Test browser for web tracking – EFF | Hacker News Reader

Test browser for web tracking – EFF

coveryourtracks.eff.org

95 points_cnhi24 comments

It's scary how much information browsers give out for free, I wish I could use a browser that completely blocks and limits fingerprinting but nowadays I can barely watch YouTube or completing an online purchase flow with ad-blockers enabled

I know what you mean. One thing I'm trying to get into the habit of doing is using yt-dlp to pull videos from YouTube so I don't have to use their website, and I have _YT premium_ ffs -- it's just nasty.

Tor Browser is really good at this. It was designed for the purpose of limiting tracking, both by IP and fingerprinting. Every user that downloads and runs Tor Browser looks perfectly identical to any website they visit, and hitting the button to reset your identity truly does that. Downside is it's really slow compared to just using your network directly, but that's the price you have to pay for privacy atm.

One thing that is important in keeping this "identical" browser appearance to potential trackers is not changing the size of the browser window once you open Tor.

Hasn't this largely been fixed? I remember reading about how the tor browser would fake its window size to be from a predefined set that's somewhat near your current window size

That's correct, if you resize the window you can see the page area switching between the predefined sizes.

Yeah, it does a pretty good job at letterboxing. It doesn't make Tor perfect, even if you wipe your identity, if you have a less common predefined size and go back to the same URL, they can probably track you as the same user, especially if combined with things like canvas fingerprinting, but if you set Tor to the safest setting, which disables JavaScript, you are completely safe.

TIL about a combination of supposedly innocuous, non-unique information my browser is sending out which, _in combination_, may identify me uniquely, or close-to-uniquely.

My test results say:

> Your browser fingerprint appears to be unique among the 187,426 tested in the past 45 days. > > Currently, we estimate that your browser has a fingerprint that conveys at least 17.52 bits of identifying information.

... and that's _at least_. It might be double that or more if all the information I'm sending out is orthogonal.

"Bits of identifying information: 4.37"

"Our tests indicate that you have strong protection against Web tracking."

Thank jeebus. If all of my effort of setting the preferences to block everything and running uBO showed as anything else, I'd be depressed more than pissed.

I've long since given up trying to remove the fingerprint completely, best I can do is limit it and just add noise where they (hopefully) don't expect it.

I’m not sure I agree with the calculation. Basically they use each variable as independent when they are by nature not - as in if you have iPhone in the headers, you’ll probably have certain ram and gpu hashes. So those aren’t necessarily fully independent bits of info.

Oh, no, they treat the variables as fully dependent. That's why they take the maximum over the fields, not the sum nor some kind of \Prod_i(1-p_i) - type thing.

It doesn’t take the maximum. It says I have 14.53 bits of identifying information, however the max listed is my time zone offset providing 8.24 Bits of identifying information.

Remember that trying to make a browser like Chromium or Firefox hard to fingerprint is harder than it seems.

There's a lot of stuff you need to change, including fonts, screen resolution, system memory, user agent details (some browsers also add Sec-CH-UA strings), timezone, along with things like WebGL fingerprinting etc

It's also worth noting that you can sometimes actually make yourself more fingerprintable by not properly hiding something, like changing your UA in HTTP requests but not in JavaScript as well. If a website detects such a "quirk", it would be able to fingerprint you with a lot more precision.

TL;DR If you really want to stay anonymous and not worry about fingerprinting and trackers — use Tor Browser. It was specifically designed so that everyone has the same fingerprint, and has things like letterboxing to hide resolution etc. It's unlikely you'd be able to do a better job than Tor Browser by modifying your own browser.

Using MS Edge on Linux really helped make my user agent unique.

  Our tests indicate that you have you have strong protection against Web tracking.

  Your browser fingerprint appears to be unique among the 191,640 tested in the past 45 days.

  User Agent
  w3m/0.5.3+git20230718
  Bits of identifying information: 17.55
  One in x browsers have this value: 191640.0

So I have strong protection by being basically unique? Not sure what this means.

I think it's saying, hey you tried and it's better than most

I think you might have missed where it says if your browser is blocking tracking ads and invisible trackers. At least for me I got the same "strong protection" message and unique fingerprint, but it did indicate that I'm blocking both of the aforementioned.

I quoted only parts of the page. My point is, when being unique while being strongly protected, am I really protected?

Well the question at that point is, protected from whom? Security is never a binary state, it can only be assessed relative to a given threat model. I'd say that being protected from all the sites that don't use fingerprinting scripts is certainly better than not. If fingerprinting is a concern to you though grab a factory default iPhone, should be pretty a pretty common fingerprint.

>Currently, we estimate that your browser has a fingerprint that conveys 11.02 bits of identifying information.

Javascript disabled and the result page doesn't even load. Does that mean I win?

nope, just inconvenienced

I have Javascript disabled on an Android phone and it loaded for me. There were several full page loads before I got to the results but I just waited.

Reply on news.ycombinator.com