• Skip to main content
  • Skip to header right navigation
  • Skip to site footer
Restore Privacy

Restore Privacy

Resources to stay safe and secure online

  • News
  • Tools
    • Secure Browser
    • VPN
    • Ad Blocker
    • Secure Email
    • Private Search Engine
    • Data Removal
      • Incogni Review
    • Password Manager
    • Secure Messaging App
    • Tor
    • Identity Theft Protection
    • Unblock Websites
    • Privacy Tools
  • Email
    • Secure Email
    • ProtonMail Review
    • Tutanota Review
    • Mailfence Review
    • Mailbox.org Review
    • Hushmail Review
    • Posteo Review
    • Fastmail Review
    • Runbox Review
    • CTemplar Review
    • Temporary Disposable Email
    • Encrypted Email
    • Alternatives to Gmail
  • VPN
    • What is VPN
    • VPN Reviews
      • NordVPN Review
      • Surfshark VPN Review
      • VyprVPN Review
      • Perfect Privacy Review
      • ExpressVPN Review
      • CyberGhost Review
      • AVG VPN Review
      • IPVanish Review
      • Hotspot Shield VPN Review
      • ProtonVPN Review
      • Atlas VPN Review
      • Private Internet Access Review
      • Avast VPN Review
      • TorGuard Review
      • PrivadoVPN Review
    • VPN Comparison
      • NordVPN vs ExpressVPN
      • NordVPN vs PIA
      • IPVanish vs ExpressVPN
      • CyberGhost vs NordVPN
      • Surfshark vs NordVPN
      • IPVanish vs NordVPN
      • ExpressVPN vs PIA
      • VyprVPN vs NordVPN
      • CyberGhost vs ExpressVPN
      • NordVPN vs HideMyAss
      • ExpressVPN vs ProtonVPN
      • Atlas VPN vs NordVPN
      • ExpressVPN vs Surfshark
      • NordVPN vs Proton VPN
      • Surfshark vs CyberGhost
      • Surfshark vs IPVanish
    • Best VPNs
      • Best VPN for Torrenting
      • Best VPN for Netflix
      • Best Free VPN
      • VPN for Firestick TV
      • Best VPN for Android
      • Best VPN for Gaming
      • Best VPN for PC
      • Best VPN for Disney Plus
      • Best VPN for Hulu
      • Best VPN for Mac
      • Best VPN for Streaming
      • Best VPN for Windows
      • Best VPN for iPhone
    • VPN Coupons
      • ExpressVPN Coupon
      • NordVPN Coupon
      • Cyber Monday VPN Deals
      • NordVPN Cyber Monday
      • Surfshark VPN Cyber Monday
      • ExpressVPN Cyber Monday
    • VPN Guides
      • Free Trial VPN
      • Cheap VPNs
      • Static IP VPN
      • VPN Ad Blocking
      • No Logs VPN
      • Best VPN Chrome
      • Best VPN Reddit
      • Split Tunneling VPN
      • VPN for Binance
      • WireGuard VPN
      • VPN for Amazon Prime
      • VPN for Linux
      • VPN for iPad
      • VPN for Firefox
      • VPN for BBC iPlayer
    • By Country
      • Best VPN Canada
      • Best VPN USA
      • Best VPN UK
      • Best VPN Australia
      • VPN for Russia
    • VPN Router
  • Password
    • Best Password Managers
    • Comparisons
      • NordPass vs 1Password
      • 1Password vs LastPass
      • NordPass vs LastPass
      • RoboForm vs NordPass
      • 1Password vs Bitwarden
      • Dashlane vs NordPass
      • 1Password vs Dashlane
      • NordPass vs Bitwarden
    • KeePass Review
    • NordPass Review
    • 1Password Review
    • Dashlane Review
    • RoboForm Review
    • LastPass Review
    • Bitwarden Review
    • Strong Password
  • Storage
    • Best Cloud Storage
    • pCloud Review
    • Nextcloud Review
    • IDrive Review
    • SpiderOak Review
    • Sync.com Review
    • MEGA Cloud Review
    • NordLocker Review
    • Tresorit Review
    • Google Drive Alternatives
  • Messenger
    • Secure Messaging Apps
    • Signal Review
    • Telegram Review
    • Wire Review
    • Threema Review
    • Session Review
  • Info
    • Mission
    • Press
    • Contact
  • News
  • Tools
    • Secure Browser
    • VPN
    • Ad Blocker
    • Secure Email
    • Private Search Engine
    • Data Removal
      • Incogni Review
    • Password Manager
    • Secure Messaging App
    • Tor
    • Identity Theft Protection
    • Unblock Websites
    • Privacy Tools
  • Email
    • Secure Email
    • ProtonMail Review
    • Tutanota Review
    • Mailfence Review
    • Mailbox.org Review
    • Hushmail Review
    • Posteo Review
    • Fastmail Review
    • Runbox Review
    • CTemplar Review
    • Temporary Disposable Email
    • Encrypted Email
    • Alternatives to Gmail
  • VPN
    • What is VPN
    • VPN Reviews
      • NordVPN Review
      • Surfshark VPN Review
      • VyprVPN Review
      • Perfect Privacy Review
      • ExpressVPN Review
      • CyberGhost Review
      • AVG VPN Review
      • IPVanish Review
      • Hotspot Shield VPN Review
      • ProtonVPN Review
      • Atlas VPN Review
      • Private Internet Access Review
      • Avast VPN Review
      • TorGuard Review
      • PrivadoVPN Review
    • VPN Comparison
      • NordVPN vs ExpressVPN
      • NordVPN vs PIA
      • IPVanish vs ExpressVPN
      • CyberGhost vs NordVPN
      • Surfshark vs NordVPN
      • IPVanish vs NordVPN
      • ExpressVPN vs PIA
      • VyprVPN vs NordVPN
      • CyberGhost vs ExpressVPN
      • NordVPN vs HideMyAss
      • ExpressVPN vs ProtonVPN
      • Atlas VPN vs NordVPN
      • ExpressVPN vs Surfshark
      • NordVPN vs Proton VPN
      • Surfshark vs CyberGhost
      • Surfshark vs IPVanish
    • Best VPNs
      • Best VPN for Torrenting
      • Best VPN for Netflix
      • Best Free VPN
      • VPN for Firestick TV
      • Best VPN for Android
      • Best VPN for Gaming
      • Best VPN for PC
      • Best VPN for Disney Plus
      • Best VPN for Hulu
      • Best VPN for Mac
      • Best VPN for Streaming
      • Best VPN for Windows
      • Best VPN for iPhone
    • VPN Coupons
      • ExpressVPN Coupon
      • NordVPN Coupon
      • Cyber Monday VPN Deals
      • NordVPN Cyber Monday
      • Surfshark VPN Cyber Monday
      • ExpressVPN Cyber Monday
    • VPN Guides
      • Free Trial VPN
      • Cheap VPNs
      • Static IP VPN
      • VPN Ad Blocking
      • No Logs VPN
      • Best VPN Chrome
      • Best VPN Reddit
      • Split Tunneling VPN
      • VPN for Binance
      • WireGuard VPN
      • VPN for Amazon Prime
      • VPN for Linux
      • VPN for iPad
      • VPN for Firefox
      • VPN for BBC iPlayer
    • By Country
      • Best VPN Canada
      • Best VPN USA
      • Best VPN UK
      • Best VPN Australia
      • VPN for Russia
    • VPN Router
  • Password
    • Best Password Managers
    • Comparisons
      • NordPass vs 1Password
      • 1Password vs LastPass
      • NordPass vs LastPass
      • RoboForm vs NordPass
      • 1Password vs Bitwarden
      • Dashlane vs NordPass
      • 1Password vs Dashlane
      • NordPass vs Bitwarden
    • KeePass Review
    • NordPass Review
    • 1Password Review
    • Dashlane Review
    • RoboForm Review
    • LastPass Review
    • Bitwarden Review
    • Strong Password
  • Storage
    • Best Cloud Storage
    • pCloud Review
    • Nextcloud Review
    • IDrive Review
    • SpiderOak Review
    • Sync.com Review
    • MEGA Cloud Review
    • NordLocker Review
    • Tresorit Review
    • Google Drive Alternatives
  • Messenger
    • Secure Messaging Apps
    • Signal Review
    • Telegram Review
    • Wire Review
    • Threema Review
    • Session Review
  • Info
    • Mission
    • Press
    • Contact
If you buy through links on this site, we may earn a commission, which helps support our mission.

