10 ms·

Are there any browser extensions or tools that effectively prevent fingerprinting including canvas fingerprinting? Or is this one of those privacy battles we ju

by dngit 2y ago

Are there any browser extensions or tools that effectively prevent fingerprinting including canvas fingerprinting? Or is this one of those privacy battles we just have to accept as unwinnable?

begueradj 2y ago
https://www.torproject.org https://www.torproject.org
- dngit 2y ago
  Tor's great if you're okay with browsing the web at "stealth mode" speed! Have you found it practical for everyday use?
- DeathArrow 2y ago
  TOR hides your IP address. It doesn't protect you from fingerprinting.
  - akimbostrawman 2y ago
    wrong https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift
    - DeathArrow 2y ago
      That is a modified browser. TOR network itself doesn't protect people from fingerprinting.
      - akimbostrawman 2y ago
        how would a traffic protocol prevent browser fingerprinting? the closest would be traffic padding which tor does. https://spec.torproject.org/padding-spec/connection-level-padding.html https://spec.torproject.org/padding-spec/connection-level-pa...
jszymborski 2y ago
Firefox's Resist Fingerprinting option will do that for you. It's also the default on LibreWolf. https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting https://support.mozilla.org/en-US/kb/firefox-protection-agai...
- uncharted9 2y ago
  Unfortunately, it didn't pass the fingerprint test. You can see the results here: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/. On the other hand, Brave does pass it. I'd like to use Brave for all my browsing, but for some reason the devs haven't been able to get hardware-accelerated video decoding to work in their latest builds. That's why I've been using Librewolf for a very long time.
  - IggleSniggle 2y ago
    I don't buy that cover your tracks applies to the Firefox strategy to privacy. The Firefox strategy is to make your browser incredibly unique every time. If you visit the same website twice, you look very unique but like two totally different visitors. This is effective for real privacy and cover your tracks doesn't account for it well
    - uncharted9 2y ago
      Cover Your Tracks shows this kind of obfuscation strategy as "Randomized Fingerprint", but it only shows it for Brave, not for Librewolf when I tested it. Brave fingerprint is unique but it randomizes, while Firefox doesn't.
      - akimbostrawman 2y ago
        having a unique fingerprint in a group (such as tor browser / resist fingerprint enabling browser) can be better than a individually semi random unique one
      - IggleSniggle 2y ago
OptionOfT 2y ago
The problem with that is that you'll see a massive uptick of bot detection checks.
mike_d 2y ago
> Or is this one of those privacy battles we just have to accept as unwinnable? It depends on what you want to win. There are two types of fingerprinting: - Browser fingerprinting (what you see here): Make sure that your Chrome on Windows behaves like every other Chrome on Windows and it isn't really a bot pretending to be Chrome. This results in you being treated like a real user and getting less CAPTCHAs. - User specific fingerprinting: Determining that your browser is unique among all the browsers the website has seen so that you can be tracked without cookies. The latter is obviously bad. Some people would argue the prior is bad, but it is a LOT of work to make every browser behave like every other browser across operating systems for little privacy benefit.
- TechDebtDevin 2y ago
  Is it bad if I use fingerprinting to track anonymous users so that I can provide them with a great UX without requiring them to give me all their personal details? Or should I only use cookies, that the user might delete? I don't see an issue with either for this purpose.
  - swatcoder 2y ago
    Imagine you sat one of you users down, and explained the details of how your fingerpriting system worked. You explain that their browser has all kinds of little, subtle leaks of information about what software they're using, what operating system they're using, whether it's up to date, what hardware they're running, whether they're in a public space or an office or a home, which city they're in, what ISP they use, how they've configured their monitor and screen, what settings they set in their browser, what language they use at home, etc etc You explain that you can collect all this information without them knowing you were doing it, without them really being able to stop you if they wanted to, and that you can collate it into an identifier that lets you know every time they visit your site even if they don't tell you themselves in some way, and with no way to ask you to stop. And you explain that you do this for them, to make their experience of your site better for them, and harder for them to accidentally break. How do you think they'd respond? To be clear, I'm not asking this as some rhetorical trick. There absolutely are users who wouldn't care in the least, and who might even see you as really clever for doing it. But that's how you can know if it's bad or not. If you think your users would be creeped out or otherwise troubled by it, or might feel like you've invaded their privacy or their right to control their own experience in their own browser, then you already know it's bad. If you think they wouldn't mind, then -- and only then -- maybe it's not.
SoothingSorbet 2y ago
Yes, CanvasBlocker for Firefox does this: https://addons.mozilla.org/en-US/firefox/addon/canvasblocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker e.g. For me it shows a new unique fingerprint each refresh.
- xyzal 2y ago
  Is it not better to set CanvasBlocker RNG mode to 'perisitent', so that for the same domain you get a same fingerprint?
tech234a 2y ago
Another tool on the same site is able to fingerprint using installed browser extensions on Chromium-based browsers: https://browserleaks.com/chrome https://browserleaks.com/chrome
galad87 2y ago
Safari adds some noise to canvas. So the website above will say it's unique, but each time Safari swaps its web process (when you load a different website or a new window or a new tab) it will change to a different one.
- DeathArrow 2y ago
  But tracking a browser does not rely solely on the canvas.
- dngit 2y ago
  Wish all browsers, at least the big ones, would do this by default. It would save regular users like us from fumbling around trying to figure out what works.
akimbostrawman 2y ago
the only way to actually prevent fingerprinting is to never connect. your ip, os, tls cryptographic protocols (or lack there of), screen resolution, mouse speed+movement, keystrokes+keyboard layout and much much more all can be used to fingerprint a user. even the reduction of all these points can be a fingerprint. since most of those are unlikely to actually happen (yet) with the usual dragnet ad surveillance, just using hardened firefox (arkenfox/librewolf/mullvad browser) with a vpn or just tor browser is sufficient.

