Hacker News Reader

You have lots of signals to generate without JS. System font base (this alone should provide a fairly unique identifier!), screen aspect ratio, DPI value, "pointer" media query, the relationship between width/device-width... and on non-TOR-scenarios you can fingerprint supported HTTPS encryption layers plus the user-agent. Oh, and you can also passively fingerprint on the presence of an ad blocker.

View on HN

If you can identify _a single person_ on the TOR network with the TOR Browser, across several sessions, just with the data you are describing and without false positives, it will probably make a case but those attacks are well-know since 2k8 and so far no one has made the same claims you firmly believe, so unless you know something that no-one in the world, then for the common "TOR user", those who use the integrated TOR Browser are in good standing just by disabling JS alone. If you are THAT paranoid, you should already know that you shouldn't use the integrated browser itself, since you are loosing half the battle just there by giving your adversaries a well-known attack vector.

Reply on news.ycombinator.com