Browser Fingerprinting Protection: How to Stay Private

February 23, 2022 By Sven Taylor — 107 Comments
browser fingerprinting

In this guide we cover all aspects of browser fingerprinting and device fingerprinting in 2022. In addition to explaining what exactly this is, we’ll also show you how to protect yourself against these threats.

Many people use VPN services to hide their IP address and location – but there is another way you can be identified and tracked online. That is through browser fingerprinting.

Whenever you go online, your computer or device provides the sites you visit with highly specific information about your operating system, settings, and even hardware. The use of this information to identify and track you online is known as device or browser fingerprinting.

As browsers become increasingly entwined with the operating system, many unique details and preferences can be exposed through your browser. The sum total of these outputs can be used to render a unique “fingerprint” for tracking and identification purposes.

Your browser fingerprint can reflect:

  • the User agent header
  • the Accept header
  • the Connection header
  • the Encoding header
  • the Language header
  • the list of plugins
  • the platform
  • the cookies preferences (allowed or not)
  • the Do Not Track preferences (yes, no or not communicated)
  • the timezone
  • the screen resolution and its color depth
  • the use of local storage
  • the use of session storage
  • a picture rendered with the HTML Canvas element
  • a picture rendered with WebGL
  • the presence of AdBlock
  • the list of fonts

Is browser fingerprinting accurate?

