4

I don't want certain websites to track me, but they don't work without js. I found a few plugins that all require "reading and changing all data on all websites", so I needed something else. I was thinking about coding a tiny python browser or another based on the chromium project, and just configure it not to pass that much data (empty user agents, etc). Also, the second option would've been to find the top 10 fingerprints on web and use them randomly. The downside is I had to get a new IP for every fingerprint change to seem like requests came from different devices. And the easiest way to achieve that is using Tor. But then I still have my unique fingerprint and back to the original problem, right? Does the Tor network do something about this?

  • The network can't do anything about this since the routing takes place at the transport layer. Fingerprinting is mostly done at the application layer. So I guess you mean the configuration of the Tor browser? – Noir Apr 3 '16 at 21:14
10

When you do not change anything, the Tor browser is already configured in a way that the fingerprint is identical to every other Tor browser (and is close to the most common fingerprint on the web). I recommend to rely on this instead of messing around with it by yourself since there are many possibilities to build a fingerprint. Have a look at the open and closed issues of the Tor browser bug tracker and try to understand the problems.

You could also use Tails via a read-only live medium to get a very high amount of anonymity with reasonable effort.

  • 1
    +1 for mentioning Tails. This is exactly what Tails was intended for - by creating anonymity at the transport layer (via TOR), and by creating anonymity at the application layer (by using a stripped-down browser that returns to its native state after every use). – mti2935 Apr 4 '16 at 0:46
3

The fingerprinting that could be used to identify a browser depends on what features are available. If you're running a bare-bones browser with everything disabled there is very little data to fingerprint off of. Then again, the lack of excessive data would also make your traffic more unique. In the end though, you are going to be opening yourself up a lot by having Javascript enabled.

I cloned this fingerprinting project from github (https://github.com/Valve/fingerprintjs) onto one of my web servers. If I accessed it with a Tor browser I got a notification from the browser that says:

"This website attempted to extract HTML5 canvas image data, which may be used to uniquely identify your computer. Should Tor Browser allow this website to extract HTML5 canvas image data?"

Also, each time I renewed my identity and visited the fingerprinting URL it gave me a unique fingerprint based off screen resolution, so Tor seems to have anti-fingerprinting there as well.

Here is a good write-up about this very subject:

http://www.unhappyghost.com/2015/02/forensics-fingerprinting-defenses-in-tor-browser.html

FTA,

Javascript can reveal a lot of fingerprinting information. It provides DOM objects such as window.screen and window.navigator to extract information about the useragent. Also, Javascript can be used to query the user's timezone via the Date() object, WebGL can reveal information about the video card in use, and high precision timing information can be used to fingerprint the CPU and interpreter speed. In the future, new JavaScript features such as Resource Timing may leak an unknown amount of network timing related information.

If you are really concerned about tracking I would advise the following:

  • Create a VM and run Tor Browser from that
  • set the wrong timezone
  • use a random user account name
  • use a virtual keyboard (this should prevent typing-style/timing fingerprinting).
  • set up all outbound traffic to be blocked except for Tor browser and only on ports 80/443 and whatever Tor needs to connect up.
  • set the security settings to high
  • only enable JS for pages that explicitly need it (via NoScript)
  • change identities frequently.

You would probably want to script regular changes to possible operating system identifiers such as exact time, keyboard layouts, MAC address.

Always update frequently and never run flash.

UPDATE There is a new version of the fingerprinting javascript available: https://github.com/Valve/fingerprintjs2

This one seems to do a better job and setting up a new identity does NOTHING.

Here is a list of the sources it uses for fingerprinting:

  1. UserAgent
  2. Language
  3. Color Depth
  4. Screen Resolution
  5. Timezone
  6. Has session storage or not
  7. Has local storage or not
  8. Has indexed DB
  9. Has IE specific 'AddBehavior'
  10. Has open DB
  11. CPU class
  12. Platform
  13. DoNotTrack or not
  14. Full list of installed fonts (maintaining their order, which increases the entropy), implemented with Flash.
  15. A list of installed fonts, detected with JS/CSS (side-channel technique) - can detect up to 500 installed fonts without flash
  16. Canvas fingerprinting
  17. WebGL fingerprinting
  18. Plugins (IE included)
  19. Is AdBlock installed or not
  20. Has the user tampered with its languages 1
  21. Has the user tampered with its screen resolution 1
  22. Has the user tampered with its OS 1
  23. Has the user tampered with its browser 1
  24. Touch screen detection and capabilities
  • 2
    +1 for mentioning javascript fingerprinting. In truth, Tor Browser is great at avoiding fingerprinting, but if javascript is enabled, there are just so many ways to fingerprint. Your OS version can even be detected based on your math libraries, because different systems give a different result for javascript's cos() routines! – forest Apr 4 '16 at 3:42
-1

I would recommend to take a look at this proof-of-concept tool:

https://github.com/jonaslejon/tor-fingerprint

It can fingerprint Tor, Tails and if the user is running the Tor Browser on macOS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.