Hacker News Reader

Comment by Semaphor | Hacker News Reader

I just tried a clean FF profile with resistFingerprinting enabled. No dice. Everything adds only very few bits of identifying information (unlike my main profile which is already almost unique thanks to the accept header (English, then German)) yet it still results in 17.75 bits which according to EFF is unique.

I’m agreeing with you, though I wonder, is there any way to not be unique? What would you have to do? Use Windows with no extra fonts, Chrome in English, on a FullHD monitor with webgl/canvas/audio fingerprinting protection extensions?

View on HN

I believe the only feasible way without bending over backwards is to use the Tor Browser. But privacy and security always come at a price.

Actually, resistFingerprinting + switching to the user-agent string tor uses gets me 99% of the way there. All that’s missing is the weird window size (vertical taskbar), if I could get that to report a default size, I’d actually be better than Tor (they have a bunch of responses slightly more unique than FF with resistFingerprinting).

But it’s academic for me anyway, I have Accept-Language en-US,en;q=0.7,de-DE;q=0.3 which is close enough to unique that nothing else really matters.

> All that’s missing is the weird window size (vertical taskbar)

TBB actually adds a border at the bottom of the browser so the reported size isn't the actual size. If you change the size of your browser window to the tor-reported size then it should work.

Unless I'm misunderstanding and you mean something to do with the scrollbar?

I think a HTML-only browser without support for CSS and JS might help.

How many people do you know run html only browsers? Not having CSS would be extremely uniquely identifying.

Disabling JS is enough to almost perfectly fingerprint you.

Yes and you probably “haven’t watched television in 20 years”.

The EFF has a website that illustrates why that doesn't help:

https://coveryourtracks.eff.org/

Like siblings are saying, they use all available information to fingerprint you.

You can cover your identity only to the extent that you can display the same characteristics to the web server as the largest group of users that have all the same characteristics. This includes whether you have JS disabled as well as your IP address, User-Agent, display resolution, etc.

Reply on news.ycombinator.com