Some researchers have found this method of identification to be extremely effective.

Why is this being done?

Browser fingerprinting is just another tool to identify and track people as they browse the web. There are many different entities – both corporate and government – that are monitoring internet activity, and they all have different reasons for doing so. Advertisers and marketers find this technique useful to acquire more data on users, which in turn leads to more advertising revenue.

Some websites use browser fingerprinting to detect potential fraud, such as banks or dating websites, so it’s not always nefarious.

Surveillance agencies could also use this to identify people who are employing other privacy measures to cloak their IP address and location, such as with VPN services or the Tor (onion) network.

Browser fingerprinting test websites

One good test website to see all of the information that is being revealed by your browser is
ipleak.net.

With ipleak.net, you will want to scroll down to the “Geek Details” section where you will be able to see:

  • Detected information
  • System information
  • Screen information
  • Plugins information
  • Mime-Types information
  • HTTP Request Headers

There are also a few websites that reveal browser data and also assess a “uniqueness” score based on your variables in comparison to their database of browsers.

  • amiunique.org is another good resource. It is open source and provides more information and updated fingerprinting techniques, including webGL and canvas.
  • Cover Your Tracks is run by the Electronic Frontier Foundation. You can learn more here.

Cover Your Tracks is the updated version of a project the EFF has been working on for many years. It gives you a pretty good picture of how susceptible your browser is to finger printing.

browser fingerprinting

How to mitigate your browser fingerprint

Before we jump into potential solutions, it’s important to note that implementing browser fingerprinting protection methods may break some websites. Be sure to research these different options carefully before adjusting your browser settings.

Another consideration is your threat model. How much privacy do you need or want? The answer to that question will be different for every user.

Lastly, I use the word “mitigate” rather than “solve” because browser fingerprinting is a very complex and evolving issue. For example, a new study revealed that there’s nothing you can do to mitigate some fingerprinting attacks on smartphones (discussed more below).

Here are some good ways to mitigate your browser fingerprint:

1. Browser modifications and tweaks

Depending on the browser you are using, you might have some different options for tweaks and modifications to mitigate browser fingerprinting. Below we’ll discuss various Firefox and Brave browsers, which are both secure and private browsers.

Brave browser fingerprinting

Although it is based on Chromium, the Brave Browser may be a good option for those wanting a simple, privacy-focused browser that blocks tracking by default and still supports Chrome extensions. Brave allows you to enable fingerprinting protection, which is under the Brave Shields settings:

fingerprinting protection brave

See also this article on Github discussing different aspects of fingerprinting protection in Brave.

Firefox browser fingerprinting

Firefox is a good browser for privacy and security, and it can also be modified and hardened for your unique needs. (For an overview of Firefox privacy tweaks, see the Firefox privacy guide.) The first thing you need to do is type about:config into the URL bar of Firefox, hit enter, then agree to “accept the risk” and make the following changes:

  • privacy.resistFingerprinting (change to true) – Changing this value to true will offer some basic protection, but it’s far from a complete solution. The privacy.resistFingerprinting preference was added to Firefox as part of the Tor Uplift project and it continues to be improved.
  • webgl.disabled (change to true) – WebGL is another tricky issue for privacy and security. Disabling this preference is generally a good idea – see some of the issues with WebGL here.
  • media.peerconnection.enabled (change to false) – Disabling WebRTC is a good idea since this can reveal your true IP address, even when you are using a good VPN service. See the WebRTC leak guide for more details and how to disable WebRTC in other browsers.
  • geo.enabled (change to false) – This disables geolocation tracking.
  • privacy.firstparty.isolate (change to true) – This is another great update from the Tor Uplift project that isolates cookies to the first party domain.

Note: This is just a brief overview of changes that improve your privacy and help to mitigate your browser fingerprint. Nonetheless, there are many different factors that go into fingerprinting and you may still have a unique fingerprint even with these changes.

Firefox with the ghacks user.js file

Another great option is to run Firefox with a unique user.js file, such as the ghacks user.js. This is a custom Firefox configuration file that has been modified for more privacy and security. I like this option because it can save lots of time with setup and is regularly updated and improved. See the Wiki page for an overview and setup instructions.

When I tested a fresh install of Firefox with the ghacks user.js file, amiunique.org showed my browser fingerprint as as not unique.

2. Browser extensions and add-ons to minimize or spoof your fingerprint

There are a number of different browser extensions and add-ons that you may find useful. With that being said here are a few things to remember:

  1. Be careful with third-party extensions, which could potentially undermine your privacy and security.
  2. Be mindful that using extensions may make your browser fingerprint more unique (many factors).

