5 ms·

Test browser for web tracking – EFF

95 points by _cnhi 3y ago

nabla9 3y ago
>Currently, we estimate that your browser has a fingerprint that conveys 11.02 bits of identifying information.
einpoklum 3y ago
TIL about a combination of supposedly innocuous, non-unique information my browser is sending out which, _in combination_, may identify me uniquely, or close-to-uniquely. My test results say: > Your browser fingerprint appears to be unique among the 187,426 tested in the past 45 days. > > Currently, we estimate that your browser has a fingerprint that conveys at least 17.52 bits of identifying information. ... and that's _at least_. It might be double that or more if all the information I'm sending out is orthogonal.
- dylan604 3y ago
  "Bits of identifying information: 4.37" "Our tests indicate that you have strong protection against Web tracking." Thank jeebus. If all of my effort of setting the preferences to block everything and running uBO showed as anything else, I'd be depressed more than pissed.
- contravariant 3y ago
  I've long since given up trying to remove the fingerprint completely, best I can do is limit it and just add noise where they (hopefully) don't expect it.
- anonymouse008 3y ago
  I’m not sure I agree with the calculation. Basically they use each variable as independent when they are by nature not - as in if you have iPhone in the headers, you’ll probably have certain ram and gpu hashes. So those aren’t necessarily fully independent bits of info.
  - einpoklum 3y ago
    Oh, no, they treat the variables as fully dependent. That's why they take the maximum over the fields, not the sum nor some kind of \Prod_i(1-p_i) - type thing.
    - upon_drumhead 3y ago
      It doesn’t take the maximum. It says I have 14.53 bits of identifying information, however the max listed is my time zone offset providing 8.24 Bits of identifying information.
syx 3y ago
It's scary how much information browsers give out for free, I wish I could use a browser that completely blocks and limits fingerprinting but nowadays I can barely watch YouTube or completing an online purchase flow with ad-blockers enabled
- movedx 3y ago
  I know what you mean. One thing I'm trying to get into the habit of doing is using yt-dlp to pull videos from YouTube so I don't have to use their website, and I have _YT premium_ ffs -- it's just nasty.
- jerbear4328 3y ago
  Tor Browser is really good at this. It was designed for the purpose of limiting tracking, both by IP and fingerprinting. Every user that downloads and runs Tor Browser looks perfectly identical to any website they visit, and hitting the button to reset your identity truly does that. Downside is it's really slow compared to just using your network directly, but that's the price you have to pay for privacy atm.
  - BramLovesYams 3y ago
    One thing that is important in keeping this "identical" browser appearance to potential trackers is not changing the size of the browser window once you open Tor.
    - themoonisachees 3y ago
      Hasn't this largely been fixed? I remember reading about how the tor browser would fake its window size to be from a predefined set that's somewhat near your current window size
      - crtasm 3y ago
        That's correct, if you resize the window you can see the page area switching between the predefined sizes.
krackers 3y ago
Javascript disabled and the result page doesn't even load. Does that mean I win?
- raggi 3y ago
  nope, just inconvenienced
- EvanAnderson 3y ago
  I have Javascript disabled on an Android phone and it loaded for me. There were several full page loads before I got to the results but I just waited.
qweqwe14 3y ago
Remember that trying to make a browser like Chromium or Firefox hard to fingerprint is harder than it seems. There's a lot of stuff you need to change, including fonts, screen resolution, system memory, user agent details (some browsers also add Sec-CH-UA strings), timezone, along with things like WebGL fingerprinting etc It's also worth noting that you can sometimes actually make yourself more fingerprintable by not properly hiding something, like changing your UA in HTTP requests but not in JavaScript as well. If a website detects such a "quirk", it would be able to fingerprint you with a lot more precision. TL;DR If you really want to stay anonymous and not worry about fingerprinting and trackers — use Tor Browser. It was specifically designed so that everyone has the same fingerprint, and has things like letterboxing to hide resolution etc. It's unlikely you'd be able to do a better job than Tor Browser by modifying your own browser.
jakebasile 3y ago
Using MS Edge on Linux really helped make my user agent unique.
rkta 3y ago
Our tests indicate that you have you have strong protection against Web tracking. Your browser fingerprint appears to be unique among the 191,640 tested in the past 45 days. User Agent w3m/0.5.3+git20230718 Bits of identifying information: 17.55 One in x browsers have this value: 191640.0 So I have strong protection by being basically unique? Not sure what this means.
- specto 3y ago
  I think it's saying, hey you tried and it's better than most
- sohex 3y ago
  I think you might have missed where it says if your browser is blocking tracking ads and invisible trackers. At least for me I got the same "strong protection" message and unique fingerprint, but it did indicate that I'm blocking both of the aforementioned.
  - rkta 3y ago
    I quoted only parts of the page. My point is, when being unique while being strongly protected, am I really protected?
    - sohex 3y ago
      Well the question at that point is, protected from whom? Security is never a binary state, it can only be assessed relative to a given threat model. I'd say that being protected from all the sites that don't use fingerprinting scripts is certainly better than not. If fingerprinting is a concern to you though grab a factory default iPhone, should be pretty a pretty common fingerprint.

