Anti-fingerprinting extensions tend to make fingerprinting easier

&gt; There you go, the website will now see the same display resolution for everybody, right? Well, that’s unless the website does this:<p><pre><code> delete screen.width; delete screen.height; </code></pre> &gt; And suddenly screen.width and screen.height are restored to their original values. Fingerprinting can now use two data points instead of one: not merely the real display resolution but also the fake one. Even if that fake display resolution were extremely common, it would still make the fingerprint slightly more precise.<p>&gt; Is this magic? No, just how JavaScript prototypes work. See, these properties are not defined on the screen object itself, they are part of the object’s prototype. So that privacy extension added an override for prototype’s properties. With the override removed the original properties became visible again.<p>This seems like a flaw in the browser extension model. There should be a way of overriding these properties outside the page&#x27;s javascript environment itself, before it&#x27;s initialized, in a way that&#x27;s immutable to anything that runs afterwards.

I worked on browser fingerprinting and countermeasures during my PhD. In one paper, we showed that in the case of an anti canvas fingerprinting extension (canvas defender I think) we were able to extract the seed used to randomise the canvas on each. Since by default the seed was constant, you could use it for tracking: <a href="https:&#x2F;&#x2F;hal.inria.fr&#x2F;hal-01820197" rel="nofollow">https:&#x2F;&#x2F;hal.inria.fr&#x2F;hal-01820197</a> (the paper also talks about other anti fingerprinting techniques).<p>There is also a shorter version in a blog post: <a href="https:&#x2F;&#x2F;antoinevastel.com&#x2F;tracking&#x2F;2018&#x2F;07&#x2F;01&#x2F;eval-canvasdef.html" rel="nofollow">https:&#x2F;&#x2F;antoinevastel.com&#x2F;tracking&#x2F;2018&#x2F;07&#x2F;01&#x2F;eval-canvasdef...</a> (Evaluating the privacy implications of a canvas fingerprinting countermeasure)

We should make fingerprinting illegal.<p>Fingerprinting is an exploit, an attack on the person and machine. It is tracking using mechanisms that were not meant for tracking.<p>It is without consent and it is without user control (you can clear cookies, you can&#x27;t clear the fingerprint you&#x27;ve let on thousands of website you browse every week).<p>Cookies, Local Storage (and IP) should be the only legally authorised means of tracking

&quot;It doesn&#x27;t matter what the data is, it should be: - unique to a sufficiently small group of people&quot;<p>&quot;What you&#x27;d rather want is finding the largest group out there and joining it.&quot;<p>Presumably there is a threshhold for how large the group must be before the value of fingerprinting to advertisers drops.<p>That is one question.<p>Another question is what value to the advertiser is there, if any, in the data contained in the fingerprint itself (beyond its value in forming a fingerprint).<p>Hypothetical. User disables Javascript, CSS, does not send Cookies, does not send User-Agent. User only sends a minumum number of headers needed to retrieve the page. For example, Host: and Connection: only.<p>Putting aside arguments about whether or not this user is more or less &quot;unique&quot; than other users (the size of the group sending minimal data may be small), as well as any arguments about &quot;breaking websites&quot;, is the data in the fingerprint valuable to advertisers.<p>For example, is the advertiser interested in guessing whether the user is using a Javascript and CSS-enabled browser that stores cookies, etc. Will the advertiser perceive the user as a more or less worthy target than another user due to the specifics of the fingerprint.

&gt; This bind() call makes sure the getter looks like a native function. Exactly what we needed.<p>Even the example given as finally working will show difference with the native method, the bound function will have a property `name` set to `bound`, while the native one has a `name` property set to `get width`.<p>My opinion on this is that only the browser can really foil fingerprinting based on surveying the properties of DOM objects.

As someone who worked on a system that did fingerprinting as an alternative to cookies for non-nefarious reasons, I can tell you the best way to not be fingerprinted is to just use Safari on the newest iPhone.<p>Not because iPhones or Safari are any more private. Just because it&#x27;s a fixed size browser that you can&#x27;t customize with extensions and looks identical to 20% of all other sessions.

The solution is very simple, but is not technical: make advertising targeted with personal data illegal.

&gt;Now one could come up with schemes to change this value regularly, but fact is: making users stand out isn’t the right way.<p>I don&#x27;t know that I understand the reasoning behind this. The idea behind it is that it isn&#x27;t the unique fingerprint that is valuable, it is correlation between different captures of the same unique fingerprint that is valuable. So a randomized fingerprint would he unique, but only for one session, and so the data has no value. If anyone understands the reasoning and could explain how I&#x27;m wrong I&#x27;d appreciate it.

...and that&#x27;s why you should be using firefox with resistfingerprinting enabled.

When I first read this headline I was imagining physical extensions to my finger tips..

I&#x27;ve been using Tor with proxy disabled[1] ever since that fingerprint tester[2] was posted a while ago. I figure of all people forking and hardening a web browser, I trust the tor project the most. I&#x27;m no tracking expert, but it&#x27;s the only way I&#x27;ve been able to score a non-unique fingerprint.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;KarlTheCool&#x2F;tor-without-tor" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;KarlTheCool&#x2F;tor-without-tor</a><p>[2] <a href="https:&#x2F;&#x2F;coveryourtracks.eff.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;coveryourtracks.eff.org&#x2F;</a>

What about randomizing some values on every load to make existing, and additional values (as described in the article), result in new (and therefore useless) fingerprints on every load?

Recently Privacy Badger by EFF added a way for sites to detect if the user has it installed <a href="https:&#x2F;&#x2F;www.eff.org&#x2F;gpc-privacy-badger" rel="nofollow">https:&#x2F;&#x2F;www.eff.org&#x2F;gpc-privacy-badger</a>

&gt; What has been is what will be, and what has been done is what will be done, and there is nothing new under the sun.<p>This a cat &amp; mouse game and the leaders constantly change. Sometimes the mice are ahead, sometimes the cats.

Only sure way to browse safely is with js disabled....

I say just ruin the information collected. let them fingerprint you all they want, make the data collected extremely useless

For those saying that fingerprinting should be illegal, how does this balance against the idea that a GET request should never be illegal? Not that I don&#x27;t despise it, I just can&#x27;t see how that&#x27;s not a slippery slope.

TL;DR: browser anti-fingerprinting is difficult<p>Use Tor Browser so that your fingerprint will be identical to many thousands of other users.

<i>&quot;Is this magic? No, just how JavaScript prototypes work.&quot;</i><p>Yet another reason to avoid JavaScript.