Now that we’ve gotten those disclaimers out of the way, let’s examine some browser add-ons that may be useful:

Firefox browser:

  • Canvasblocker by kkapsner – Protects against canvas fingerprinting methods (source on GitHub)
  • Trace by AbsoluteDouble – Protects against various fingerprinting methods (source on GitHub)
  • Chameleon by sereneblue – Allows you to spoof user agent values (source on GitHub)

There are many other Firefox add-ons you may want to consider as well, which are discussed in the Firefox privacy guide. Some of these add-ons are also available for Chromium-based browsers, such as Brave.

Some people recommend spoofing different user agents through a browser extension, while others suggest this is a bad idea because it might make you more “unique”. Of course, there are many factors to consider, but adding noise to your fingerprint may not be a bad strategy.

For example, with Chameleon, you can cycle through different user agents at various time intervals.

browser fingerprinting extension

Now let’s look at another option for modifying your browser fingerprint: the use of virtual machines.

3. Virtual machines

You can also consider running different virtual machines, which can utilize different operating systems on your host computer. VirtualBox is FOSS and offers an easy way to run different Linux VMs for more privacy and security. There are many different video tutorials online, depending on your operating system and the VM OS you are looking to use.

Virtual machines offer numerous advantages in terms of privacy and security, while also protecting your host machine. For privacy, VMs allow you to easily spoof different operating systems and also chain VPN services, as explained in the multi-hop VPN guide. This also helps keep your host machine secure by isolating a virtual environment. If the VM were to be compromised, simply delete it and create a new one. You can also use different VMs for different purposes.

4. Tor Browser

Another option is to use the Tor browser, which is simply a hardened and protected version of Firefox. It includes numerous privacy and security modifications that are built into the default version:

  • HTTPS Everywhere
  • NoScript
  • Anti-tracking features
  • Canvas image extraction blocked
  • WebGL blocked
  • Operating system cloaking (shows as Windows 7 for all users)
  • Timezone and language preferences blocked

The key here is to use the default version (the developers do not recommend adding any plugins or extensions because this could compromise the browser’s effectiveness).

You can get the latest version of the Tor browser here.

The default version of the Tor browser is configured to run with the Tor (anonymous/onion) network. While the Tor network does have added benefits in terms of privacy, it also has a number of disadvantages:

  • Your internet speed will be reduced to around 2 Mbps, making streaming videos or music nearly impossible
  • Tor only encrypts traffic through the browser, rather than encrypting all traffic on your operating system like a VPN
  • Tor is vulnerable to IP leaks, especially with Windows
  • Tor is not safe to use when torrenting (see the Best VPNs for Torrenting guide)
  • Tor was created by the US government and is still funded largely by US government grants
  • Some consider Tor to be compromised

Ultimately, like all privacy tools, Tor has both pros and cons.

Note: You can also first connect to a VPN and then load the Tor browser as normal with the VPN running in the background. This will hide your real IP address from malicious Tor nodes and give you an extra layer of protection.

5. Don’t expect much privacy on a smart phones

As we’ve covered before, most “smart” devices are data collection tools for various entities.

Smart phones are especially vulnerable to browser fingerprinting. A team of researchers at Cambridge published a paper highlighting how smartphones can be fingerprinted using internal sensors – and there’s nothing the user can do about it.

The paper delves into the technical details, but here’s a brief overview of their findings:

  • The attack can be launched by any website you visit or any app you use on a vulnerable device without requiring any explicit confirmation or consent from you.
  • The attack takes less than one second to generate a fingerprint.
  • The attack can generate a globally unique fingerprint for iOS devices.
  • The calibration fingerprint never changes, even after a factory reset.
  • The attack provides an effective means to track you as you browse across the web and move between apps on your phone.

Aside from the sensor issue, there are many other reasons for avoiding smart phones if you expect privacy. See our article on controlling communication channels for more info on this topic.

Use a good VPN service

Although a VPN alone won’t protect you against browser fingerprinting, it is a very important privacy tool to hide your IP address, hide your location, and keep your data secure.

If you’re not using a good VPN, your internet provider can easily monitor all your online activity by recording your DNS requests. In many countries, such as the UK and Australia, this is mandatory. Internet providers in the US can also monitor and record their users, and since March 2017, they can also sell this information to third parties (advertisers).

An interesting report from the Federal Trade Commission in the US highlighted how all major internet providers are collecting vast amounts of private data and sharing this data within a wide network of partners. See our article for more details:

Internet Service Providers are Logging EVERYTHING You Do Online

Going through all the hassle to protect yourself against browser fingerprinting may be a waste of time if you aren’t using a good VPN that will encrypt your internet connection and hide your IP address and location. The best VPN services report discusses the top recommendations based on the latest results.

For those who are seeking a higher level of online anonymity, you can also use a multi-hop VPN, which will encrypt your traffic across more than one server (multiple hops) before exiting onto the regular internet.

