Hacker News Reader

Comment by bobcostas55 | Hacker News Reader

Any tips on fighting browser fingerprinting?

on the topic of chaff, I use an extension that rotates randomly between combinations of {Windows,OS X,Linux}, {Firefox,chrome} and various versions of those things.

though sadly this doesn't work alone, because it only solves the stuff sent to server (but is far more pleasing to screw with them than to just send nothing). you still have to use noscript to stop things like the canvas font rendering trick :(

What is this extension?

I have used user agent switcher in the past. It sounds like the extension that rickycook was referring to.

that still leaves over 100 bits if info on the table, resolution, fonts installed, localstorage, indexed storage, cookies etc.

Does it cycle through user-agents? I could see an extension that rotates through those contributing nicely to creating noise.

The only real bullet proof solution I can think of is to use Qubes (or VMPlayer / VirtualBox on a more common OS) to launch a new VM every browsing session. You loose your browser preferences and bookmarks though. You could organize your bookmarks in a local HTML file so your browser don't "broadcast" them.

Nope. If you're using Qubes you are (as far as an ad network is concerned) a young middle to upper class white male with an interest in technology and computer security who probably lives near the Bay Area or another tech hub (depending on GeoIP). That's exactly what an advertiser would be tracking you to find out, and you just put it in the user agent string.

The only way to defeat browser fingerprinting is for everyone (or a lot of people including you) to use exactly the same version of the same browser on the same platform on the same device configured the same way. Even the, which browser-device-screen resolution-version cohort you are part of probably says a lot about your demographic.

It's easy to hide in 2560x1440 Macs running latest Chrome under Yosemite. Not so much on Ubuntu Phone in middle America.

Couldn't you just use a browser that doesn't send user-agent?

The lack of one itself is a datapoint.

You use a random user agent.

I use this one for example:

https://github.com/dillbyrne/random-agent-spoofer

I do this as well, but there's still plenty of data points available. Have a look here https://panopticlick.eff.org/

If your browser is in a VM how could they know you're using Qubes ? They're gonna get the Linux version that is used in the VM but that's it.

Haven't used it myself but you may want to check out - https://github.com/ghostwords/chameleon

Anonymizing proxy.

get a cryptostorm (or cryptofree) account.

Reply on news.ycombinator.com