Evidence aside, it always seems impossible to have any serious discussion of (non-behavioural) fingerprinting online. There is a meme that always shows up abou

Evidence aside, it always seems impossible to have any serious discussion of (non-behavioural) fingerprinting online. There is a meme that always shows up about how anything someone does to avoid fingerpringting makes them stand out even more, like some sort of Catch-22. But this meme rests on an assumption that people must use, now and forever, certain software that sends many details that can be used to construct a fingerprint, namely, a software program that web developers call a "modern browser". If those are the conditions, if this is the only software web users are allowed to choose, then yes, I agree, web users have no chance against fingerprinting; they will be involuntarily sending copious details to websites, automatically. The small number of popular "modern" web browsers are generally distributed by surveillance advertising companies, companies increasing their surveillance advertising services or organisations that send data about users to such companies in return for payment. Using this complex software to attempt to "defeat browser fingerprinting" is, no surprise, a losing game. Ultimately, the goal of anti-fingerprinting should be to significantly reduce the number of details sent, which in effect reduces the number of details that can be used to construct a fingerprint. The reason this should be the goal is that when there are fewer details to copy then it is easier to make fingerprints so generic that they are not very useful for surveillance advertising. The Catch-22 meme often refers to the goal as "blending in", achieved by trying to duplicate popular but complex configurations reported to websites by the popular browsers. Truthfully, if the choice of software is smaller programs that have minimal configuration and send almost no details, then it is easier to "blend in", if that is the goal. If a user-modifiable string from an optional User-Agent HTTP header is one of only a few, or perhaps the only, detail in a fingerprint, e.g., if web users make HTTP requests using simpler software that does not run Javascript, then, _if web users wanted too look alike_, it is easier for them to do so. The alleged Catch-22 created by the complexity of "modern" browser can be resolved. As it happens, according to "web security" reports, over half of web traffic comes from simpler clients that do not display advertising. What are the (non-behavioural) "browser fingerprints" of these users. Generally, it is a user-modifiable string in a User-Agent HTTP header. If the header is omittted, or if different "bots" use the same string, then the "browser fingerprint" becomes even less distinguishable. Alas, web users who choose simpler software instead of the larger, more complex "modern" browsers often get mistaken for "bots" based on crude heuristics with high false positive rates. Alas, website operators often do not focus on behaviour, e.g., rate-limiting, when it's easier to simply label anything that is not sending many details and running Javascript as a "bot". The characteristic bad behaviour of "bots" is assumed. Even when it does not exist. A single, one-time HTTP request can trigger a heuristic-based block designed to stop repeated, excessive HTTP requests. The surveillance advertising ecosystem relies on web users all choosing the same few browsers that run Javascripts indiscriminantly without any user input. Even using an add-on/extension like uMatrix with a "modern" browser may trigger "bot" heuristics, because uMatrix lets the user run Javascript discrimantly. Fingerprinting may not be 100% dependant on Javascript. But the most useful fingerprints for advertising, not to mention serving the advertisements themselves, rely on Javascript.