Unique Browser Fingerprint

What is the best way to reduce your browser fingerprint? Is there a default configuration of OS + browser + addons, that many people use? There should be a standard like: ubuntu + firefox + uMatrix + uBlock + adblockPlus + duckduckgo as default search engine + never remember history Someone here said you should use Pale Moon if you is really into privacy. But running a quick test on [Search domain panopticlick.eff.org] https://panopticlick.eff.org gives me instantly a unique fingerprint (even with no add-ons installed).

Windows 10 with Chrome is the most common setup. Being on linux almost guarantees that you'll end up being unique, since there are many distros and everyone configures and rices it to death. The plain simple linux beginner guy who might not touch anything doesn't use browser extensions at all. It's a tradeoff between privacy (addons and good config) and anonimity (not being unique).

>>4950 Does it have to be a tradeoff? Wouldn't spoofing your useragent fix this?

>>4951 Javascript can pull out all sorts of things, including a list of fonts installed on your computer. On linux this will almost always identify you completely uniquely. Take a look at https://panopticlick.eff.org/

So far as I know, the Tor browser / Tails is the only thing that comprehensively addresses fingerprinting. You'll be easily identified as a Tor user, but other than that your browser itself should be indistinguishable.

>>4949 >uBlock + adblockPlus Why would you use twice the same addon? Besides adblockPlus is complete soykaf. ublock takes custom filter lists through an import box at the bottom. I have never looked back again. Kudos though for using uMatrix, love it. Always saved me where a filter could have potentially failed me. 3rd party JS cannot be trusted. 1st party already gives you too much drekk.

>>4949 You want to reduce your browser's information leakage, spoof your user agent to Google's crawler or something similar, disable all javascript, no cookies, no plugins or add-ons. Never remembering history doesn't really accomplish much, and I'm not sure why you've chosen that as a privacy mechanism. >>4956 Frankly, this is the best advice. Finally, remember that most people here are what I'd call "Security LARPers", so take most advice from here, ie the Pale Moon soykaf, with a grain of salt. Especially when it's retarded tribal fuarrrkery like browsers or distros or whatever.

>>4958 I think there are different concepts to what exactly privacy is. 1) absolute minimization of data sent over the net 2) completely blending into the noise For the first option TOR of course and no JS. For the second option you obviously make your browser indistinguishable from the average browser. A Firefox Linux user would want to fake a Chrome Windows agent to blend in. Since the adoption of Linux desktops is probably 2% market penetration.

>>4959 There's only one kind of effective privacy, and that's using Tor. The latter option, this idea of blending in, is really just cargo cult privacy, if I'm being honest with you, Your browser user-agent can be tracked, sure, but LSOs, cookies, browser hardware tasks, GPU fingerprinting, side channel stuff, etc, all provide unique markers that are more commonly and reliably used to track people than just plain old user-agent and basic fingerprint. "Hiding in plain sight" doesn't work, doesn't provide any real privacy, and the only thing it accomplishes is making dilettantes feel good about themselves. You have to disable any kind of interpreted language client-side, and you basically need to run the browser from a read-only section of the filesystem, and try and look like something nobody cares too much about targeting or actively tries to avoid tracking in order to not skew their analytics, like a very common crawler. Even then, it's unlikely to be super-effective.

>>4961 >There's only one kind of effective privacy, and that's using Tor. You greatly overestimate your importance to any tracking server, just a little sanity check: they give a fragging drokk about you. Once you have filtered basic crap like google-analytics and the thousands of clones you already have done enough. Unless the fedgovs are after you. TOR exit nodes are way more monitored than anything else, regularly you see Firefox fix a CVE that was found and actively abused against the TOR browser. When you look past that falsehood of pseudo-elitism, you realize that it is fairly easy to fly under the radar. And of course wiping your history and having your daily IP check does wonders. No matter how well you use the TOR browser, your daily surfing behaviour would already give you away. >NSA goon: ah that cunt accessed example.com again at 09:30a.m., just right after checking lainchan.org So ask yourself who the real enemy is: Megacorps cooking with gas or the three letter facists before you lecture me again. >You have to disable any kind of interpreted language client-side, and you basically need to run the browser from a read-only section of the filesystem, and try and look like something nobody cares too much about targeting or actively tries to avoid tracking in order to not skew their analytics, like a very common crawler. Even then, it's unlikely to be super-effective. Already said to turn off JS before, no need to rephrase

