How well Tor protects against fingerprinting?

Question

I don't want certain websites to track me, but they don't work without js. I found a few plugins that all require "reading and changing all data on all websites", so I needed something else. I was thinking about coding a tiny python browser or another based on the chromium project, and just configure it not to pass that much data (empty user agents, etc). Also, the second option would've been to find the top 10 fingerprints on web and use them randomly. The downside is I had to get a new IP for every fingerprint change to seem like requests came from different devices. And the easiest way to achieve that is using Tor. But then I still have my unique fingerprint and back to the original problem, right? Does the Tor network do something about this?

Answer 1

When you do not change anything, the Tor browser is already configured in a way that the fingerprint is identical to every other Tor browser (and is close to the most common fingerprint on the web). I recommend to rely on this instead of messing around with it by yourself since there are many possibilities to build a fingerprint. Have a look at the open and closed issues of the Tor browser bug tracker and try to understand the problems.

You could also use Tails via a read-only live medium to get a very high amount of anonymity with reasonable effort.

Answer 2

The fingerprinting that could be used to identify a browser depends on what features are available. If you're running a bare-bones browser with everything disabled there is very little data to fingerprint off of. Then again, the lack of excessive data would also make your traffic more unique. In the end though, you are going to be opening yourself up a lot by having Javascript enabled.

I cloned this fingerprinting project from github (https://github.com/Valve/fingerprintjs) onto one of my web servers. If I accessed it with a Tor browser I got a notification from the browser that says:

"This website attempted to extract HTML5 canvas image data, which may be used to uniquely identify your computer. Should Tor Browser allow this website to extract HTML5 canvas image data?"

Also, each time I renewed my identity and visited the fingerprinting URL it gave me a unique fingerprint based off screen resolution, so Tor seems to have anti-fingerprinting there as well.

Here is a good write-up about this very subject:

http://www.unhappyghost.com/2015/02/forensics-fingerprinting-defenses-in-tor-browser.html

FTA,

Javascript can reveal a lot of fingerprinting information. It provides DOM objects such as window.screen and window.navigator to extract information about the useragent. Also, Javascript can be used to query the user's timezone via the Date() object, WebGL can reveal information about the video card in use, and high precision timing information can be used to fingerprint the CPU and interpreter speed. In the future, new JavaScript features such as Resource Timing may leak an unknown amount of network timing related information.

If you are really concerned about tracking I would advise the following:

• Create a VM and run Tor Browser from that
• set the wrong timezone
• use a random user account name
• use a virtual keyboard (this should prevent typing-style/timing fingerprinting).
• set up all outbound traffic to be blocked except for Tor browser and only on ports 80/443 and whatever Tor needs to connect up.
• set the security settings to high
• only enable JS for pages that explicitly need it (via NoScript)
• change identities frequently.

You would probably want to script regular changes to possible operating system identifiers such as exact time, keyboard layouts, MAC address.

Always update frequently and never run flash.

UPDATE There is a new version of the fingerprinting javascript available: https://github.com/Valve/fingerprintjs2

This one seems to do a better job and setting up a new identity does NOTHING.

Here is a list of the sources it uses for fingerprinting:

1. UserAgent
2. Language
3. Color Depth
4. Screen Resolution
5. Timezone
6. Has session storage or not
7. Has local storage or not
8. Has indexed DB
9. Has IE specific 'AddBehavior'
10. Has open DB
11. CPU class
12. Platform
13. DoNotTrack or not
14. Full list of installed fonts (maintaining their order, which increases the entropy), implemented with Flash.
15. A list of installed fonts, detected with JS/CSS (side-channel technique) - can detect up to 500 installed fonts without flash
16. Canvas fingerprinting
17. WebGL fingerprinting
18. Plugins (IE included)
19. Is AdBlock installed or not
20. Has the user tampered with its languages 1
21. Has the user tampered with its screen resolution 1
22. Has the user tampered with its OS 1
23. Has the user tampered with its browser 1
24. Touch screen detection and capabilities