95 points by _cnhi 3y ago

>Currently, we estimate that your browser has a fingerprint that conveys 11.02 bits of identifying information.

TIL about a combination of supposedly innocuous, non-unique information my browser is sending out which, _in combination_, may identify me uniquely, or close-to-uniquely. My test results say: > Your browser fingerprint appears to be unique among the 187,426 tested in the past 45 days. > > Currently, we estimate that your browser has a fingerprint that conveys at least 17.52 bits of identifying information. ... and that's _at least_. It might be double that or more if all the information I'm sending out is orthogonal.

dylan604 3y ago
"Bits of identifying information: 4.37" "Our tests indicate that you have strong protection against Web tracking." Thank jeebus. If all of my effort of setting the preferences to block everything and running uBO showed as anything else, I'd be depressed more than pissed.
contravariant 3y ago
I've long since given up trying to remove the fingerprint completely, best I can do is limit it and just add noise where they (hopefully) don't expect it.
anonymouse008 3y ago
I’m not sure I agree with the calculation. Basically they use each variable as independent when they are by nature not - as in if you have iPhone in the headers, you’ll probably have certain ram and gpu hashes. So those aren’t necessarily fully independent bits of info.
- einpoklum 3y ago
  Oh, no, they treat the variables as fully dependent. That's why they take the maximum over the fields, not the sum nor some kind of \Prod_i(1-p_i) - type thing.
  - upon_drumhead 3y ago
    It doesn’t take the maximum. It says I have 14.53 bits of identifying information, however the max listed is my time zone offset providing 8.24 Bits of identifying information.

syx 3y ago

It's scary how much information browsers give out for free, I wish I could use a browser that completely blocks and limits fingerprinting but nowadays I can barely watch YouTube or completing an online purchase flow with ad-blockers enabled

movedx 3y ago
I know what you mean. One thing I'm trying to get into the habit of doing is using yt-dlp to pull videos from YouTube so I don't have to use their website, and I have _YT premium_ ffs -- it's just nasty.
jerbear4328 3y ago
Tor Browser is really good at this. It was designed for the purpose of limiting tracking, both by IP and fingerprinting. Every user that downloads and runs Tor Browser looks perfectly identical to any website they visit, and hitting the button to reset your identity truly does that. Downside is it's really slow compared to just using your network directly, but that's the price you have to pay for privacy atm.
- BramLovesYams 3y ago
  One thing that is important in keeping this "identical" browser appearance to potential trackers is not changing the size of the browser window once you open Tor.
  - themoonisachees 3y ago
    Hasn't this largely been fixed? I remember reading about how the tor browser would fake its window size to be from a predefined set that's somewhat near your current window size
    - crtasm 3y ago
      That's correct, if you resize the window you can see the page area switching between the predefined sizes.

krackers 3y ago

Javascript disabled and the result page doesn't even load. Does that mean I win?

raggi 3y ago
nope, just inconvenienced
EvanAnderson 3y ago
I have Javascript disabled on an Android phone and it loaded for me. There were several full page loads before I got to the results but I just waited.

qweqwe14 3y ago

Remember that trying to make a browser like Chromium or Firefox hard to fingerprint is harder than it seems. There's a lot of stuff you need to change, including fonts, screen resolution, system memory, user agent details (some browsers also add Sec-CH-UA strings), timezone, along with things like WebGL fingerprinting etc It's also worth noting that you can sometimes actually make yourself more fingerprintable by not properly hiding something, like changing your UA in HTTP requests but not in JavaScript as well. If a website detects such a "quirk", it would be able to fingerprint you with a lot more precision. TL;DR If you really want to stay anonymous and not worry about fingerprinting and trackers — use Tor Browser. It was specifically designed so that everyone has the same fingerprint, and has things like letterboxing to hide resolution etc. It's unlikely you'd be able to do a better job than Tor Browser by modifying your own browser.

jakebasile 3y ago

Using MS Edge on Linux really helped make my user agent unique.

rkta 3y ago

Our tests indicate that you have you have strong protection against Web tracking. Your browser fingerprint appears to be unique among the 191,640 tested in the past 45 days. User Agent w3m/0.5.3+git20230718 Bits of identifying information: 17.55 One in x browsers have this value: 191640.0 So I have strong protection by being basically unique? Not sure what this means.

specto 3y ago
I think it's saying, hey you tried and it's better than most
sohex 3y ago
I think you might have missed where it says if your browser is blocking tracking ads and invisible trackers. At least for me I got the same "strong protection" message and unique fingerprint, but it did indicate that I'm blocking both of the aforementioned.
- rkta 3y ago
  I quoted only parts of the page. My point is, when being unique while being strongly protected, am I really protected?
  - sohex 3y ago
    Well the question at that point is, protected from whom? Security is never a binary state, it can only be assessed relative to a given threat model. I'd say that being protected from all the sites that don't use fingerprinting scripts is certainly better than not. If fingerprinting is a concern to you though grab a factory default iPhone, should be pretty a pretty common fingerprint.