>>4963 >IP check *change

>>4963 >So ask yourself who the real enemy is: Megacorps cooking with gas or the three letter facists before you lecture me again. Surely the answer to this is c) all of the above. >TOR exit nodes are way more monitored than anything else, regularly you see Firefox fix a CVE that was found and actively abused against the TOR browser You can always tell when someone isn't actually that familiar with Tor, despite having Big Opinions on it, when they spell Tor as if it's an acronym. You don't regularly see Firefox fix a CVE that's been found and used against Tor. I can think of two examples of this in the last say, five years, about a year apart, one of which, if I recall correctly, was already patched when the exploit was put into use (also, disabling javascript/plugins was a viable mechanism of avoiding it, and most browser exploits, too). Many Tor exit nodes are certainly monitored and sniffing traffic, but as long as you're not browsing Facebook with your Powerword clicking past every possible SSL error, that shouldn't really be a concern. Also, a benefit is there are lots of competing parties there, so as long as you regularly switch circuits, you'll avoid anyone seeing very much. It seems like you just feel like using an adblock plugin and getting a new lease/IP every once in a while is sufficient to get privacy in a world where a very large number of people use adblock plugins, and most people will have dynamic IP ranges. Protip: If it was that easy, companies like Facebook wouldn't be making millions selling everyone's data. Intelligence agencies wouldn't be hoovering up every bit of traffic they could get their grubby hands on. (Also, I don't get your obsession with wiping your history. You realise your history is just a local record of all the sites you visited, right? It's got nothing to do with privacy or tracking)

>>4963 >Saying TOR instead of Tor Opinion discarded.

>>4959 i dont think that's what he was talking about. almost everyone who uses tor connects using the tor browser bundle with more or less the same default config. theoretically the fact that you're using tor is the only thing anyone can find out about you, because your browser cannot be distinguished from other tor users. that's a big part of why everyone recommends using the official tor browser, even though it's basically just a hardened firefox config with some addons.

-use some form of self-destructing cookies -for the love of god don't use the default user agent -use some request blocker and ban domains that you think would track you. I recommend umatrix. -don't enable javascript unless it's absolutely necessary -use firefox or chromium(preferably a degoogled chromium, like iridium). Anything else is either slow or easily identifiable or closed source. I recommend firefox. -look into your default header values. Sometimes they give fonts or whatnot that will make you very easy to identify. Good browsers have addons that can change them. JonDoNym has the best fingerprint detector I've ever seen http://ip-check.info

There's no point in installing a bunch of plugins to reduce your fingerprint. You're just making yourself more identifiable. There will always be a new thing that they'll be able to track you through and until enough people do it you won't know. Today it's fonts, tomorrow it'll be timing attacks, and the day after it'll be some WebUSB thing. There's no stopping them. Better to blend in as best you can and make sure they never see you twice. In other words, try to feed them false information that puts you in the same bucket as a large percent of the population, while clearing any saved state between browsing sessions. The better you can do both of these, the harder you make their job. The harder you make their job, the less cost effective it is for them to classify you. The best answer is probably something like QubesOS. Have a VM (of a popular OS) and a vanilla install of a browser. Then save that as a snapshot and revert back to it whenever your done. Set/leave your hostname/MAC address/username/etc to sane defaults. All 0's for the MAC address and a hostname of "ubuntu", for instance, makes it pretty generic. That being said, I don't have a computer that supports Qubes so I run Firefox locked down (uMartix) when browsing and use a Webkit browser (with no history) for "Web Applications" (bank, youtube, etc). Seems that this is the middle ground between an easy enough setup and not feeling like I need to shower after going online. One of these days I'll finally write the stateless containerized browser orchestration suite of my dreams but I need to learn Nix a bit better first.

>>5034 >You're just making yourself more identifiable. how? Serious question. If you install plugins that make known tracking methods not work, how are you more identifiable? >There will always be a new thing that they'll be able to track you through and until enough people do it you won't know. "there will always be some way to break into my house so I just leave the front door unlocked"

>>5039 >how? Serious question. If you install plugins that make known tracking methods not work, how are you more identifiable? Look at your fingertips. Imagine removing the left half of your fingerprints. You've removed information but you've also added information that happens to be very distinctive. This is one of the reasons that Tor users are advised to not install browser extensions.

>>5039 >there will always be some way to break into my house so I just leave the front door unlocked More like “there will always be some way to break into my house so I make my house look nondescript so hopefully it won’t catch anyone’s eye” The alternative is being the only house on the block with a moat and 15 security cameras on the perimeter. You’re only drawing more attention to yourself. Throwing away the metaphor, you’re just putting a big sign on your browser that says, “I’m computer literate and have an interest in privacy preserving technology”. They might also determine gender, age, and class with reasonable certainty depending on what browser you’re using/where your IP is from.

>>5046 >determine gender, age, and class with reasonable certainty depending on what browser you’re using/where your IP is from Text-mode browser originating from Tor exits would be 15 to 20-year old Arch Linux users who frequent technology-discussion anonymous image boards, girls(male), lower middle class Europeans or North Americans. >>5034 > All 0's for the MAC address and a hostname of "ubuntu", for instance, makes it pretty generic. I hope you're trying to make a joke here, ha-ha lol. Anyways, does anybody know a full-featured browser fingerprint tester for self-hosting? Don't feel like feeding my privacy endeavors to some ""do-good"" third party on a long term span. Oh I also just came up with an idea, how about we develop a browser exploit that will install ublock and umatrix on targeted browsers, thus overall lowering uniqueness of technology-inclined adblocker users (around 4 millions on Firefox today)

>>5040 flawed anology. If I leave my user agent the same, for instance, I'm just broadcasting with every request "hey! look at me! this is the browser and OS I run!". If I let javascript load I'm making myself vulnerable to tons of exploits and exotic tracking techniques. If I let the referrer header stay the same I'm saying "HEY LOOK AT WHAT I JUST DID." If I let a cookie sit I'm saying "oh hi I was here at this time doing this". If I let facebook share buttons load I'm letting them know what website I'm visiting at all times. Leaving ?utm values unchanged tells the page it's linking to everything it needs to know about me. Et cetera et cetera. The web is set up already so that you give the maximum amount of possible information to everyone that asks for it. Hiding or obfuscating that information can only make it harder to assign a correct and unique fingerprint. Tor is a different use case from a regular browser, at least for me. I use the TBB when I don't want the FBI to know what I'm doing, I use my normal browser when I don't want my ISP or google to know what I'm doing(yes I use a VPN).

