6 ms·

Definitely a good STEP1, but it’s not like Firefox and Safari are finger printing secure.

by SV_BubbleTime 11mo ago

capitainenemo 11mo ago
Firefox does pretty damn well though, especially with privacy.resistFingerprinting set to true
- wizzwizz4 11mo ago
  privacy.resistFingerprinting has potentially-unwanted side-effects, like wiping out most of your browser history (instead of the more sensible approach of just disabling purple links). I also recall something about it getting removed or nerfed, though I'm not sure whether that was a mere proposal.
  - noisem4ker 11mo ago
    It also does (or at least used to) mess with dates, due to it attempting to hide what time zone you're in.
    - godshatter 11mo ago
      The browser should reasonably know what time zone you're in and what time zone you're reporting to the website and translate between them automatically.
      - noisem4ker 11mo ago
        Yeah, "should". Too bad it's unfeasible. As soon as you e.g. print the current date as part of a paragraph somewhere, the browser loses track of it, and the website can just read the element's content and parse it back.
  - capitainenemo 11mo ago
    It does not wipe your browser history. I can definitely attest to that since my generic JS active + resistFingerprinting profile has a history going back years. It does set your timezone to UTC in JS on websites. I've mostly encountered that when playing Wordle ;)
- jijijijij 11mo ago
  Every time I manually touched the "fingerprinting" about:config settings, my entropy went up. I used the EFF site to test: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ AFAIK some of these options are there to be used by the Tor browser, which comes with strict configuration assumptions, and it doesn't translate well to normal Firefox usage. Especially if you change the window size on a non-standardized device. Mind you, the goal is not to block fingerprinting, but to not stand out. Safari on a macbook is probably harder to fingerprint than Firefox on your soldering iron. However, judging by the fact that every data hungry website seemingly has a huge problem with VPN usage, I'd presume they are pretty effective and fingerprinting is not.
  - capitainenemo 11mo ago
    I've had good success with tracking tool tests and resistFingerprinting. Granted, I usually use it with uMatrix/NoScript most of the time which cuts down on the available data a lot and maybe makes it an unfair test. One issue, I expect, is simply not enough people using resist fingerprinting to add variation to the mix. Since it's off by default, and only a small % of users use Firefox and an even tinier percentage use resistFingerprinting, unlike your example of Tor where probably most people on the tor network use the tor browser, it's likely that simply blocking things is a fingerprint all on its own. The solution there would be to get more people using it :) I will say one downside to using it is far more bot detection websites freaking out over generic information being returned to them, causing some sites to break (some of their settings breaking webgl games too due to low values). Using a different profile avoids this, or explicitly whitelisting certain sites in privacy.resistFingerprinting.exemptedDomains - obviously if a site is using a generic tracking service for bot detection, that kills a fair amount of the benefit of the flag, so a separate profile might be best. I wish firefox had a container option for this. ... and. not too sure what you mean by changing window size on a non-standardised device. They do try to ensure the window sizes are at standard intervals, as if they were fullscreened at typical widths to reduce fingerprinting, but surely that applies to using Tor too? I mean, people don't use Tor on dedicated monitors at standard sizes.
    - capitainenemo 11mo ago
fsflover 11mo ago
Tor Browser (based on Firefox) is.
Alive-in-2025 11mo ago
what about duck duck go? We need a simple chart: 1. What browsers are good at resisting finger printing 2. tell for each browser, does it work on android ad ios and apple and windows and linux 3. what setting are needed to achieve this for bonus points, is there no way to strip all headers on chrome on control it better?
- mark_l_watson 11mo ago
  This is my question also. I tend to not use apps, use DuckDuckGo browser. I sometimes do use Safari which is a more convenient browser - it would be ironic if DDG browser is less private than Safari.
8fingerlouie 11mo ago
Modern Safari is pretty damned good at randomizing fingerprints with Intelligent Tracking Prevention. With IOS 26 and MacOS 26, it's enabled in both private and non private browser windows (used to be only in private mode). All "fingerprint" tests I've run have returned good results.
- SV_BubbleTime 11mo ago
  I haven’t tried 26, but I remember it didn’t used to be so great.
- drnick1 11mo ago
  Unfortunately, it's closed source and only available on Apple devices.

