2

I'm developing a browser based on Google Chromium and keeping in mind that privacy is freedom; but I need to know how to protect my browser's users against fingerprinting.

I was thinking about intercepting requests associated with fingerprinting, such as requests for:

  1. Browser plugin details and user agent string
  2. HTTP_ACCEPT headers
  3. Screen size and color depth
  4. Time zone and system fonts

And always sending the same (fake) response. I want to do this without breaking anything for the end user.

For instance, if a user tries to watch a video in full screen, and the site asks for screen size to resize it properly, the browser would send a fake screen size, but would actually display it at the true screen size.

Is this even possible? Is it actually possible to intercept these requests and hide this information without making the site not work properly?

5

Yes, it's possible, but it's a lot harder than you think, and you'll end up breaking some things no matter what. To take your full-screen video example, it's not the website that asks for the screen size, it's Javascript running on a web page, and you can't know at the time of the request if it's going to use the size to adjust a video, or to fingerprint the browser.

The Tor browser bundle attempts to do this with reasonable success. I recommend studying it to see how it works, and how it can be improved upon.

  • There is always Canvas fingerprinting, though a lot of security solutions provide workaround now. – billc.cn Jan 4 '15 at 10:41
  • The usual workaround is to disable reading from a Canvas surface. – Mark Jan 4 '15 at 11:01
  • @Mark Can you narrow my search on the code of Tor browser? What exactly i'm looking for in the code ? I never read about tor doing that but thanks knowing it is possible i can throw more effort – Freedo Jan 6 '15 at 3:59
  • @Freedom, I'd start by reading the documentation before looking into the code. – Mark Jan 6 '15 at 4:38
0

I just found a open-source extension for firefox RAS since it's open source you can dig into the code and port it to any platform should you want... I've tested this plugin for a time for Firefox and as long you don't spoof mobile browsers on pc, and pc browsers on phones you should be OK.

No problems so far, except when the extension randomly choose to spoof a old browser version but you could just exclude the old browsers versions and only spoof the current version.

This extension can:

  • Disable Authorization header
  • Send Spoofed If-None-Match headers
  • Send Spoofed X-Forwarded-For header
  • Send Spoofed Via headers
  • Spoof Referer header
  • Spoof Accepted Documents
  • Spoof Accepted Encodings
  • Spoof Accepted Language
  • Time zone spoofing (UTC)
  • Screen size spoofing
  • Use standard font set

And much more, and i won't tell the details here you can see their documentation Here. Setting plugins to "click to play" by default is also a good idea, but let javascript allowed by default to not break thousand of pages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.