6 ms·

OT on Tor: Recently this link was on HN[1]. It ranks your browser on regular tracking and fingerprinting separately. "Tor without JS" was the only option I fou

OT on Tor: Recently this link was on HN[1]. It ranks your browser on regular tracking and fingerprinting separately. "Tor without JS" was the only option I found to be completely fingerprint resistant. Even Tor "with JS on strict settings" ranked it as only "partly fingerprint resistant". (Interestingly firefox without JS never returns) Scary stuff. I'd like to hear other people's experiences/experiments here. [1] https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/

47282847 11mo ago
Tor Browser tries to widen the fingerprint buckets you can get put into by eg rounding off canvas sizes. The widest bucket and unavoidable is “Tor (browser) user”.
mawadev 11mo ago
You can even track people by favicon which bypasses incognito mode. Another part is hiding font urls in css with more tracking...
- mr_mitm 11mo ago
  Was incognito mode ever meant to prevent tracking? I thought it was for porn, I mean buying surprise presents on a shared computer.
  - sharperguy 11mo ago
    it's commonly used for checking how sites look when not logged in, without logging out, or logging in as another user temporarily.
  - jfindper 11mo ago
    You're correct, incognito mode never has been for privacy protection from websites, ISPs, etc.
- shlomo_z 11mo ago
  While this was possible in the past, I believe it got patched and is impossible today.
armchairhacker 11mo ago
In iOS embedded WebView: “strong protection against Web tracking”, and a fingerprint of ~20 bits.
- infogulch 11mo ago
  A basic Brave install: "strong protection against Web tracking" / 18.58 bits
monerozcash 11mo ago
Regular OS X safari: Our tests indicate that you have strong protection against Web tracking. >Your browser fingerprint has been randomized among the 378,837 tested in the past 45 days. Although sophisticated adversaries may still be able to track you to some extent, randomization provides a very strong protection against tracking companies trying to fingerprint your browser. >Currently, we estimate that your browser has a fingerprint that conveys at least 18.53 bits of identifying information. Anyway, this test doesn't really communicate the results very well. Yes, Tor browser stands out. No, it's not easy to differentiate between different Tor browser users via this kind of fingerprinting.
- ekjhgkejhgk 11mo ago
  Could you clarify if that's with or without JS?
  - monerozcash 11mo ago
    I have not disabled JS or made any other configuration changes on this device. Entirely stock Safari and entirely stock MacOS.
    - ekjhgkejhgk 11mo ago
      That's not really believable. I'm starting to think this website isn't very reliable.
      - monerozcash 11mo ago
        No, it's believable. All this website is communicating to us that most MacOS Safari installs look the same.
        ekjhgkejhgk 11mo ago
        It's not "install" that matter here. If two people have the same "install" but their browser windows have different sizes, they'll be distinguishable. Or any perperty that can be queried via JS. Let me rephrase it: you believe it, I don't believe.
pixel_popping 11mo ago
Tor without JS is still subject to some degree of fingerprinting through CSS (media queries, caching) and tracking methods through mouse (without JS).
- SoKamil 11mo ago
  > and tracking methods through mouse (without JS). How?
  - npn 11mo ago
    Hovering can trigger network request
deleted 11mo ago
[deleted]
Santosh83 11mo ago
Visiting this site with a freshly installed, stock Tor browser (therefore with JS enabled, no settings changed from defaults) on Debian stable gives me: "Our tests indicate that you have strong protection against Web tracking." "Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 301.9 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 8.24 bits of identifying information." Interestingly, increasing the Tor Browser Security level from Safe to Safer actually increased the bits of identifying information and reduced the anonymity: "Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 832.32 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 9.7 bits of identifying information." And at the Safest Security level (i.e. with JS diabled) the identifying bits and anonymization appear to be at their best: "Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 261.41 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 8.03 bits of identifying information."
- ekjhgkejhgk 11mo ago
  I'm also on Debian 13 stable, that's definitely not what I get with JS. Weird.
twhb 11mo ago
This tool is deeply flawed. Fingerprinting protection is sometimes done by binning, which this tool rewards, and is sometimes done by randomizing, which this tool harshly punishes. The net result is it generally guides you away from the strongest protection. The flip side of this, having the complementary flaw of testing only persistence, not uniqueness, is (warning, real tracking link) fingerprinting.com/demo. You can try resetting your ID and seeing if it changes here. Since tracking requires (a degree of) uniqueness AND (a degree of) persistence, the danger signal is only failing both the EFF test and this test. Failing both is a requirement to derive meaning, not being lax: measuring only uniqueness would fail a random number generator, and measuring only persistence would fail the number 4.
- ekjhgkejhgk 11mo ago
  You make an interesting point on binning vs randomization. I'm not an expert but to me your point is consistent with Tor having the "best protection" according to the website, because I know that Tor's strategy is binning. However, this is what actually makes sense for many variables though. For example, font sizes come in integers. If you're trying to be clever by "randomizing" and claiming to use decimal-sized, you might be the only person in the world to do so and immediately fingerprinted. So I think that randomization might indeed be a bad idea in many cases. Your link doesn't work though. I just get "file not found".
  - ue7gjelwjd 11mo ago
    [flagged]
  - twhb 11mo ago
    Sorry, fixed link: https://demo.fingerprint.com/playground https://demo.fingerprint.com/playground. I agree on randomization, but there are other places where it doesn’t stick out like that. I’ll look up specifics if I find the time, but I think reading canvas data without permission is one place it’s utilized, including by Tor.
- monerozcash 11mo ago
  It seems to reward totally unique randomized fingerprints also, which is maybe not great.
fuddle 11mo ago
Interesting, Chrome failed but Firefox and Brave "have strong protection against Web tracking."

