In this guide we cover all aspects of browser fingerprinting and device fingerprinting in 2022. In addition to explaining what exactly this is, we’ll also show you how to protect yourself against these threats.
Many people use VPN services to hide their IP address and location – but there is another way you can be identified and tracked online. That is through browser fingerprinting.
Whenever you go online, your computer or device provides the sites you visit with highly specific information about your operating system, settings, and even hardware. The use of this information to identify and track you online is known as device or browser fingerprinting.
As browsers become increasingly entwined with the operating system, many unique details and preferences can be exposed through your browser. The sum total of these outputs can be used to render a unique “fingerprint” for tracking and identification purposes.
Your browser fingerprint can reflect:
- the User agent header
- the Accept header
- the Connection header
- the Encoding header
- the Language header
- the list of plugins
- the platform
- the cookies preferences (allowed or not)
- the Do Not Track preferences (yes, no or not communicated)
- the timezone
- the screen resolution and its color depth
- the use of local storage
- the use of session storage
- a picture rendered with the HTML Canvas element
- a picture rendered with WebGL
- the presence of AdBlock
- the list of fonts
Is browser fingerprinting accurate?
Some researchers have found this method of identification to be extremely effective.
Why is this being done?
Browser fingerprinting is just another tool to identify and track people as they browse the web. There are many different entities – both corporate and government – that are monitoring internet activity, and they all have different reasons for doing so. Advertisers and marketers find this technique useful to acquire more data on users, which in turn leads to more advertising revenue.
Some websites use browser fingerprinting to detect potential fraud, such as banks or dating websites, so it’s not always nefarious.
Surveillance agencies could also use this to identify people who are employing other privacy measures to cloak their IP address and location, such as with VPN services or the Tor (onion) network.
Browser fingerprinting test websites
One good test website to see all of the information that is being revealed by your browser is
ipleak.net.
With ipleak.net, you will want to scroll down to the “Geek Details” section where you will be able to see:
- Detected information
- System information
- Screen information
- Plugins information
- Mime-Types information
- HTTP Request Headers
There are also a few websites that reveal browser data and also assess a “uniqueness” score based on your variables in comparison to their database of browsers.
- amiunique.org is another good resource. It is open source and provides more information and updated fingerprinting techniques, including webGL and canvas.
- Cover Your Tracks is run by the Electronic Frontier Foundation. You can learn more here.
Cover Your Tracks is the updated version of a project the EFF has been working on for many years. It gives you a pretty good picture of how susceptible your browser is to finger printing.
How to mitigate your browser fingerprint
Before we jump into potential solutions, it’s important to note that implementing browser fingerprinting protection methods may break some websites. Be sure to research these different options carefully before adjusting your browser settings.
Another consideration is your threat model. How much privacy do you need or want? The answer to that question will be different for every user.
Lastly, I use the word “mitigate” rather than “solve” because browser fingerprinting is a very complex and evolving issue. For example, a new study revealed that there’s nothing you can do to mitigate some fingerprinting attacks on smartphones (discussed more below).
Here are some good ways to mitigate your browser fingerprint:
1. Browser modifications and tweaks
Depending on the browser you are using, you might have some different options for tweaks and modifications to mitigate browser fingerprinting. Below we’ll discuss various Firefox and Brave browsers, which are both secure and private browsers.
Brave browser fingerprinting
Although it is based on Chromium, the Brave Browser may be a good option for those wanting a simple, privacy-focused browser that blocks tracking by default and still supports Chrome extensions. Brave allows you to enable fingerprinting protection, which is under the Brave Shields settings:
See also this article on Github discussing different aspects of fingerprinting protection in Brave.
Firefox browser fingerprinting
Firefox is a good browser for privacy and security, and it can also be modified and hardened for your unique needs. (For an overview of Firefox privacy tweaks, see the Firefox privacy guide.) The first thing you need to do is type about:config into the URL bar of Firefox, hit enter, then agree to “accept the risk” and make the following changes:
- privacy.resistFingerprinting (change to true) – Changing this value to true will offer some basic protection, but it’s far from a complete solution. The privacy.resistFingerprinting preference was added to Firefox as part of the Tor Uplift project and it continues to be improved.
