Hacker News Reader

Comment by notjtrig | Hacker News Reader

When you use tor it says not to maximize the window because sites can use your screen resolution to track you. More realisticly they could match operating system from the user agent with other data. I remember chrome being acused of putting serial number like strings in the user agent. Why would they not?

View on HN

These are the basic basics for tweaking FF's about:config. There are many more. Try these and see how you fare...

layout.css.visited_links_enabled set to false; geo.enabled set to false; media.navigator.enabled set to false; media.peerconnection.enabled (WebRTC) set to false; network.http.sendRefererHeader set to 0; privacy.resistFingerprinting set to true; privacy.firstparty.isolate set to true; network.dns.disablePrefetch set to true; network.prefetch-next set to false; webgl.disabled set to true

Don't forget to also use something like uBlock Origin, Token Tracker Stipper, and Decentraleyes. Pass is all through a Pi-hole and VPN and you're pretty safe. Make sure your VPN does not expose your NAT'd IP with WebRTC. Both uBlock Origina and ScriptSafe can help with this, as FF will sometimes crap all over its about:config settings with updates.

A VPN does not offer privacy-by-design, it's at best a privacy-by-policy product.

Note that this also has some insane side effects, eg setting resist fingerprint also breaks anything that assumed JavaScript date objects actually reflect local time. Like Gmail. Surprise!

FF also has an extension for always opening Facebook in an isolated container: https://github.com/mozilla/contain-facebook

Wouldn't a randomly sized window be more unique than a fullscreen resolution (of which there are probably only a handfull of common ones)?

The idea is to keep the same standard unmaximized window size across all TOR Browser users. Yes, a randomly sized window is worse than full screen, which is worse than the TOR-standard size.

Completely agree. And moreover they don’t need to match you with 100% level of confidence. Even something as low as 10% is probably enough.

Reply on news.ycombinator.com