Hacker News Reader

Comment by relkor | Hacker News Reader

Is there any solid guide to preventing browser fingerprinting? Or is the only protection constantly changing your accept headers + user agent?

View on HN

Mozilla has documented some of the ways trackers can fingerprint users (in 2010):

https://wiki.mozilla.org/Fingerprinting

The Tor project submitted some of their fingerprinting protection patches to Firefox. They can be enabled by setting the "privacy.resistFingerprinting" about:config pref.

https://bugzil.la/418986 - Bug 418986 - Resist fingerprinting by preventing exposure of screen and system info

And the W3C has shared some information about the obligations of W3C specification authors and working groups of new Web platform features:

http://www.w3.org/wiki/images/7/7d/Is_preventing_browser_fin...

"For day-to-day use, the best options are to run tools like Privacy Badger or Disconnect that will block some (but unfortunately not all) of the domains that try to perform fingerprinting, and/or to use a tool like NoScript for Firefox, which greatly reduces the amount of data available to fingerprinters."

https://panopticlick.eff.org/about#defend-against

Will blocking them at the HOSTS file level decrease exposure as well? My gut says yes, but I wanted to check.

Also, does this test check for that and/or give points for that?

Here is the HOSTS file I use to block ads: http://winhelp2002.mvps.org/hosts.txt

If you're on Linux i recommend 'Hosts-Update'[1], it's a bash script that generates a Host file from multiple sources:

http://adaway.org/hosts.txt http://hosts-file.net/ad_servers.txt http://malwaredomains.lehigh.edu/files/justdomains http://pgl.yoyo.org/adservers http://someonewhocares.org/hosts/hosts http://winhelp2002.mvps.org/hosts.txt http://www.malwaredomainlist.com/hostslist/hosts.txt

[1]: https://github.com/zant95/hosts-update

Yes, our test does work for that and various hosts-based blockers are supported (like AdAway for Android, for example). In order for our test to give accurate results, the host-based blocker has to add our simulated trackers to its block list, which some lists may not have done yet.

Reply on news.ycombinator.com