- webgl.disabled (change to true) – WebGL is another tricky issue for privacy and security. Disabling this preference is generally a good idea – see some of the issues with WebGL here.
- media.peerconnection.enabled (change to false) – Disabling WebRTC is a good idea since this can reveal your true IP address, even when you are using a good VPN service. See the WebRTC leak guide for more details and how to disable WebRTC in other browsers.
- geo.enabled (change to false) – This disables geolocation tracking.
- privacy.firstparty.isolate (change to true) – This is another great update from the Tor Uplift project that isolates cookies to the first party domain.
Note: This is just a brief overview of changes that improve your privacy and help to mitigate your browser fingerprint. Nonetheless, there are many different factors that go into fingerprinting and you may still have a unique fingerprint even with these changes.
Firefox with the ghacks user.js file
Another great option is to run Firefox with a unique user.js file, such as the ghacks user.js. This is a custom Firefox configuration file that has been modified for more privacy and security. I like this option because it can save lots of time with setup and is regularly updated and improved. See the Wiki page for an overview and setup instructions.
When I tested a fresh install of Firefox with the ghacks user.js file, amiunique.org showed my browser fingerprint as as not unique.
2. Browser extensions and add-ons to minimize or spoof your fingerprint
There are a number of different browser extensions and add-ons that you may find useful. With that being said here are a few things to remember:
- Be careful with third-party extensions, which could potentially undermine your privacy and security.
- Be mindful that using extensions may make your browser fingerprint more unique (many factors).
Now that we’ve gotten those disclaimers out of the way, let’s examine some browser add-ons that may be useful:
Firefox browser:
- Canvasblocker by kkapsner – Protects against canvas fingerprinting methods (source on GitHub)
- Trace by AbsoluteDouble – Protects against various fingerprinting methods (source on GitHub)
- Chameleon by sereneblue – Allows you to spoof user agent values (source on GitHub)
There are many other Firefox add-ons you may want to consider as well, which are discussed in the Firefox privacy guide. Some of these add-ons are also available for Chromium-based browsers, such as Brave.
Some people recommend spoofing different user agents through a browser extension, while others suggest this is a bad idea because it might make you more “unique”. Of course, there are many factors to consider, but adding noise to your fingerprint may not be a bad strategy.
For example, with Chameleon, you can cycle through different user agents at various time intervals.
Now let’s look at another option for modifying your browser fingerprint: the use of virtual machines.
3. Virtual machines
You can also consider running different virtual machines, which can utilize different operating systems on your host computer. VirtualBox is FOSS and offers an easy way to run different Linux VMs for more privacy and security. There are many different video tutorials online, depending on your operating system and the VM OS you are looking to use.
Virtual machines offer numerous advantages in terms of privacy and security, while also protecting your host machine. For privacy, VMs allow you to easily spoof different operating systems and also chain VPN services, as explained in the multi-hop VPN guide. This also helps keep your host machine secure by isolating a virtual environment. If the VM were to be compromised, simply delete it and create a new one. You can also use different VMs for different purposes.
4. Tor Browser
Another option is to use the Tor browser, which is simply a hardened and protected version of Firefox. It includes numerous privacy and security modifications that are built into the default version:
- HTTPS Everywhere
- NoScript
- Anti-tracking features
- Canvas image extraction blocked
- WebGL blocked
- Operating system cloaking (shows as Windows 7 for all users)
- Timezone and language preferences blocked
The key here is to use the default version (the developers do not recommend adding any plugins or extensions because this could compromise the browser’s effectiveness).
You can get the latest version of the Tor browser here.
The default version of the Tor browser is configured to run with the Tor (anonymous/onion) network. While the Tor network does have added benefits in terms of privacy, it also has a number of disadvantages:
- Your internet speed will be reduced to around 2 Mbps, making streaming videos or music nearly impossible
- Tor only encrypts traffic through the browser, rather than encrypting all traffic on your operating system like a VPN
- Tor is vulnerable to IP leaks, especially with Windows
- Tor is not safe to use when torrenting (see the Best VPNs for Torrenting guide)
- Tor was created by the US government and is still funded largely by US government grants
- Some consider Tor to be compromised
Ultimately, like all privacy tools, Tor has both pros and cons.