As mentioned above, combining VPNs also adds additional privacy and security while distributing trust across different VPN providers.

Browser Fingerprinting FAQs

Below are some of the other questions we see regarding browser fingerprinting.

What do you mean by browser fingerprinting?

Browser fingerprinting is a method to identify and track you online based on numerous different variables, including your operating system, timezone, browser headers, plugins, cookie preferences, tracking preferences, screen resolution and more. By aggregating these browser variables, third parties can create a unique fingerprint of your browser so that you can be identified and tracked online.

Who uses browser fingerprinting?

Browser fingerprinting is used primarily by advertising agencies and data brokers. By creating a unique browser fingerprint, ad agencies and data brokers can track your activities as you browse different websites. Your browsing activity can then be linked to your unique browser fingerprint, which allows you be targeted with ads based on your online activities. Additionally, your activities and identity can be sold to third parties by data brokers and other ad-tech intermediaries.

Does a VPN prevent browser fingerprinting?

No, a VPN alone will not protect you against browser fingerprinting. While a VPN will hide your true ISP-assigned IP address and location, it will not protect you against browser fingerprinting, which is based on unique variables without your browser and operating system. To protect yourself against browser fingerprinting, you will need to modify the settings within your browser, as we describe above. However, you should still use a VPN to hide your IP address and location to better protect your online privacy.

Can you be tracked on private browsing?

Private browsing alone will not protect you from browser fingerprinting and it also won’t hide your IP address or location. In essence, private browsing is not actually private. We explain why incognito/private browsing is not private and the steps you can take to actually have more privacy and security online with your browser.

Use browser fingerprinting protection in 2022

While browser fingerprinting may seem like a daunting issue to some, mitigating your browser fingerprint is relatively easy. For those seeking the highest levels of privacy and security, I’d recommend utilizing virtual machines and perhaps chaining different VPN services (using more than one VPN at the same time).

As a general rule of thumb, Firefox remains a great all-around browser after some modifications and configuration. The secure browsers guide also discusses various options, while the Firefox privacy modifications guide takes a deep-dive into tweaks, extensions, and custom configuration.

Another issue to consider, which was not mentioned in this guide, is using a good ad blocker. Ads today basically function as tracking – they record your browsing habits so you can be hit with targeted advertisements. A good add-on is uBlock Origin, but there are other recommendations in the ad blocker article and privacy tools guide.

Stay safe, secure, and private in 2022 and beyond. We’re all being watched.

About Sven Taylor

Sven Taylor is the lead editor and founder of Restore Privacy, a digital privacy advocacy group. With a passion for digital privacy and accessible information, he created RestorePrivacy to provide you with honest, useful, and up-to-date information about online privacy, security, and related topics.

Reader Interactions

Comments

  1. Bronco

    December 28, 2021

    I have to disagree here, at least for iOS: SnowHaze is probably the only mobile browser that can successfully mitigate fingerprints. It’s about how this browser is made and how it works. SH is really unique in many respects. Brave is close in iOS, but it leaves much more traces than SH.

    Reply
    • Sven Taylor

      December 28, 2021

      For me personally, trying to achieve lots of privacy on a mobile phone is a waste of time. Check out this article on controlling communication channels to see how challenging it really is.

      However, for those who do use their mobile devices a lot, I can see how finding the right browser is important. We discuss some privacy-focused browser for mobile devices in our secure browser guide.

      Reply
    • Cliff

      December 29, 2021

      Brave leaves fingerprints and how can we trust a company that includes bitcoin garbage with the installation?

      Reply
  2. BoBeX

    December 2, 2021

    …continued

    VM and change the guest window size. Obviously not an enjoyable browsing experience and not a solution.
    https://noscriptfingerprint.com publish their documentation and obviously corporates do not – god knows what they are up to.

    I believe there is a good solution in this but as said I am not close to being technical capable enough. I think it would be possible though.
    What would be required is:
    A custom hypervisor running a lightweight purpose built OS for browsing only.
    It would be a fork of VirtualBox and a fork of a Linux distro;
    It would draw on the Whonix and Nmap for lessons learned. (I myself, don’t know much about this)

    Come finger print this; I have a custom hypervisor. (Insert here the emoji that gives them the finger)
    F finger printers.

    It could be very cleverly designed. Persistence (on/off) could be could be presented as tabs.
    F Finger printers.

    It just needs to be purpose built.
    F finger printers

    Regards,

    BoBeX

    Reply
  3. BoBeX

    December 2, 2021

    Hi RP community,

    I beat the last finger printer:
    https://noscriptfingerprint.com
    I had to read their documentation and have completed one and a half years of formal IT education.

    It is not a workable or convenient and I am not technical capable to make it so.

    Spoiler for anyone enjoying learning and testing themselves…

    Reply
    • Mai

      February 12, 2022

      Can you share how you beat them?