47282847 11mo ago

Tor Browser tries to widen the fingerprint buckets you can get put into by eg rounding off canvas sizes. The widest bucket and unavoidable is “Tor (browser) user”.

mawadev 11mo ago

You can even track people by favicon which bypasses incognito mode. Another part is hiding font urls in css with more tracking...

mr_mitm 11mo ago
Was incognito mode ever meant to prevent tracking? I thought it was for porn, I mean buying surprise presents on a shared computer.
- sharperguy 11mo ago
  it's commonly used for checking how sites look when not logged in, without logging out, or logging in as another user temporarily.
- jfindper 11mo ago
  You're correct, incognito mode never has been for privacy protection from websites, ISPs, etc.
shlomo_z 11mo ago
While this was possible in the past, I believe it got patched and is impossible today.

armchairhacker 11mo ago

In iOS embedded WebView: “strong protection against Web tracking”, and a fingerprint of ~20 bits.

infogulch 11mo ago
A basic Brave install: "strong protection against Web tracking" / 18.58 bits

monerozcash 11mo ago

Regular OS X safari: Our tests indicate that you have strong protection against Web tracking. >Your browser fingerprint has been randomized among the 378,837 tested in the past 45 days. Although sophisticated adversaries may still be able to track you to some extent, randomization provides a very strong protection against tracking companies trying to fingerprint your browser. >Currently, we estimate that your browser has a fingerprint that conveys at least 18.53 bits of identifying information. Anyway, this test doesn't really communicate the results very well. Yes, Tor browser stands out. No, it's not easy to differentiate between different Tor browser users via this kind of fingerprinting.

ekjhgkejhgk 11mo ago
Could you clarify if that's with or without JS?
- monerozcash 11mo ago
  I have not disabled JS or made any other configuration changes on this device. Entirely stock Safari and entirely stock MacOS.
  - ekjhgkejhgk 11mo ago
    That's not really believable. I'm starting to think this website isn't very reliable.
    - monerozcash 11mo ago
      No, it's believable. All this website is communicating to us that most MacOS Safari installs look the same.
      - ekjhgkejhgk 11mo ago
        It's not "install" that matter here. If two people have the same "install" but their browser windows have different sizes, they'll be distinguishable. Or any perperty that can be queried via JS. Let me rephrase it: you believe it, I don't believe.

pixel_popping 11mo ago

Tor without JS is still subject to some degree of fingerprinting through CSS (media queries, caching) and tracking methods through mouse (without JS).

SoKamil 11mo ago
> and tracking methods through mouse (without JS). How?
- npn 11mo ago
  Hovering can trigger network request

deleted 11mo ago

[deleted]

Santosh83 11mo ago

Visiting this site with a freshly installed, stock Tor browser (therefore with JS enabled, no settings changed from defaults) on Debian stable gives me: "Our tests indicate that you have strong protection against Web tracking." "Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 301.9 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 8.24 bits of identifying information." Interestingly, increasing the Tor Browser Security level from Safe to Safer actually increased the bits of identifying information and reduced the anonymity: "Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 832.32 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 9.7 bits of identifying information." And at the Safest Security level (i.e. with JS diabled) the identifying bits and anonymization appear to be at their best: "Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 261.41 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 8.03 bits of identifying information."

ekjhgkejhgk 11mo ago
I'm also on Debian 13 stable, that's definitely not what I get with JS. Weird.

twhb 11mo ago

This tool is deeply flawed. Fingerprinting protection is sometimes done by binning, which this tool rewards, and is sometimes done by randomizing, which this tool harshly punishes. The net result is it generally guides you away from the strongest protection. The flip side of this, having the complementary flaw of testing only persistence, not uniqueness, is (warning, real tracking link) fingerprinting.com/demo. You can try resetting your ID and seeing if it changes here. Since tracking requires (a degree of) uniqueness AND (a degree of) persistence, the danger signal is only failing both the EFF test and this test. Failing both is a requirement to derive meaning, not being lax: measuring only uniqueness would fail a random number generator, and measuring only persistence would fail the number 4.

ekjhgkejhgk 11mo ago
You make an interesting point on binning vs randomization. I'm not an expert but to me your point is consistent with Tor having the "best protection" according to the website, because I know that Tor's strategy is binning. However, this is what actually makes sense for many variables though. For example, font sizes come in integers. If you're trying to be clever by "randomizing" and claiming to use decimal-sized, you might be the only person in the world to do so and immediately fingerprinted. So I think that randomization might indeed be a bad idea in many cases. Your link doesn't work though. I just get "file not found".
- ue7gjelwjd 11mo ago
  [flagged]
- twhb 11mo ago
  Sorry, fixed link: https://demo.fingerprint.com/playground https://demo.fingerprint.com/playground. I agree on randomization, but there are other places where it doesn’t stick out like that. I’ll look up specifics if I find the time, but I think reading canvas data without permission is one place it’s utilized, including by Tor.
monerozcash 11mo ago
It seems to reward totally unique randomized fingerprints also, which is maybe not great.

fuddle 11mo ago

Interesting, Chrome failed but Firefox and Brave "have strong protection against Web tracking."