Note: You can also first connect to a VPN and then load the Tor browser as normal with the VPN running in the background. This will hide your real IP address from malicious Tor nodes and give you an extra layer of protection.
5. Don’t expect much privacy on a smart phones
As we’ve covered before, most “smart” devices are data collection tools for various entities.
Smart phones are especially vulnerable to browser fingerprinting. A team of researchers at Cambridge published a paper highlighting how smartphones can be fingerprinted using internal sensors – and there’s nothing the user can do about it.
The paper delves into the technical details, but here’s a brief overview of their findings:
- The attack can be launched by any website you visit or any app you use on a vulnerable device without requiring any explicit confirmation or consent from you.
- The attack takes less than one second to generate a fingerprint.
- The attack can generate a globally unique fingerprint for iOS devices.
- The calibration fingerprint never changes, even after a factory reset.
- The attack provides an effective means to track you as you browse across the web and move between apps on your phone.
Aside from the sensor issue, there are many other reasons for avoiding smart phones if you expect privacy. See our article on controlling communication channels for more info on this topic.
Use a good VPN service
Although a VPN alone won’t protect you against browser fingerprinting, it is a very important privacy tool to hide your IP address, hide your location, and keep your data secure.
If you’re not using a good VPN, your internet provider can easily monitor all your online activity by recording your DNS requests. In many countries, such as the UK and Australia, this is mandatory. Internet providers in the US can also monitor and record their users, and since March 2017, they can also sell this information to third parties (advertisers).
An interesting report from the Federal Trade Commission in the US highlighted how all major internet providers are collecting vast amounts of private data and sharing this data within a wide network of partners. See our article for more details:
Internet Service Providers are Logging EVERYTHING You Do Online
Going through all the hassle to protect yourself against browser fingerprinting may be a waste of time if you aren’t using a good VPN that will encrypt your internet connection and hide your IP address and location. The best VPN services report discusses the top recommendations based on the latest results.
For those who are seeking a higher level of online anonymity, you can also use a multi-hop VPN, which will encrypt your traffic across more than one server (multiple hops) before exiting onto the regular internet.
As mentioned above, combining VPNs also adds additional privacy and security while distributing trust across different VPN providers.
Browser Fingerprinting FAQs
Below are some of the other questions we see regarding browser fingerprinting.
Browser fingerprinting is a method to identify and track you online based on numerous different variables, including your operating system, timezone, browser headers, plugins, cookie preferences, tracking preferences, screen resolution and more. By aggregating these browser variables, third parties can create a unique fingerprint of your browser so that you can be identified and tracked online.
Browser fingerprinting is used primarily by advertising agencies and data brokers. By creating a unique browser fingerprint, ad agencies and data brokers can track your activities as you browse different websites. Your browsing activity can then be linked to your unique browser fingerprint, which allows you be targeted with ads based on your online activities. Additionally, your activities and identity can be sold to third parties by data brokers and other ad-tech intermediaries.
No, a VPN alone will not protect you against browser fingerprinting. While a VPN will hide your true ISP-assigned IP address and location, it will not protect you against browser fingerprinting, which is based on unique variables without your browser and operating system. To protect yourself against browser fingerprinting, you will need to modify the settings within your browser, as we describe above. However, you should still use a VPN to hide your IP address and location to better protect your online privacy.
Private browsing alone will not protect you from browser fingerprinting and it also won’t hide your IP address or location. In essence, private browsing is not actually private. We explain why incognito/private browsing is not private and the steps you can take to actually have more privacy and security online with your browser.
Use browser fingerprinting protection in 2022
While browser fingerprinting may seem like a daunting issue to some, mitigating your browser fingerprint is relatively easy. For those seeking the highest levels of privacy and security, I’d recommend utilizing virtual machines and perhaps chaining different VPN services (using more than one VPN at the same time).
