73

Whenever I maximize the Tor browser, it shows a warning:

Maximizing Tor Browser can allow websites to determine you monitor size, which can be used to track you...

How can screen resolution or monitor size be used to track a person?

  • Unfortunately I can not find it anymore, but a while ago there was some site that was trying to generate a fingerprint from all it could gather about you, not only the screen resolution. It was telling you how many different systems with that fingerprint it already saw. I was never able to find any configuration that was not unique ... – PlasmaHH Oct 9 '15 at 10:40
  • 3
    @PlasmaHH probably the EFF Panopticlick: panopticlick.eff.org – Cosmic Ossifrage Oct 9 '15 at 13:08
  • 1
    @CosmicOssifrage: Yep, that looks like it. Quite useful to get an idea for these informations. – PlasmaHH Oct 9 '15 at 13:13
  • 1
    @PlasmaHH: Visited the website, took the test. Yes, the "fingerprint" they extracted is unique... to the point of being useless for tracking. The reason that real world fingerprints are useful is because they stay with a person through one's whole life. The panopticlick "fingerprint" changes with every browser patch. – Ben Voigt Oct 9 '15 at 17:26
  • I think that this question can be better if you ask why you can be tracked by any screen size if you don't have JavaScript enabled – Freedo Oct 16 '15 at 22:29
60

All Tor browser users are asked to surf pages using the default window size. So if you follow this practice, you are just like other users; I mean the screen resolution won't be used as a factor to identify you.

From here, you can read an interesting comment that fits your question:

Using an unusual screen resolution was sufficient to identify me uniquely to panopticlick. With my portrait mode screen resolution of 1200 wide by 1920 high, the default window size of 1000x1765 was unique, no resizing or maximizing needed.

Visit browswerspy webpage that implements a demo where you can find out information about your screen including width, height, DPI, color depth, font smoothing.

Conclusion: do not distinguish yourself from others. Act as everybody else.

| improve this answer | |
  • 3
    The real question is, why couldn't Tor return a "fixed screen size" to the javascript requesting the screen sizes even when you have it maximized? Why doesn't Tor implement standard Tor Pixels that are the same throughout all users regardless of whether you have it maximized or not? – Pacerier Oct 8 '15 at 6:58
  • 11
    @Pacerier That would require a bit more tooling within the browser, not just regarding how the network traffic is handled. If Tor had its own browser, of course, this would be perfectly doable -- but that's a rather tall order, and that browser itself would instantly become a much more interesting target than Tor currently presents (the slightest mistake within a "Tor browser" would be a much more certain fingerprint/giveaway than a particular screen resolution). – zxq9 Oct 8 '15 at 7:04
  • 7
    @Pacerier Because generally people expect webpages to adjust to fit their screen... – user253751 Oct 8 '15 at 7:55
  • 3
    @immibis That adjustment could be done by the browser reflowing the content to match the window size without the JS ever getting the window size. – Reinstate Monica Oct 8 '15 at 20:40
  • 2
    It's also possible to determine browser viewport size by setting up list of CSS media queries to load different image url for all possible viewport sizes and even combine that with other media types like color capabilities and DPI. – Māris Kiseļovs Oct 9 '15 at 5:00
44

Perhaps it's worth mentioning that the impact of resizing your browser on your privacy heavily depends on what window size you set. Maximizing Tor browser on a screen with a standard resolution like 1280x1024 or 1080p is not too bad - lost of people have screens like that, and you probably won't end up being the only one with that resolution. The adversary will still be able to tell that you're running Tor on a desktop PC rather than laptop - those often have WXGA resolution, or something model-specific which is worse if you want to stay private.

The worst thing you can do is to resize the Tor browser manually to a random size instead of maximizing it. The adversary won't have a clue about the hardware you're running on, but you will probably be the only person with that browser size on each site you visit. This means your activity can be tracked - the adversary will know that sites A, B and C were visited by the same person (you), despite the fact that Tor used three different IPs to access those sites.

EDIT: One thing I would like to add here: running a browser with JavaScript support with Tor is something I wouldn't do at all. Screen size aside, JavaScript provides numerous options for tracking. For example, Google is able to distinguish users from bots by the way you click on a button, and that same algorithm could probably be tuned to identify individual users as well.

| improve this answer | |
  • 5
    Best answer IMO... No one is going to be able to track you if you are using one of the 3 or 4 standard screen resolutions. Random window sizes, however, would be very unique. – JPhi1618 Oct 8 '15 at 13:10
  • 4
    Supposing that the sizing of your toolbars and window decoration matches that of everyone else. – Ángel Oct 8 '15 at 22:17
  • @Ángel, this is a valid remark, but I expect this to be the case across different Tor browser versions. One can certainly customize his instance at the cost of their privacy. – Dmitry Grigoryev Oct 9 '15 at 7:47
  • 2
    @DmitryGrigoryev it's not about the toolbars of the browser, but rather the graphical user interface configuration of the operating system the browser is running on. People usually have some sort of task bars and monitors at the sides of the screen, and window decoration differs because of different operating systems, window managers and their themes... – dbanet Oct 11 '15 at 9:19
13

Client-side code (JavaScript) on a web site you visit has access to screen resolution and other settings. Often the combination of these settings are unique enough to match your current session (which may be protected by tor) with some other session that is not protected by Tor. Following the fingerprint analogy, if you use Tor but have a non-default window size, it can be unique enough that it is like you are leaving a fingerprint at a web site you visit. And with that fingerprint, they can track you to other web sites.

| improve this answer | |
  • 2
    The Tor browser masks your screen resolution by saying it's the same as your browser window size. – Mark Oct 7 '15 at 19:02
  • 1
    @Mark - doesn't that make it more fingerprintable? Most people don't have consistent browser sizes unless they're maximized, and even a maximized window is quite informative since it won't include your taskbar and related items, all of which can vary in size (icon size, multiple rows, etc). – Adam Katz Oct 7 '15 at 22:34
  • 7
    @AdamKatz, it makes it easy to detect the use of the Tor browser. It makes it very difficult to tell users of the Tor browser apart, because the Tor browser starts up with a standard window size. – Mark Oct 7 '15 at 22:40
  • 6
    And detecting use of the Tor browser is already easy (the list of Tor exit nodes is public for one thing). Tor does not attempt to hide the fact that you are using Tor; it just tries to make you look as much like any other Tor user as possible. – Zach Lipton Oct 8 '15 at 3:36
  • The Tor browser itself is the largest threat to Tor. – zxq9 Oct 8 '15 at 7:06
2

... and just to clarify "track": if you go from their page X to their page Y, they can tell that somebody with the same resolution visited both pages, and maybe with enough information (see @Begueradj answer above) they could even guess correctly whether or not it was the same person.

... and "they" is the web host: If you then go to somebody else's page A, then the process starts over with that new somebody else.

... but they wouldn't necessarily know (from that alone) who that person was. They can't really track you across different web sites (unless they host both sites), and they'd need to piece together with something else to figure out who it actually was. Though the three different IP addresses might tell them it's a TOR user.

| improve this answer | |
  • 2
    The way you have written this answer makes it very difficult to read. Can you re-write this to make direct statements related to the questions? – schroeder Oct 8 '15 at 15:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.