Hacker News Reader

Comment by Cider9986 | Hacker News Reader

Being fingerprinted across Tor is different from being deanonymized—it basically just "psuedonomizes" you. You now have an identifier. It is a significant threat, but it is not hard to "psuedonomize" someone based on stylometry and some of the people with the highest threat model—operating an illegal site, will be pseudonymous anyway.

Don't get your opsec advice from HN. Check whonix, qubes, grapheneos, kicksecure forums/wikis. Nihilist opsec, Privacyguides.

View on HN

This fingerprint persists over private and non-private Firefox sessions until you restart Firefox. State actors might be able to connect your Google-login in FF window 1 with your tor session in FF private window 2.

Good opsec usually means you don't do this anyway. Don't use your anonymous browser for anything related to your real persona. In fact, don't re-use the OS between anonymous and public personas. Or even better: Don't re-use the hardware (also goes for networking). There will always be bugs across all levels of software and hardware that could eventually be chained to expose you. But if there is nothing there that could be exposed, you're already much better off by default. Even if that is very hard to achieve in practice.

Usually you have TOR browser for TOR and a standard Firefox for the standard browsing so they already are two sessions.

No, fingerprinting is a synonym of deanonymization.

No. If everyone (or browser installs) had identical fingerprints... Good luck deanonymising them.

Reply on news.ycombinator.com