      Reply
  4. Bill

    November 29, 2021

    Interesting. Changing privacy.resistFingerprinting disabled audio reading in reader view of Firefox.

    Reply
  5. Restorer

    November 28, 2021

    Another website for browser fingerprinting: https://abrahamjuliot.github.io/creepjs/

    Reply
  6. BoBeX

    October 29, 2021

    Hi Sven, Restorer and RP Community,

    I must thank Restorer for the finger print test sites he has shared.

    I have posted on Restorer’s first two links below (basically custom FF with privacy extensions defeats both those (without no-script) and Brave is defeats both (only with script blocking).

    This post discusses my (armature) testing of Restorers third link:
    https://noscriptfingerprint.com

    Firefox:
    Fingerprinted.
    Produces two distinct and repeatable finger prints. One distinct finger print on standard windows and a second distinct finger print on private windows.

    Brave:
    Fingerprinted.
    The same finger print for standard windows, private windows and Tor windows.

    Before go further I would encourage others to test this independently. The may be flaws in my testing methodology and / or configurations in my browser settings.

    Firefox defeated both the first two sites without disabling JS which for me is the perfect solution. FF could not defeat the third link but produced two distinct and repeatable fingerprints for standard and private windows; this result is perplexing for me; but also may shine a light on a possible way to defeat the the finger printer. If the change from standard to private windows changes the finger print than this distinction may point to a solution to produce unique finger prints for all windows. The question raised is what changes and is it possible to implement this change for all windows?

    The Brave results were for me both disappointing and disturbing. Brave out-of-the box (with a few standard changes) doesn’t defeat anything with out script blocking which for me makes browsing unpleasant. Disturbingly the Brave Tor window appears to off zero protection from finger printing, which to my mind makes it absolutely useless. My testing (which may be imperfect) leads me to hold a current view that Brave is far from what it promises to be – it appears to me to be a chromium browser with a built in add blocker. Offering Tor services that are defeated so easily is disturbing.

    Regards,

    BoBeX

    Reply
    • Restorer

      November 1, 2021

      That’s good BoBeX, I think I got the same results too more or less because I used only extensions and didn’t harden through config. For test #3 only one fingerprint for each browser.

      Reply
    • Anonymoud

      December 30, 2021

      As far as I know, in brave a fingerprint is randomized for each new session. So, if a user opens normal window, private window and tor window from the same session all of them will have same fingerprint. But, if the user opens a normal window, ends the session, opens a new session with private window, then the normal window from previous session and private window in this new session will have different fingerprint

      I might be wrong though..

      Reply
  7. Restorer

    October 24, 2021

    Websites to test browser fingerprinting:
    1. https://nothingprivate.ml
    2. https://fingerprintjs.com
    3. https://noscriptfingerprint.com

    Reply
    • BoBeX

      October 26, 2021

      Hi Restorer,

      I started testing your first two listed sites against my browsers the other day and have only come back to it to day.

      I have a modified FF (as per RP guide) and multiple privacy extension; and
      Brave with some settings switched to high, aggressive etc.

      https://nothingprivate.ml does not generate a fingerprint for either.

      https://fingerprintjs.com does not fingerprint FF, but does fingerprint Brave. When I block ‘scripts’ on Brave it then too can’t be fingerprinted but this breaks things on other websites. My FF does not have ‘NoScript’ or JS blocked, it doesn’t break websites.

      So based on your first two links, FF wins for me.

      I’ll test your last link against my browsers and get back to you.

      What is your experience?

      Regards,

      BoBeX

      P.S. Does anyone else have fingerprinting test sites?

      Reply
  8. BoBeX

    October 16, 2021

    Hi Sven,

    Further to my previous…

    I just went and started looking into the Brave browser setting and I can’t seem to help myself by tweaking things. “Trackers”, I changed this to “aggressive”; “Fingerprinting,” i changed this to “strict”; “Social Media” – off, off, off.

    My question is if I am going to use Brave to limit finger printing and tracking am I helping or hindering when making changes?

    Regards,

    BoBeX

    Reply
    • Restorer

      October 19, 2021

      It will help because trackers are blocked and noise or random values will be added to fingerprints.

      Reply
      • BoBeX

        October 21, 2021

        Hi Restorer,

        Thank you for your reply.

        This is the technical information I was after. I had previously looked into tracker blocking and creating ‘noise’. I was using privacy possum to achieve this.

        You seem very cluey. Please let me throw another technical question to you. Just thinking of ‘noise,’ which would be more difficult to finger print a FF browser with Privacy Possum installed or Brave with aggressive setting on?

        Thankyou for your advise

        Regards

        BoBeX

        Reply
        • Restorer

          October 22, 2021

          Hello BoBex, you’re welcome. Well I’m no expert but I’ll help where I can!

