These are the results for the Panopticlick test on Tor Browser that I just performed:

  • Is your browser blocking tracking ads? Partial protection
  • Is your browser blocking invisible trackers? Partial protection
  • Does your browser unblock 3rd parties that promise to honor Do Not Track? No
  • Does your browser protect from fingerprinting? No, your browser has a unique fingerprint

I am surprised at these findings, especially since I was under the impression that Tor Browser does not provide fingerprinting data unless you accept it, or that it would be good at blocking trackers.

Why would it perform so poorly? Is it better to add anonymising add ons to regular browsers and use them instead?

  • Tor is more than just a browser, it provides network encryption and anonymity. Using other browsers with Tor's network functionality will leave your real IP exposed. – Neil Smithline Dec 20 '15 at 17:47
  • I'm not sure that we can answer this, and answers will be highly opinion-based. – schroeder Dec 20 '15 at 21:24
  • Your results differ from my own tests of the Tor Browser (which indicate that the browser does not have a unique fingerprint). Can you confirm that you are using the latest Tor Browser Bundle? – Austin Hartzheim Dec 21 '15 at 3:15

Bits of identifying information

The quality of a fingerprint is measured by the number of "bits" of identifying information. The more bits of information your fingerprint contains, the more reliably your device can be distinguished from other devices.

These bits of information are obtained by testing how your browser behaves in different situations. For example, whether or not cookies are enabled provides one bit of information (either they are enabled, or they are not enabled).

If we assume that the testable behaviors are evenly distributed, then any configuration with n bits of information occurs with probability 1/2^n.

However, the actual math surrounding this becomes somewhat more complicated due to certain settings being more popular. For example, most users have cookies enabled because that is the default in their browser; therefore, having cookies enabled does little to distinguish you from other users. But, if you are the rare person with cookies disabled, you will be more identifiable.

Does the Tor Browser allow fingerprinting?

It is impossible to not provide any fingerprinting information because the information is collected as a boolean value: either your browser supports a feature or it does not. However, it is possible to reduce the uniqueness of that information by trying to match other users.

If you look at the user agent information in Panopticlick while using the Tor Browser, you will notice that it is pretending to be installed on the Windows operating system even when it is running on a Linux. This is because Windows is currently the most prevalent operating system worldwide. Thus, it provides the least amount of "uniqueness" to your fingerprint.

Furthermore, it is more important for Tor users to all appear identical than it is to attempt to match another fingerprint. This is because it is possible to identify that someone is using Tor by the IP address that is connecting to a website. Thus, the fact that they are a Tor user is impossible to obscure. However, if all Tor users have the same fingerprint, it remains impossible to tell which Tor user connected to your website.

Does installing add-ons help?

It depends on whether you are installing add-ons into a normal browser or the Tor Browser:

  • The Tor Browser: Probably not. If an add-on you install disables one feature in the Tor browser and nobody else installs this add-on, you will be the only user on the Tor network with this fingerprint. However, if the add-on is included in the Tor Browser for every user, then it might be possible to change your fingerprint characteristics for the better.
  • A Normal Browser: Yes, privacy add-ons can provide an enhancement over the browser's default configuration. However, the Tor Browser is better overall because it contains many modifications that are too difficult to perform via add-ons alone. Additionally, the Tor Browser has protection against more than just device fingerprinting.
  • Panoptclick is saying that the OP's browser doesn't look like any other Tor browser, that it's unique. I believe the OP is asking why using Tor doesn't provide a fingerprint that look like other Tor browsers. – Neil Smithline Dec 21 '15 at 4:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.