Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

Question

I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We're generally scolded about using extensions in it, as they can alter web traffic patterns to or from your browser, adding another fingerprinting vector by distinguishing you from other Tor Browser users.

If JS is turned off even in vanilla Firefox, and I apply modifications to the DOM (like CSS mods, zooming in etc.) after the website has finished loading, I can't see how a website or ISP could detect what the user is doing in the DOM.

I know if you, for example, hide an element in CSS before it is fully loaded (such as the sidebar), the browser may skip downloading resources (such as icons) associated with the element. This would distinguish your web traffic patterns from other users. That's why I wait till the page is fully loaded (Edit: page is loaded in a default 1000x1000 window). I'm also careful to not trigger CSS media queries which can be set up to connect to a remote URL if triggered (or remove them first if they will be triggered).

I think the above should be enough to avoid distinguishing myself by my web traffic. Do you see any way I could be distinguished with only CSS & HTML?

Answer 1

You are assuming that distinguishing yourself from the others will only be done if Javascript is enabled. But, assuming that all but you have Javascript enabled , exactly disabling Javascript might result (depending on the site you visit) in a behavior which is clearly different from the other users.

Apart from that there are HTML features like responsive images or lazy loading where images are loaded depending on the size of the browser window or only when the image gets visible - without any Javascript involved. These can be used for fingerprinting clients and client behavior too.