Definitely a good STEP1, but it’s not like Firefox and Safari are finger printing secure.

capitainenemo 11mo ago

Firefox does pretty damn well though, especially with privacy.resistFingerprinting set to true

wizzwizz4 11mo ago
privacy.resistFingerprinting has potentially-unwanted side-effects, like wiping out most of your browser history (instead of the more sensible approach of just disabling purple links). I also recall something about it getting removed or nerfed, though I'm not sure whether that was a mere proposal.
- noisem4ker 11mo ago
  It also does (or at least used to) mess with dates, due to it attempting to hide what time zone you're in.
  - godshatter 11mo ago
    The browser should reasonably know what time zone you're in and what time zone you're reporting to the website and translate between them automatically.
    - noisem4ker 11mo ago
      Yeah, "should". Too bad it's unfeasible. As soon as you e.g. print the current date as part of a paragraph somewhere, the browser loses track of it, and the website can just read the element's content and parse it back.
- capitainenemo 11mo ago
  It does not wipe your browser history. I can definitely attest to that since my generic JS active + resistFingerprinting profile has a history going back years. It does set your timezone to UTC in JS on websites. I've mostly encountered that when playing Wordle ;)
jijijijij 11mo ago
Every time I manually touched the "fingerprinting" about:config settings, my entropy went up. I used the EFF site to test: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ AFAIK some of these options are there to be used by the Tor browser, which comes with strict configuration assumptions, and it doesn't translate well to normal Firefox usage. Especially if you change the window size on a non-standardized device. Mind you, the goal is not to block fingerprinting, but to not stand out. Safari on a macbook is probably harder to fingerprint than Firefox on your soldering iron. However, judging by the fact that every data hungry website seemingly has a huge problem with VPN usage, I'd presume they are pretty effective and fingerprinting is not.
- capitainenemo 11mo ago
  I've had good success with tracking tool tests and resistFingerprinting. Granted, I usually use it with uMatrix/NoScript most of the time which cuts down on the available data a lot and maybe makes it an unfair test. One issue, I expect, is simply not enough people using resist fingerprinting to add variation to the mix. Since it's off by default, and only a small % of users use Firefox and an even tinier percentage use resistFingerprinting, unlike your example of Tor where probably most people on the tor network use the tor browser, it's likely that simply blocking things is a fingerprint all on its own. The solution there would be to get more people using it :) I will say one downside to using it is far more bot detection websites freaking out over generic information being returned to them, causing some sites to break (some of their settings breaking webgl games too due to low values). Using a different profile avoids this, or explicitly whitelisting certain sites in privacy.resistFingerprinting.exemptedDomains - obviously if a site is using a generic tracking service for bot detection, that kills a fair amount of the benefit of the flag, so a separate profile might be best. I wish firefox had a container option for this. ... and. not too sure what you mean by changing window size on a non-standardised device. They do try to ensure the window sizes are at standard intervals, as if they were fullscreened at typical widths to reduce fingerprinting, but surely that applies to using Tor too? I mean, people don't use Tor on dedicated monitors at standard sizes.
  - capitainenemo 11mo ago

fsflover 11mo ago

Tor Browser (based on Firefox) is.

Alive-in-2025 11mo ago

what about duck duck go? We need a simple chart: 1. What browsers are good at resisting finger printing 2. tell for each browser, does it work on android ad ios and apple and windows and linux 3. what setting are needed to achieve this for bonus points, is there no way to strip all headers on chrome on control it better?

mark_l_watson 11mo ago
This is my question also. I tend to not use apps, use DuckDuckGo browser. I sometimes do use Safari which is a more convenient browser - it would be ironic if DDG browser is less private than Safari.

8fingerlouie 11mo ago

Modern Safari is pretty damned good at randomizing fingerprints with Intelligent Tracking Prevention. With IOS 26 and MacOS 26, it's enabled in both private and non private browser windows (used to be only in private mode). All "fingerprint" tests I've run have returned good results.

SV_BubbleTime 11mo ago
I haven’t tried 26, but I remember it didn’t used to be so great.
drnick1 11mo ago
Unfortunately, it's closed source and only available on Apple devices.