I don't want certain websites to track me, but they don't work without js. I found a few plugins that all require "reading and changing all data on all websites", so I needed something else. I was thinking about coding a tiny python browser or another based on the chromium project, and just configure it not to pass that much data (empty user agents, etc). Also, the second option would've been to find the top 10 fingerprints on web and use them randomly. The downside is I had to get a new IP for every fingerprint change to seem like requests came from different devices. And the easiest way to achieve that is using Tor. But then I still have my unique fingerprint and back to the original problem, right? Does the Tor network do something about this?
When you do not change anything, the Tor browser is already configured in a way that the fingerprint is identical to every other Tor browser (and is close to the most common fingerprint on the web). I recommend to rely on this instead of messing around with it by yourself since there are many possibilities to build a fingerprint. Have a look at the open and closed issues of the Tor browser bug tracker and try to understand the problems.
You could also use Tails via a read-only live medium to get a very high amount of anonymity with reasonable effort.
I cloned this fingerprinting project from github (https://github.com/Valve/fingerprintjs) onto one of my web servers. If I accessed it with a Tor browser I got a notification from the browser that says:
"This website attempted to extract HTML5 canvas image data, which may be used to uniquely identify your computer. Should Tor Browser allow this website to extract HTML5 canvas image data?"
Also, each time I renewed my identity and visited the fingerprinting URL it gave me a unique fingerprint based off screen resolution, so Tor seems to have anti-fingerprinting there as well.
Here is a good write-up about this very subject:
If you are really concerned about tracking I would advise the following:
- Create a VM and run Tor Browser from that
- set the wrong timezone
- use a random user account name
- use a virtual keyboard (this should prevent typing-style/timing fingerprinting).
- set up all outbound traffic to be blocked except for Tor browser and only on ports 80/443 and whatever Tor needs to connect up.
- set the security settings to high
- only enable JS for pages that explicitly need it (via NoScript)
- change identities frequently.
You would probably want to script regular changes to possible operating system identifiers such as exact time, keyboard layouts, MAC address.
Always update frequently and never run flash.
This one seems to do a better job and setting up a new identity does NOTHING.
Here is a list of the sources it uses for fingerprinting:
- Color Depth
- Screen Resolution
- Has session storage or not
- Has local storage or not
- Has indexed DB
- Has IE specific 'AddBehavior'
- Has open DB
- CPU class
- DoNotTrack or not
- Full list of installed fonts (maintaining their order, which increases the entropy), implemented with Flash.
- A list of installed fonts, detected with JS/CSS (side-channel technique) - can detect up to 500 installed fonts without flash
- Canvas fingerprinting
- WebGL fingerprinting
- Plugins (IE included)
- Is AdBlock installed or not
- Has the user tampered with its languages 1
- Has the user tampered with its screen resolution 1
- Has the user tampered with its OS 1
- Has the user tampered with its browser 1
- Touch screen detection and capabilities
I would recommend to take a look at this proof-of-concept tool:
It can fingerprint Tor, Tails and if the user is running the Tor Browser on macOS.