As a general rule of thumb, Firefox remains a great all-around browser after some modifications and configuration. The secure browsers guide also discusses various options, while the Firefox privacy modifications guide takes a deep-dive into tweaks, extensions, and custom configuration.
Another issue to consider, which was not mentioned in this guide, is using a good ad blocker. Ads today basically function as tracking – they record your browsing habits so you can be hit with targeted advertisements. A good add-on is uBlock Origin, but there are other recommendations in the ad blocker article and privacy tools guide.
Stay safe, secure, and private in 2022 and beyond. We’re all being watched.
Hi Sven. Regarding the sensors fingerprinting you’ve stated above, it can be mitigated by only installing open source and trusted apps can’t it? So big tech apps that will likely use the sensors data, like Facebook or Google, should be avoided.
It’s said too that the sensors fingerprinting can also be done through websites. However, to overcome this, Google and Apple have implemented motion sensors access control in their browser settings haven’t they? So that you can block sites from accessing these sensors. I’ve checked my browser settings, and it’s blocked by default (I’m using a Chromium-based browser).
Hi Klaus, yes, using trustworthy open source apps is a great idea to mitigate privacy risks. Yes, Apple and Google have said there are restrictions on sensor data, but who knows.
Klaus is right. There’s actually something you can do about it. It’s by blocking sites from accessing the sensors. As for Apps, there’s this OS (a fork of Android) that allows you to disable sensor access for Apps. For what it’s worth, I’d say this article should be updated.
What about this?: https://fingerprintjs.com/blog/disabling-javascript-wont-stop-fingerprinting/
I was just going to provide the same website as it is where I test my fingerprint vulnerability.
The only Chromium/Firefox extension I’ve found that actually can spoof this site is called “Fingerprint Spoofing” by leelei. The extension is quite draconian though and can break sites.
Recently, chromium-based browsers added chrome:flags which is the same as about:config for gecko-based browsers
Do you will upload anytime soon a tutorial like Firefox has but with Brave and their brave:flags? Thank you for reading!
Probably not because Brave gives you lots of control in a user-friendly control panel with the Shields options. It’s pretty self-explanatory.
Thank you! I noticed that if you use v96 ghacks/arkenfox user.js you are not gonna need to enable FPI anymore because they moved to dinamic-FPI (reference: https://github.com/arkenfox/user.js/issues/1281) and according to Librewolf docs: dFPI, also known as Total Cookie Protection, is a newer implementation and it causes less breakage, plus it is included by default when using Tracking Protection in Strict mode. Never change it to Custom mode because it will disable it! Besides that, i think its not recommended to use Librewolf or other third-party Firefox binaries (except Tor if you really need it for your threat modeling) when you hardened it with your own user-overrides.js settings.
Hi RP Community,
I would like to hear peoples thoughts on Privacy Badger.
Comments recently have suggested that it hasn’t been actively maintained for over two years.
I am wondering where this information comes from?
EFF still has it listed as a tool they supply.
I just read an interesting article (to me at least) on how browser extensions can lead to fingerprinting.
I feel it is relevant to many of the question on extensions that have been asked recently.
https://www.eff.org/deeplinks/2020/10/privacy-badger-changing-protect-you-better
For me, until recently, I was adding every (nearly but not really) Mozilla recommended privacy extension;
Than I took a minimalist approach and cut back to UBlock Origin and another tool (not a privacy one)
Two extensions only.
As I have been learning, my belief is a good approach is to pick a good tool (for me Ublock Origin);
and learn to utilise it to it’s potential before adding another tool.
I am thinking of adding Privacy Badger;
And I would welcome the communities thoughts?
Regards,
BoBeX
Hi BoBeX!
I did the same thing a few weeks ago… all gone except for uBlock! (An amazing tool/extension, IMO.)
Have added Privacy Badger and Privacy Possum since. (I consider myself at a low threat level. I just want enough “tinkering/adjustment” to optimize my browsing.) Neither PB nor PP slow down anything and do their respective thing automatically including automated updates. I believe they compliment each other and do not duplicate functions of uBlock. (Don’t know for sure though.)
(I also have one browser I have hardened just for accounts with passwords.