by dngit 2y ago

Are there any browser extensions or tools that effectively prevent fingerprinting including canvas fingerprinting? Or is this one of those privacy battles we just have to accept as unwinnable?

begueradj 2y ago

https://www.torproject.org https://www.torproject.org

dngit 2y ago
Tor's great if you're okay with browsing the web at "stealth mode" speed! Have you found it practical for everyday use?
DeathArrow 2y ago
TOR hides your IP address. It doesn't protect you from fingerprinting.
- akimbostrawman 2y ago
  wrong https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift
  - DeathArrow 2y ago
    That is a modified browser. TOR network itself doesn't protect people from fingerprinting.
    - akimbostrawman 2y ago
      how would a traffic protocol prevent browser fingerprinting? the closest would be traffic padding which tor does. https://spec.torproject.org/padding-spec/connection-level-padding.html https://spec.torproject.org/padding-spec/connection-level-pa...

jszymborski 2y ago

Firefox's Resist Fingerprinting option will do that for you. It's also the default on LibreWolf. https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting https://support.mozilla.org/en-US/kb/firefox-protection-agai...

uncharted9 2y ago
Unfortunately, it didn't pass the fingerprint test. You can see the results here: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/. On the other hand, Brave does pass it. I'd like to use Brave for all my browsing, but for some reason the devs haven't been able to get hardware-accelerated video decoding to work in their latest builds. That's why I've been using Librewolf for a very long time.
- IggleSniggle 2y ago
  I don't buy that cover your tracks applies to the Firefox strategy to privacy. The Firefox strategy is to make your browser incredibly unique every time. If you visit the same website twice, you look very unique but like two totally different visitors. This is effective for real privacy and cover your tracks doesn't account for it well
  - uncharted9 2y ago
    Cover Your Tracks shows this kind of obfuscation strategy as "Randomized Fingerprint", but it only shows it for Brave, not for Librewolf when I tested it. Brave fingerprint is unique but it randomizes, while Firefox doesn't.
    - akimbostrawman 2y ago
      having a unique fingerprint in a group (such as tor browser / resist fingerprint enabling browser) can be better than a individually semi random unique one
    - IggleSniggle 2y ago

OptionOfT 2y ago

The problem with that is that you'll see a massive uptick of bot detection checks.

mike_d 2y ago

> Or is this one of those privacy battles we just have to accept as unwinnable? It depends on what you want to win. There are two types of fingerprinting: - Browser fingerprinting (what you see here): Make sure that your Chrome on Windows behaves like every other Chrome on Windows and it isn't really a bot pretending to be Chrome. This results in you being treated like a real user and getting less CAPTCHAs. - User specific fingerprinting: Determining that your browser is unique among all the browsers the website has seen so that you can be tracked without cookies. The latter is obviously bad. Some people would argue the prior is bad, but it is a LOT of work to make every browser behave like every other browser across operating systems for little privacy benefit.

TechDebtDevin 2y ago
Is it bad if I use fingerprinting to track anonymous users so that I can provide them with a great UX without requiring them to give me all their personal details? Or should I only use cookies, that the user might delete? I don't see an issue with either for this purpose.
- swatcoder 2y ago
  Imagine you sat one of you users down, and explained the details of how your fingerpriting system worked. You explain that their browser has all kinds of little, subtle leaks of information about what software they're using, what operating system they're using, whether it's up to date, what hardware they're running, whether they're in a public space or an office or a home, which city they're in, what ISP they use, how they've configured their monitor and screen, what settings they set in their browser, what language they use at home, etc etc You explain that you can collect all this information without them knowing you were doing it, without them really being able to stop you if they wanted to, and that you can collate it into an identifier that lets you know every time they visit your site even if they don't tell you themselves in some way, and with no way to ask you to stop. And you explain that you do this for them, to make their experience of your site better for them, and harder for them to accidentally break. How do you think they'd respond? To be clear, I'm not asking this as some rhetorical trick. There absolutely are users who wouldn't care in the least, and who might even see you as really clever for doing it. But that's how you can know if it's bad or not. If you think your users would be creeped out or otherwise troubled by it, or might feel like you've invaded their privacy or their right to control their own experience in their own browser, then you already know it's bad. If you think they wouldn't mind, then -- and only then -- maybe it's not.

SoothingSorbet 2y ago

Yes, CanvasBlocker for Firefox does this: https://addons.mozilla.org/en-US/firefox/addon/canvasblocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker e.g. For me it shows a new unique fingerprint each refresh.

xyzal 2y ago
Is it not better to set CanvasBlocker RNG mode to 'perisitent', so that for the same domain you get a same fingerprint?

tech234a 2y ago

Another tool on the same site is able to fingerprint using installed browser extensions on Chromium-based browsers: https://browserleaks.com/chrome https://browserleaks.com/chrome

galad87 2y ago

Safari adds some noise to canvas. So the website above will say it's unique, but each time Safari swaps its web process (when you load a different website or a new window or a new tab) it will change to a different one.

DeathArrow 2y ago
But tracking a browser does not rely solely on the canvas.
dngit 2y ago
Wish all browsers, at least the big ones, would do this by default. It would save regular users like us from fumbling around trying to figure out what works.

akimbostrawman 2y ago

the only way to actually prevent fingerprinting is to never connect. your ip, os, tls cryptographic protocols (or lack there of), screen resolution, mouse speed+movement, keystrokes+keyboard layout and much much more all can be used to fingerprint a user. even the reduction of all these points can be a fingerprint. since most of those are unlikely to actually happen (yet) with the usual dragnet ad surveillance, just using hardened firefox (arkenfox/librewolf/mullvad browser) with a vpn or just tor browser is sufficient.