Browser Fingerprinting: How to Stay Private

There are two approaches to dealing with fingerprinting I've seen. The first is to hand over a ton of data to fingerprinters but try to get your fingerprint to match a lot of other people's so you can "hide in the crowd". This is what TOR browser does and it seems extremely fragile and unlikely to work since it's a never-ending game of whac-a-mole where you have to account for every single possible thing that could ever possibly make your fingerprint different for it to be effective.

The other approach is to try to provide as little information as possible with much of that information being inconsistent so that your fingerprint is always unique across sessions/requests. This seems a lot easier. Simply disabling javascript by default does most of the work for you. You'll still have anything sent over in HTTP headers to worry about (and that can be randomized), but hardened firefox with JS disabled should make most of the data used to fingerprint your browser inaccessible.

See for example: https://github.com/fingerprintjs/fingerprintjs

They evade ad-blocking easily by using custom domains or by distributing the script using popular sites like Github, NPM, etc; This makes extensions like NoScript necessary.