Bits of identifying information
The quality of a fingerprint is measured by the number of "bits" of identifying information. The more bits of information your fingerprint contains, the more reliably your device can be distinguished from other devices.
These bits of information are obtained by testing how your browser behaves in different situations. For example, whether or not cookies are enabled provides one bit of information (either they are enabled, or they are not enabled).
If we assume that the testable behaviors are evenly distributed, then any configuration with
n bits of information occurs with probability
However, the actual math surrounding this becomes somewhat more complicated due to certain settings being more popular. For example, most users have cookies enabled because that is the default in their browser; therefore, having cookies enabled does little to distinguish you from other users. But, if you are the rare person with cookies disabled, you will be more identifiable.
Does the Tor Browser allow fingerprinting?
It is impossible to not provide any fingerprinting information because the information is collected as a boolean value: either your browser supports a feature or it does not. However, it is possible to reduce the uniqueness of that information by trying to match other users.
If you look at the user agent information in Panopticlick while using the Tor Browser, you will notice that it is pretending to be installed on the Windows operating system even when it is running on a Linux. This is because Windows is currently the most prevalent operating system worldwide. Thus, it provides the least amount of "uniqueness" to your fingerprint.
Furthermore, it is more important for Tor users to all appear identical than it is to attempt to match another fingerprint. This is because it is possible to identify that someone is using Tor by the IP address that is connecting to a website. Thus, the fact that they are a Tor user is impossible to obscure. However, if all Tor users have the same fingerprint, it remains impossible to tell which Tor user connected to your website.
Does installing add-ons help?
It depends on whether you are installing add-ons into a normal browser or the Tor Browser:
- The Tor Browser: Probably not. If an add-on you install disables one feature in the Tor browser and nobody else installs this add-on, you will be the only user on the Tor network with this fingerprint. However, if the add-on is included in the Tor Browser for every user, then it might be possible to change your fingerprint characteristics for the better.
- A Normal Browser: Yes, privacy add-ons can provide an enhancement over the browser's default configuration. However, the Tor Browser is better overall because it contains many modifications that are too difficult to perform via add-ons alone. Additionally, the Tor Browser has protection against more than just device fingerprinting.