>>5057 No, it isn't a flawed analogy. It's the correct application of information theory to the subject of fingerprinting. The things you're talking about are orthogonal to fingerprinting, my analysis, and the question I was answering.

>>5059 really? because the only way to do those things is by installing addons, which you seem to be pretty against for some reason. Also, taking a fingerprint online is nothing like taking a fingerprint in person. You can change a fingerprint online, you can only erase one in person. The two are vastly different "information theoretically"

>>4963 >>NSA goon: ah that cunt accessed example.com again at 09:30a.m., just right after checking lainchan.org You could restart the Tor Browser whenever you are going to browse another website so there is that.

>>5082 you could just get a new circuit, there's a nice little button for it

>>5089 Yeah, about that. https://tails.boum.org/doc/about/warning/index.en.html#index11h1

>>4949 >What is the best way to reduce your browser fingerprint? Don't use your browser, obviously. Back to irc, ftp, ssh.

By configuring Firefox a little I improved my fingerprint dramatically in terms of uniqueness. From 1 in 3'000 to 1 in 70/80'000

>>5128 1 in 3000 is much much better than 1 in 70,000... You don't want to be unique, you want to have a high ratio

>>5082 There's no need for that. The Tor Browser creates a new circuit for each tab that accesses a different domain. To prove this to yourself, open two tabs to two different domains and click the onion on each. You'll see that the circuits are different.

>>5091 Doesn't that say that the issue is with Tails, not with Tor? >The New Identity feature of Tor Browser is limited to the browser. >This feature is not enough to strongly separate contextual identities in the context of Tails as the connections outside of Tor Browser are not restarted. >Tails does not provide a global New Identity feature. Shutdown and restart Tails instead. >>5082 >>5136 >new circuit for each tab That's true, but it doesn't isolate the cookies (or super-cookies). If those two different domains load content from a third, that third party could tell where you've been. Always use New Identity.

>>5144 >Doesn't that say that the issue is with Tails, not with Tor? No the issue is with logic. New Identity basically just restarts tbb to put the browser back into its initial state. The equivalent for an operating system running in RAM is to reboot. It's not magic.

>>5135 Sorry I inverted both. I indeed got a 1 in 3'000 at the end*.

>>5091 Dude blogposts like this make me love the tails people so much. They just casually soykaf on idiots and it warms my heart.

>>4966 Is TOR still safe? I see a lot of memes going back and forth around this topic, and i can't seem to get a straight answer from anyone.

>>5171 This is a fingerprinting thread. Tor/Tails is far and away the best way to avoid a unique fingerprint. Is it secure? It is routinely used to thwart law enforcement, but people do get deanonymized. I would recommend it to everyone who cares about anonymity as one part of a layered strategy.

>>5172 Thanks for the reply. I'll give it a shot

I get 1 in 1500 on panopticlick by just using the built-in firefox anti-fingerprinting (must be turned on in about:config), noscript (even enabling most scripts on the website) and ublock origin

>>5174 Impressive, bUT remember that the panopticlick database is only a database of people who care about privacy. Browsers in the wild are probably easier to identify.

disable javascript

>>5174 >built-in firefox anti-fingerprinting This must be the biggest bait scam in the history of Mozilla. Labeling your browser with http referrer that says "dind-dong fellas, I have no idea what am I doing and I also happen to be a beginner in caring for my privacy so please, please do not track me okay"

>>5216 Resist Fingerprint doesn't have anything to do with request headers. There are separate referer options but they're for enhanced privacy, not anonymity.

>>5216 resist fingerprint just changes your user agent and fonts to be more "average"

>>4951 It's relatively trivial to detect a spoofed user agent. >>4968 Self-destructing cookies is definitely a must. It's one of the easiest things to steal and can be really punishing for the victim. >>5039 Wearing a cloak can hide your features but you'll stand out in a crowd of normal people. Anonymity plugins protect your identity like a cloak but they don't prevent you from being tracked unless there's a good proportion of users using them. In a perfect world, everyone would. The same principle is seen with Tor. It prevents people from reading your traffic but doesn't necessarily stop you from being identified. There was a legal case a while back were a student made a violent threat to the school using Tor while on the school network. Because he was among the very few using Tor at the time, it wasn't necessary to know the traffic, only that he was using Tor. After being interrogated as a suspect he confessed. I'm pretty sure this is called a side channel attack because it takes advantage of metadata instead of the data that was being protected. >>5171 It might not be safe but it's the best we have.