An other browser just for news…. in addition to various other browsers I have checked out for the right features.)
I’m right now looking at and reading the version date at the bottom left (very faint) – says 2021.11.23.1! So the ‘2 year no maintenance’ statement I believe is quashed!
Best of luck to yu’ on going minimalist!!! Cheers, George
(BTW… I’m no geek, but I think the whole fingerprinting thing with the “unique” attribute is seriously overdone/overrated and academic. I’ve tested for over a year now and I ALWAYS COME UP AS UNIQUE!!! So the F what??? That said, I could be completely wrong on my take! LOL
I use only Badger in Firefox for some time, even though I like Origin and I always used it throughout the years. Badger seems enough if you set all in FF as recommended and set your Network to go through DNS ad blocker (I recommend AdGuard DNS). In case you set DNS, you may also use a VPN add-on as well.
Very good tip Bronco… I’ll give it a go! Cheers, George
@Bronco, With Badger, do you use Badger Sett or local learning?
I have NordVPN with CyberSec enabled, do you still think I need more DNS protection?
With Origin, I really like the idea of customising it to suit the particular purpose I have for a browser in a browser segmentation framework.
I do believe Badger will compliment this in fit for purpose cases
@George I do believe PB compliments other ADBlocker tools due to it’s local heuristic learning – rather than reliance on predetermined lists.
Before I read the article I posted above, I thought PB’s move away form heuristic diminished it’s capability.
The “Badger Sett” I assume is ~95% as good as the local learning (now turned off by default)
And local learning can be turned back on (understanding the risks outlined in the article)
I am looking into browser compartmentalization with he mind to make UBlock Origin my primary tool. I think in some cases PB will be complimentary to it.
On PP, it was one of the many tools I had previously installed and it still appears in FF recommended. I always did find it hard to find much documentation and reviews of PP.
I recently read their Github and I still like their concept;
But I am unsure if they are big enough to be providing security really well (like EEF) and to draw the attention of Google security team if there is a vulnerability.
This said, I can’t criticise PP, I am just not sure.
All ways great to hear from a fellow Commonwealth countrymen
BoBeX
Hi BoBeX,
I think Privacy Possum was/is the one that hasn’t been updated in two years. (2019-2021)
I’ve no experience in using Privacy Badger. Privacy Badger works like Safari Intelligent Tracking Protection (ITP) which is based on local learning or heuristics. Now, Privacy Badger mainly uses Badger Sett as basis for predetermined or known trackers. Likewise, Safari now also includes known trackers database (from DuckDuckGo) but local learning is still on by default unlike Privacy Badger.
EasyList, AdGuard, Ghostery, Disconnect and DuckDuckGo—these ad/tracker filters are similar but not 100% identical. One may be stronger/stricter/more bloated than the other. Badger Sett claims to be unique from those because its tracker list is automated rather than handcrafted by community. Badger Sett learns from 1000s of popular websites listed by Tranco.
Should you use Privacy Badger with uBlock Origin or other ad blockers? I think it’s not necessary due to redundancy but there’s probably no harm either in terms of ad blocking quality or computer performance.
Different Question: how do we configure the browser so that it sends wrong “user agent info” ( I am referring things such as the OS used, display information such as width(height etc.). Tor browser and Librewolf do this but how would we accomplish that with Firefox/Ungoogled Chromium ?
@JanesaidNO(UC) th answer is that hey ready do
Firefox>about:config>privacy.resistFingerprinting, it changes the display information.
The AmIUnique website contains a job posting whose deadline for application expired more than 3 months ago. How seriously should we take these people if they can’t keep a silly mistake like this from happening?
Correct me if I’m wrong, but after checking my browser fingerprint over the years on sites like Browser Leaks, Jondonym, and Device Info, it seems to me that it’s Javascript that’s the real problem here. With it on, all kinds of info gets revealed, with it off, almost nothing. Javascript can of course be turned off with uBlock, but the web becomes far less interesting (and usable) without it. I’m not a programmer by any means, but I wonder if it would it be possible to create another programming language that does the same thing but without revealing so much about the user (I always think of it as “livescript,” its old name, because it’s a better description of what it does and keeps me from confusing it with Java.)
