How to fight browser fingerprinting?

Question

https://panopticlick.eff.org/ , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via java and flash, but the linked pdf also points out that disabling these common plugins actually just adds to the uniqueness, as well as simply altering the User Agent. Font detection is also seems possible via css introspection.

What steps can one take, what technology options do exists to counter-measure fingerprinting of one's browser?

Answer 1

During fingerprinting, the following are taken:

1. IP address / subnet / country / region
2. User Agent
3. Other HTTP headers

Now, for IP address, you can use:

• Tor
• I2P
• Public VPN service like OpenVPN, where many others users are as well it is having nodes across multiple networks

For User-Agent:

• Online anonymous proxy
• Your own proxy server, which does set User-Agent and some common headers
• Browser plugin which modify headers
• Browser plugin, which runs browser on remote, anonymity service

BUT, you will always be fingerprinted and identified in some way. It is because you normally connect from the same subnet, and you use the same browser. So to avoid these two, is really hard, because you would need VPN servers on endless number of networks, as well User-Agent generator, and header obfuscation, which does set different values each day, or each time you start it.

I for myself, I use Amazon EC2 free micro instance with free OpenVPN server, and it does self-stop and self-start every day in different region (by itself, it boots new server with a script to set it up thru AWS API), and updates DNS via Route 53 API. It is using SQUID as proxy, and there are many rules to block advertising, tracking as well some other things. It has also full BGP table, as these VPN servers are working in the network, but you dont need this, if you are not making cover-up.

You can also make EC2 instance change it's IP address without actually rebooting it. You can use AWS API to release Elastic IP and allocate a new one, and add to it. If you change User-Agent at the same time, you will avoid fingerprinting.

http://aws.amazon.com/

http://aws.amazon.com/articles/1346

http://www.squid-cache.org/

See this for example:

https://calomel.org/squid_ua_random.html

And indeed, with different IP number and user-agent every day, Google cant recognize me, so I can see ads which are not "tracking me".

ps. When you add new instance, you need at least 20GB of EBS root volume. Then you just do yum install squid or apt-get install squid, configure it thru /etc/, and there you go. If you want to change IP address, just change Elastic IP on it - it does work in both ways - the way you can access new instance or you get to the internet.

And then you will need only this:

http://openvpn.net/

Don't forget to update instance once a while yum update

I could produce maybe AMI image, which would work automatically. Simply you just launch instance, it setups OpenVPN, and thru AWS API it would configure IPs, DNS as well SQUID etc. Maybe there are some AMIs at Amazon already.

See this:

http://n00dlestheindelible.blogspot.co.uk/2010/05/secure-anonymous-browsing-with-your-own.html

Some websites will complain that you work over VPN. For example, some sites which serve music or video. While most of sites works OK, there are just few exceptions.

Answer 2

The fingerprinting technology used by the EFF is nothing but the "normal" Javascript functions used by web sites to, well, operate properly. It is possible to report untrue information to the outside, but then you'd risk either "falling behind":

• the untrue information you would need send along changes and yours doesn't, making you unique -- and suspicious;
• the detection techniques change, and you aren't aware of it, so become unique again;

or having a really awkward navigation.

Assuming that you can use TOR or a VPN or an openshell anywhere to tunnel away your IP address, the "safest" practice in my opinion would be to fire up a virtual machine, install a stock Windows Seven on it, and use that for any privacy-sensitive operation. Do not install anything unusual on the machine, and it will truthfully report to be a stock Windows Seven machine, one between a horde of similar machines.

You have also the advantage of the machine being insulated inside your true system, and you being able to snapshot/reinstall it in a flash.

This can be very useful, in that you could keep a "clean" snapshot and always restore it before sensitive operations such as home banking. Some VM's also allow 'sandboxing', i.e., nothing done in the VM will actually permanently change its contents -- all system changes, malware downloaded, virus installed, keyloggers injected, disappear as soon as the virtual machine is powered down.

Any other technique would be no less intrusive, and would entail a considerable work on the browser or on some kind of anonymizing proxy designed not only to sanitize your headers and your Javascript responses (as well as the fonts!), but to do it in a credible way.

In my opinion, not only would the total amount of work be the same (or even more), but it would be a much more complicated and less stable kind of work.

Install the most common OS, keep to the bundled browser and software, resist the temptation of pimping it, and what's to tell that machine from literally hundreds of thousands of similar just-installed, never-maintained, computers-are-not-my-thing machines on the Internet?