Hacker News Reader

Comment by Telaneo | Hacker News Reader

Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.

Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.

View on HN

There are projects that do this already e.g. https://github.com/lwthiker/curl-impersonate

> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard

It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.

That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.

Any idea how iOS’ private browsing impacts fingerprinting?

It doesn’t. Same there

It can make a small difference on this site, though. Testing it with three browsers (Safari, Brave, Firefox Focus) on iOS with Private Browsing on, each gets a different name and hash — then again, those do stick to the browser pretty well after that and are resistant to incognito mode (or session switch by other means), for example, just like you’d expect. On Safari, Private Browsing masks the IP at least, and Brave has its own tricks.

I use private browsing and could not replicate your result, though I have done a few things on my device such as enable developer mode that the OS has warned me decreases my security.

Well, yeah, I’ve turned a knob or two through the years I might’ve easily failed to consider now, as well...

Reply on news.ycombinator.com