@glix
It is great to read from people who test, thanks for sharing your tools and I will be keen to look into those myself.
Restorer provided a test link which demonstrates blocking JS doesn’t mitigate browser fingerprinting:
https://noscriptfingerprint.com
(Joke – Where did Restorer go? He is probably with Heinrich. Nobody knows where he is)
I found a great tutorial on UBlock Origin:
(@glix, I am in no way meaning to indicate that you yourself need this – I am just sharing)
https://www.youtube.com/watch?v=2lisQQmWQkY
For me it was an easier entry point than stating with UBlock Origin’s documentation
(The author of the video accepts that his video has been recommended by Raymond Hill – it is right at the top of the comments – though I don’t know where this recommendation occurred)
But to return to an on point reply to @glix, JS is a problem; No script is recommended but it is noted as very hard. My question is does anyone have a resource that provides an easy entry point into NoScript?
Hi! The recommendation ocurred in the “Dynamic filtering” section of the Wiki.
https://github.com/gorhill/uBlock/wiki/Dynamic-filtering
How do you install the ghacks user.js file especially on Android? About: config is an invalid command on Android.
Additionally, many people are doing most of their work on mobile devices whether it’s their phones or tablets. There’s clearly a need and demand for anti-fingerprinting hacks for Android. There’s nothing we can do for iOS though.
You cannot use it on android. Firefox/fenix on android does not have such setup. Also, the teaks are only for PC firefox and practically cannot be used for mobile.
There are more things to consider on smartphone. If your OS is android (googled) or ios, whatever you do with your browser will not matter. Lets say you are viewing a website like instagram on your browser. You try to avoid getting fingerprinted as much as possible spoofing/resisting it. But, instead of viewing instagram in your browser you download its app. Then you are practically to all fingerprinting techniques and trying to resist fingerprint via browser will not matter.
https://github.com/arkenfox/user.js/issues/318#issuecomment-359181951
I have to disagree here, at least for iOS: SnowHaze is probably the only mobile browser that can successfully mitigate fingerprints. It’s about how this browser is made and how it works. SH is really unique in many respects. Brave is close in iOS, but it leaves much more traces than SH.
For me personally, trying to achieve lots of privacy on a mobile phone is a waste of time. Check out this article on controlling communication channels to see how challenging it really is.
However, for those who do use their mobile devices a lot, I can see how finding the right browser is important. We discuss some privacy-focused browser for mobile devices in our secure browser guide.
Brave leaves fingerprints and how can we trust a company that includes bitcoin garbage with the installation?
…continued
VM and change the guest window size. Obviously not an enjoyable browsing experience and not a solution.
https://noscriptfingerprint.com publish their documentation and obviously corporates do not – god knows what they are up to.
I believe there is a good solution in this but as said I am not close to being technical capable enough. I think it would be possible though.
What would be required is:
A custom hypervisor running a lightweight purpose built OS for browsing only.
It would be a fork of VirtualBox and a fork of a Linux distro;
It would draw on the Whonix and Nmap for lessons learned. (I myself, don’t know much about this)
Come finger print this; I have a custom hypervisor. (Insert here the emoji that gives them the finger)
F finger printers.
It could be very cleverly designed. Persistence (on/off) could be could be presented as tabs.
F Finger printers.
It just needs to be purpose built.
F finger printers
Regards,
BoBeX
Hi RP community,
I beat the last finger printer:
https://noscriptfingerprint.com
I had to read their documentation and have completed one and a half years of formal IT education.
It is not a workable or convenient and I am not technical capable to make it so.
Spoiler for anyone enjoying learning and testing themselves…
Can you share how you beat them?
Interesting. Changing privacy.resistFingerprinting disabled audio reading in reader view of Firefox.
Another website for browser fingerprinting: https://abrahamjuliot.github.io/creepjs/
Hi Sven, Restorer and RP Community,
I must thank Restorer for the finger print test sites he has shared.