          I’m not familiar with Privacy Possum but it seems to be quite outdated (last version was 2019, might still work today but not sure about coming months). Some if not most of its features are already baked in Firefox such as block 3rd party cookies, block trackers, block fingerprinting. I’m not sure if Firefox adds noise to fingerprint like Possum. As for me, I use canvas fingerprint defender by ilGur on my Firefox.

          About Firefox vs Brave fingerprint protection, I think they should provide equal protection. Here, you can test browser fingerprinting using these sites:
          1. https://nothingprivate.ml
          2. https://fingerprintjs.com
          Make sure you pass #1 before going #2 test because #2 is stronger. To test, open the website in a tab/window to be recognized, then open a new tab/window and type the same website address to see if you’re trackable or fingerprintable.

  9. BoBeX

    October 16, 2021

    Hi Sven,

    Great guide!

    This guide has finally convinced me to use the Brave browser (Have never been opposed to Brave I just like the idea of using Firefox to maintain diversity in the market place). My thoughts are that the Brave out of the box experience should be be harder to finger print than a highly customised Firefox? What are your thoughts?

    My new plan is to use Firefox for Youtube; Brave for browsing and research and Chrome for business. (Its not a privacy extension but “Youtube Enhancer” is so good.)

    Regards,

    BoBeX

    Reply
    • Restorer

      October 20, 2021

      Why use Chrome for business? Have you tested Brave for business instead? It’s also based on Chromium, just more private. Should work OK.

      For Firefox, install multi account containers extensions eg Firefox container, Temporary containers and/or SnowHaze containers. Use containers to isolate website activities and data (cookies, script etc.). It’ll be the same as having multiple Firefox browsers.

      Reply
      • BoBeX

        October 21, 2021

        Hi Restorer,

        Thank you for your kind reply.

        When I said ‘business’ I meant ‘personal business’ not ‘commercial business. All my stuff is linked to a Gmail account and will be very time consuming to change. For the time being, I erase my account info regularly, they say they delete all collected data. My view is that if all this stuff is linked to a gmail account changing the browser would be of little value (though I could be wrong) I don’t use the in app Chrome P/W manager. I believe Chrome to be a very secure browser (I am not suggesting other browsers are not) and this too is important to me.

        I do believe account and browser segmentation is a very powerful and convenient privacy tool and personal organisational method. I note your suggestion for account containers, I prefer segmentation. I don’t know if one is more private than the other but I like to segment both on the browser and account, it’s easier for me cognitively.

        Thanks again for your advice. It is welcomed.

        Regards,

        BoBeX

        Reply
        • Anonymous

          December 30, 2021

          You are using gmail. Then browser fingerprinting will not matter as you already in their system. And everything you do will be in vain

  10. naapsel

    August 20, 2021

    Trace looks good , he should add euro opion too so i could buy it

    Reply
  11. Peter

    August 12, 2021

    Hello Sven
    Can you make another article to make firefox more safer like the before firefox article with more advanced privacy protection features
    Thanks

    Reply
  12. Ayumu Uehara

    July 21, 2021

    I read somewhere that eff browser fingerprint test gets the data from people who are using the browser fingerprint test site. In other words, unique or not, that depends on people who are using the test site. However, I cannot validate that. Does anyone here has a link to proof that? So I can read the details. Thanks.

    Reply
    • Restorer

      July 29, 2021

      They collect for study purpose.

      https://coveryourtracks.eff.org/privacy

      Reply
  13. BoBeX

    June 9, 2021

    Great article. Very hard to find consolidated and relevant advise else where

    Reply
  14. worried

    June 8, 2021

    how do I change my timezone for brave browser? I do not want people do see my timezone. I thought that vpn would hide what timezone I live in.

    Reply
    • Afellowhuman

      June 12, 2021

      Use bromite browser it changes your timezone by default. U can also change the user agent, u can use a proxy ,has ad blocking ,etc.
      Keep the javascript off and try to use atleast 3 browsers each for different work.
      Stay safe.

      Reply
    • Aid

      July 2, 2021

      Try the add-on Chameleon. I change my timezone on it every hour. I’m not sure if it’s available for Chromium, but it’s on Firefox.

      Reply
  15. jiml8

    May 24, 2021

    On my home network I have deployed a raspberry pi as a VPN proxy. It has an “always on” tunnel, that I change from time to time, and it is set as the gateway for any device on the network that I want to have using that VPN. This solves webrtc leaks quite neatly; browsers on machines on the network connect through the VPN proxy, so the webrtc leak shows the VPN exit node address and the VPN DNS.

    I also have another RPI on my network that is configured as a pihole DNS server (of course, with ad blocking). Every device on my network gets its DNS from this pihole. The pihole gets its DNS using DoH through the DNS proxy to the provider of my choice.

    My workstation has what I call 4-level security. There is the host, and 3 separate virtual machines using 3 different operating systems to implement this security. Level 4 is applied on the host. Fully protected Firefox and slightly less protected Chromium, accessing the internet through chained Privoxy and TOR, and routed through the VPN proxy.

