It seems so powerful, all I need is to have my browser have js with canvas enabled and I can be matched across websites? I know you can disable canvas in firefox, how does one do it in Chrome
Note the fingerprint isn't unique, it's basically a property of your graphics hardware + operating system. If you have a M4 macbook pro, in all likelihood you'll have the same fingerprint as all the other M4 macbook pro users.
>I know you can disable canvas in firefox, how does one do it in Chrome
Bad news. Disabling features is also a fingerprint vector, and having it disabled probably makes you more suspicious. Imagine you're at a border checkpoint that fingerprints you (many countries do that), and your fingerprints were burned off. How do you think the border guard will react?
er... maybe if they're using metamask or something with the viewport pixel WxH set arbitrarily. canvas size/window size, fonts installed (are you a graphic designer or typographer?), who knows what else. the EFF has a site that shows you all the nonsense we can be tracked with.
open safari on a second monitor? at the same time? probably globally unique WxH between the two windows.
i'm unique in their dataset on firefox on a 2k monitor.
looks like my main culprits: useragent, timezone (lol), navigator properties (99.9% unique,) fonts, canvas (100% unique,) screen dimensions (available and .. actual?). all of these showed >99% unique.
I was talking about canvas specifically, since the OP mentioned "js with canvas enabled". The rest can be somewhat mitigated by avoiding configurations that stick out, eg. using a "common" window size (ie. maximized). On firefox you can also use RFP with letterboxing, which rounds windows dimensions to the nearest 100 pixels, and defaults to 1000x1000. However, that's also somewhat suspicious (who perfectly sets their window to multiples of 100?) that you're better off using maximized window + common display resolution + standard taskbar/dock size. RFP also has mitigations for some of the other issues you mentioned, eg. a font whitelist.
I'm just saying it's not as easy as all of that, even on a "computer" using the stock browser.
you'd also have to figure out where most users are in the timezone data as that narrowed my browser down to 95% unique all on its own. (UTC-5)
>you'd also have to figure out where most users are in the timezone data as that narrowed my browser down to 95% unique all on its own.
The best timezone to use is the one that corresponds to your IP info, because it doesn't reveal anything about you. You'd expect 95+% of users with a Californian geo ip to be on pacific time, for instance. Using anything else makes you stick out like a sore thumb.
Statistics like "95% unique" also make little sense. Being able to identify you as one out of 400 million people (5% * world population) seems... fine? You can get better targeting through geoip/latency measurements, for instance. If you use a VPN in California, that narrows you down to 1 in 39 million people.
i understand what you're saying, of course.