerprinters but try to get your fingerprint to match a lot of other people's so you can "hide in the crowd". This is what TOR browser does and it seems extremely fragile and unlikely to work since it's a never-ending game of whac-a-mole where you have to account for every single possible thing that could ever possibly make your fingerprint different for it to be effective. The other approach is to try to provide as little information as possible with much of that information being inconsistent so that your fingerprint is always unique across sessions/requests. This seems a lot easier. Simply disabling javascript by default does most of the work for you. You'll still have anything sent over in HTTP headers to worry about (and that can be randomized), but hardened firefox with JS disabled should make most of the data used to fingerprint your browser inaccessible.
- LinuxBender 4y ago
  I have always preferred your second option. I've used a MitM Squid SSL Bump proxy in the past to strip all but known required headers and browser addons to reduce data transmitted. It is hit-or-miss these days as CF will assume I am a bot for not transmitting all the extra fluff so I only use that with sites that are not behind CloudFlare.
  - neodypsis 4y ago
    Interesting idea for a new Qubes Net VM.
- freediver 4y ago
  Third approach is just not to let the fingerprinter run. If it is allowed to run, there is no escaping from being fingerprinted because of the level of sophistication the best ones have.
neodypsis 4y ago
See for example: https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs They evade ad-blocking easily by using custom domains or by distributing the script using popular sites like Github, NPM, etc; This makes extensions like NoScript necessary.
- feet 4y ago
  Clicking on that link gave me instant disdain for an immense amount of devs

18 points by WallyFunk 4y ago

There are two approaches to dealing with fingerprinting I've seen. The first is to hand over a ton of data to fingerprinters but try to get your fingerprint to match a lot of other people's so you can "hide in the crowd". This is what TOR browser does and it seems extremely fragile and unlikely to work since it's a never-ending game of whac-a-mole where you have to account for every single possible thing that could ever possibly make your fingerprint different for it to be effective. The other approach is to try to provide as little information as possible with much of that information being inconsistent so that your fingerprint is always unique across sessions/requests. This seems a lot easier. Simply disabling javascript by default does most of the work for you. You'll still have anything sent over in HTTP headers to worry about (and that can be randomized), but hardened firefox with JS disabled should make most of the data used to fingerprint your browser inaccessible.

LinuxBender 4y ago
I have always preferred your second option. I've used a MitM Squid SSL Bump proxy in the past to strip all but known required headers and browser addons to reduce data transmitted. It is hit-or-miss these days as CF will assume I am a bot for not transmitting all the extra fluff so I only use that with sites that are not behind CloudFlare.
- neodypsis 4y ago
  Interesting idea for a new Qubes Net VM.
freediver 4y ago
Third approach is just not to let the fingerprinter run. If it is allowed to run, there is no escaping from being fingerprinted because of the level of sophistication the best ones have.

neodypsis 4y ago

See for example: https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs They evade ad-blocking easily by using custom domains or by distributing the script using popular sites like Github, NPM, etc; This makes extensions like NoScript necessary.

feet 4y ago
Clicking on that link gave me instant disdain for an immense amount of devs