    Level 3 is a VM that is bridged to the host WAN port. Fully protected Firefox, routed through the VPN proxy.

    Level 2 is a VM that is bridged to the host WAN port. Moderately protected Firefox, mostly unprotected chromium, routed through the VPN proxy.

    Level 1 is a VM that is bridged to the host WAN port. Almost unprotected Firefox (I do have an ad blocker on it) and fully stock Chromium, routed out the upstream router’s default gateway. The pihole DNS is set to block any and all attempts to contact Facebook that come from the Level 1 host.

    My browsing philosophy should be obvious. I browse using level 4 Firefox. If a site breaks, and I need to see it for some reason, I copy/paste the URL into the level 3 Firefox, and enable the minimum number of scripts needed to see the content I want to see.

    Level 4 Chromium is used specifically for facebook and linkedin. I also may hit a small handful of other sites with it, but usually only following links out of facebook. If the site breaks, copy/paste into level 3 firefox.

    Level 2 is reserved for certain specific sites I visit, and most of my e-commerce activity.

    Level 1 is used strictly for those sites (mostly banks, brokerages, etc) where I have to allow them to identify me.

    Overkill for privacy? Well, I don’t think that is possible in today’s environment, and I make this post to tell you (and anyone else) a way to go about it that solves just about all the problems associated with maintaining privacy on the internet.

    I didn’t get into the IOT VLAN, but it has its own VPN proxy, uses the pihole DNS, and allows me to secure those inherently unsecure IOT things that I use (mostly an android TV).

    Reply
    • naapsel

      August 20, 2021

      how hard is it to set it up?

      Reply
  16. Ayumu Uehara

    April 21, 2021

    If I have to choose just one browser extensions from the above, I would go for Trace. Available for both Chromium and Firefox. Turn on the advanced mode and then disable all fingerprinting tracking. The only drawback is the plugin is no longer updated.

    Reply
    • Sven Taylor

      April 21, 2021

      Yeah that’s a big drawback.

      Reply
  17. NoNeedForAName

    April 19, 2021

    Re: 3. Virtual machines
    Have you checked out Qubes OS yet? It might be worth a punt.

    Reply
    • d

      July 10, 2021

      Is Kodachi Linux with KVM of any good use here for privacy or is it compromised with all the apps and processes running on it by default?

      Reply
  18. king

    April 17, 2021

    Sir, brave browser displays information like graphics card , ram, battery percentage and even live time zone. However firefox too does this by exposing the browser build number (unless we use chameleon). For an average use like browsing youtube video (sometimes few skoodilypooping videos) , does it matter.
    I would greatly appreciate if you tell us about backdoors. Are Trumps claims of backdoors are true. how does it work?
    Kindly explain the level and importance of privacy in our daily life. How much privacy should we try to achieve as a regular user.

    Reply
    • Sven Taylor

      April 18, 2021

      Hi King. There are tradeoffs with everything. I would recommend browsing our Essential privacy guides to get up to speed. As for backdoors, I have no idea.

      Reply
  19. ANONYMOUS

    April 17, 2021

    ACCORDING TO YOU, WHICH BROWER IS BETTER : FIREFOX OR BRAVE.

    Reply
    • Sven Taylor

      April 18, 2021

      I write this website to help different people, and everyone has their own needs. Brave has been making great progress and may be my top recommendation soon, but there are other options to consider in our secure browser guide.

      Reply
  20. Robin

    April 17, 2021

    Very good and clear article. Tnx. Too bad about the smartphones browser. I noticed the recent Firefox update only allows (or supports) a limited number of extensions.

    Reply
    • d

      July 10, 2021

      Too bad about the smarthphones browsers? Can I challenge you on that one: what would you say about a Linux phone(Pine) with virtualbox runing Pure Os?
      This is not anymore a smartphone but a portable computer disguised as a smarthphone i believe.
      Any thoughts?

      Reply
« Older Comments
Newer Comments »

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Restore Privacy Checklist

  1. Secure browser: Modified Firefox or Brave
  2. VPN: NordVPN (68% Off Coupon) or Surfshark
  3. Ad blocker: uBlock Origin or AdGuard
  4. Secure email: Mailfence or Tutanota
  5. Secure Messenger: Signal or Threema
  6. Private search engine: MetaGer or Brave
  7. Password manager: NordPass or Bitwarden

About

Restore Privacy is a digital privacy advocacy group committed to helping people stay safe and secure online. You can support this project through donations, purchasing items through our links (we may earn a commission at no extra cost to you), and sharing this information with others. See our mission here.

We’re available for Press and media inquiries here.

Restore Privacy is also on Twitter

COPYRIGHT © 2023 RESTORE PRIVACY, LLC · PRIVACY POLICY · TERMS OF USE · CONTACT · SITEMAP