1

According to EFF's Panopticlick web browser fingerprinting test canvas & WebGL fingerprinting require JavaScript and (at least) screen size, color depth, browser plugins, time zone, language, system fonts, platform and touch support are detected via JavaScript.

Panopticlick results for Tor browser

Newly discovered "cross-browser fingerprinting" appears to rely on JavaScript.

What identifying browser characteristics can be detected without JS and how much information they provide?

Improve this question
3
  • 3
    Disabling Javascript definitely provides the information that you are one of few users which has disabled Javascript and is thus a pretty good fingerprint by itself. Apart from that, there are many questions on this site about reducing the ability of the server to fingerprint and there is lot of overlap of your question with these others. And since you don't restrict yourself to specific features and for an unknown reason are not satisfied with the extensive research by EFF which you even cite I propose to close the question as too broad.
    – Steffen Ullrich
    Commented Jul 3, 2017 at 3:46
  • @SteffenUllrich: With JS enabled "everyone" is unique. Feel free to share additional EFF articles about Javascript's relation to fingerprinting.
    – user598527
    Commented Jul 3, 2017 at 8:01
  • 2
    "No javascript" itself is a special entropy bits: it might make small group of user stand out from the crowd.
    – mootmoot
    Commented Jul 3, 2017 at 8:35

1 Answer 1

Reset to default
3

Without Javascript, the server can only use the remote IP address and the standard HTTP headers. From those, the most informative are:

  • User-Agent: the browser shows its identification here
  • Accept or Accept-Language: the browser declares its prefered language
  • Accept or Accept-Encoding: the browser declares its supported encoding or compression

But, as some servers require those informations and only know a limited range of browsers, uncommon browsers and robots (request sent from non browser programs) often present fake values and pretend to be a firefox or IE browser. Said differently they are not really reliable when javascript is deactivated.

But the absence of Javascript support is a strong indication of a robot or uncommon browser (do you know lynx?), or a user that wants special processing on its browser. In that case, the type of the browser is much less important that the deactivation of javascript. Because as nowadays very few sites can be used without javascript, very few users disable it. As said by Stephen in his comment, the absence of javascript simply gives a fingerprint of no javascript.

Improve this answer
6
  • 2
    "Because as nowadays very few sites can be used without javascript" - I have disabled JavaScript globally for more than three years, but allow JS to run on trusted websites (when beneficial) and web applications. I very rarely encounter sites where the page doesn't load without JS, but some functionality may be limited or broken. Considering that I most often only want to see the article content on a website, breakage doesn't necessarily have any effect on me.
    – user598527
    Commented Jul 3, 2017 at 8:11
  • 1
    @user598527: I meant most site need javascript for full usability so very few users.... I too disable JS for some sites, or even use lynx or wget to be sure to only get the raw content, but my wife never does.
    – Serge Ballesta
    Commented Jul 3, 2017 at 9:26
  • For the longest time graceful degradation and progressive enhancement were heavily favored as a best practice. As a result you could get some user experience ether way. But most did this to cater to those with less modern browsers and not so much if JavaScript is enabled/disabled. As a majority of users move to modern browsers and use JS we could see a trend of outright breakage since most developers want to encourage the end user to use JS. Thus forcing users to use it or whitelist it than go without it completely.
    – Bacon Brad
    Commented Jul 3, 2017 at 19:31
  • The screen orientation, screen resolution, and the screen device pixel ratio can also be detected without javascript. Source: Device Info - https://www.deviceinfo.me
    – Joshua
    Commented Feb 5, 2020 at 21:08
  • @user598527 what to say in 2020 where a big amount of pages has client-side rendering through js frameworks as react, vue, angular, etc?
    – Lucas Vazquez
    Commented May 11, 2020 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .