Circumventing Device Fingerprinting

Question

Regarding the concept of device (browser) fingerprinting, would it be possible for the user to spoof fingerprinting data by giving random information such that your fingerprint changes after every request?

If so, are there any plugins/browsers that have this capability?

Answer 1

As far as I can see, you can easily spoof all of the fingerprinting data, and potentially change it with every request. All this information is sent by your browser in the HTTP headers of the request (or obtained via browser client-side scripts). I am not aware of a particular plugin that supports this fully, but there are some plugins for changing your user-agent, manipulating headers and managing cookies. The user-agent is one of the main identifying pieces of information of the fingerprinting process and most other pieces are in other various headers. Blocking javascript/flash scripts is also possible, e.g. using the noscript plugin

Changing this fingerprinting info however does come with a price. It might cause the website to display pages in a different way, which will cause the site to look wrong or not to function properly. Lots of website developers rely on (at least some of) this fingerprint information in order to make the pages they display compatible with your browser. Hiding/spoofing this info will therefore affect this process and your browsing experience may be altered.

It's also possible that this fingerprinting is performed for legitimate security reasons. For example, a security-aware website might tie in the fingerprint info to the session or logged-in user, and will reject requests where the fingerprinting doesn't match (this would suggest to the server a request is now coming from a different browser). Here's one more example from another question where the website owner wants to test browser plugin versions of your browser (which is part of the fingerprinting data) before allowing access. I don't know of any specific sites that use this technique, but it is definitely feasible. Changing fingerprint data with every request will again cause unwanted behaviour.

I suppose that performing some minor randomized tweaks to specific headers will achieve a better degree of anonymity against fingerprinting without compromising the browsing experience. This requires some experimentation and will probably mean a compromise between security and usability.

Answer 2

Yes, it's probably possible. However, I don't know of any browsers or plugins that support spoofing the fingerprint or making it change on every request.

If you are trying to protect your anonymity and protect yourself against fingerprinting, I would suggest a combination of Tor (install it via the Tor bundle), possibly along with NoScript.