Comment by helterskelter2

1 day ago

I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.

Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?

19 comments

helterskelter2

Reply
Telaneo  1 day ago

Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.

Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.

  • autoexec  20 hours ago

    > Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard

    It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.

  • hobo123  20 hours ago

    That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.

edelbitter  1 day ago

You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.

For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.

pkal  21 hours ago

IIRC that is what https://jshelter.org/ does.

  • DavideNL  20 hours ago

    > "What JShelter configuration should I pick?

    https://jshelter.org/faq/#what-jshelter-configuration-should... :

    First, see our blog post. Consult also other blog posts and other questions in this FAQ.

    If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.

  • aorth  20 hours ago

    Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?

    • pkal  9 hours ago

      Yes, Anubis and other sites that really insist on abusing browser APIs breaks a lot of sites, but that is kind of the point.

avodonosov  14 hours ago

The reason is that the browser maker is interested to support tracking.

On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.

The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.

autoexec  20 hours ago

> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?

That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.