Advanced Tor Browser Fingerprinting

&gt;The most intersting fingerprinting vector I found on Tor Browser is getClientRects. Is strange that reading back from a canvas has been prevented but simply asking the browser javascript API how a specific DOM elements has been drawn on the screen has not been prevented or protected in any way.<p>This isn&#x27;t as strange as he makes it sound, it is done to prevent the link color history attack [1]. Most of the other CSS properties aren&#x27;t allowed on :active or :visited modifiers.<p>[1] <a href="http:&#x2F;&#x2F;dbaron.org&#x2F;mozilla&#x2F;visited-privacy" rel="nofollow">http:&#x2F;&#x2F;dbaron.org&#x2F;mozilla&#x2F;visited-privacy</a>

Unless JavaScript is disabled, this arms race is going to continue forever.

Lots of ideas, many of which I&#x27;ve had as well, but I am missing conclusions. On the demo page it tells me my CPU benchmark and some scrolling measurements. Great, but how unique was that now? And how are you going to make the data points into a fingerprint? Because next time I scroll, I will totally scroll a millisecond differently.

I don&#x27;t believe that any of these will link different Whonix instances on the same host machine. Using Tor browser in the same OS that you use for general work is <i>not</i> secure. Even sharing the same host machine is insecure, where anonymity really matters.

The author is missing the point of the Tor Browser. They don&#x27;t try to make fingerprinting impossible. They want to make the outcome uniform across all users. See &quot;Strategies for Defense: Randomization versus Uniformity&quot; in their design docs [1].<p>And (as other said) uniformity is increased when using an anonymous&#x2F;privacy enhancing operating system like Tails or WHONIX underneath.<p>[1] <a href="https:&#x2F;&#x2F;www.torproject.org&#x2F;projects&#x2F;torbrowser&#x2F;design&#x2F;#fingerprinting-linkability" rel="nofollow">https:&#x2F;&#x2F;www.torproject.org&#x2F;projects&#x2F;torbrowser&#x2F;design&#x2F;#finge...</a>

Most of these are nullified by disabling JavaScript.

Disable javascript. Disable user-agent. Run from VM.

Demo does nothing for me. I&#x27;m dubious how repeatable or unique those results are.

Did the author of the article submit his findings to the Tor Project?