I have posted on Restorer’s first two links below (basically custom FF with privacy extensions defeats both those (without no-script) and Brave is defeats both (only with script blocking).
This post discusses my (armature) testing of Restorers third link:
https://noscriptfingerprint.com
Firefox:
Fingerprinted.
Produces two distinct and repeatable finger prints. One distinct finger print on standard windows and a second distinct finger print on private windows.
Brave:
Fingerprinted.
The same finger print for standard windows, private windows and Tor windows.
Before go further I would encourage others to test this independently. The may be flaws in my testing methodology and / or configurations in my browser settings.
Firefox defeated both the first two sites without disabling JS which for me is the perfect solution. FF could not defeat the third link but produced two distinct and repeatable fingerprints for standard and private windows; this result is perplexing for me; but also may shine a light on a possible way to defeat the the finger printer. If the change from standard to private windows changes the finger print than this distinction may point to a solution to produce unique finger prints for all windows. The question raised is what changes and is it possible to implement this change for all windows?
The Brave results were for me both disappointing and disturbing. Brave out-of-the box (with a few standard changes) doesn’t defeat anything with out script blocking which for me makes browsing unpleasant. Disturbingly the Brave Tor window appears to off zero protection from finger printing, which to my mind makes it absolutely useless. My testing (which may be imperfect) leads me to hold a current view that Brave is far from what it promises to be – it appears to me to be a chromium browser with a built in add blocker. Offering Tor services that are defeated so easily is disturbing.
Regards,
BoBeX
That’s good BoBeX, I think I got the same results too more or less because I used only extensions and didn’t harden through config. For test #3 only one fingerprint for each browser.
As far as I know, in brave a fingerprint is randomized for each new session. So, if a user opens normal window, private window and tor window from the same session all of them will have same fingerprint. But, if the user opens a normal window, ends the session, opens a new session with private window, then the normal window from previous session and private window in this new session will have different fingerprint
I might be wrong though..
Websites to test browser fingerprinting:
1. https://nothingprivate.ml
2. https://fingerprintjs.com
3. https://noscriptfingerprint.com
Hi Restorer,
I started testing your first two listed sites against my browsers the other day and have only come back to it to day.
I have a modified FF (as per RP guide) and multiple privacy extension; and
Brave with some settings switched to high, aggressive etc.
https://nothingprivate.ml does not generate a fingerprint for either.
https://fingerprintjs.com does not fingerprint FF, but does fingerprint Brave. When I block ‘scripts’ on Brave it then too can’t be fingerprinted but this breaks things on other websites. My FF does not have ‘NoScript’ or JS blocked, it doesn’t break websites.
So based on your first two links, FF wins for me.
I’ll test your last link against my browsers and get back to you.
What is your experience?
Regards,
BoBeX
P.S. Does anyone else have fingerprinting test sites?
Hi Sven,
Further to my previous…
I just went and started looking into the Brave browser setting and I can’t seem to help myself by tweaking things. “Trackers”, I changed this to “aggressive”; “Fingerprinting,” i changed this to “strict”; “Social Media” – off, off, off.
My question is if I am going to use Brave to limit finger printing and tracking am I helping or hindering when making changes?
Regards,
BoBeX
It will help because trackers are blocked and noise or random values will be added to fingerprints.
Hi Restorer,
Thank you for your reply.
This is the technical information I was after. I had previously looked into tracker blocking and creating ‘noise’. I was using privacy possum to achieve this.
You seem very cluey. Please let me throw another technical question to you. Just thinking of ‘noise,’ which would be more difficult to finger print a FF browser with Privacy Possum installed or Brave with aggressive setting on?
Thankyou for your advise
Regards
BoBeX
Hello BoBex, you’re welcome. Well I’m no expert but I’ll help where I can!
I’m not familiar with Privacy Possum but it seems to be quite outdated (last version was 2019, might still work today but not sure about coming months). Some if not most of its features are already baked in Firefox such as block 3rd party cookies, block trackers, block fingerprinting. I’m not sure if Firefox adds noise to fingerprint like Possum. As for me, I use canvas fingerprint defender by ilGur on my Firefox.
About Firefox vs Brave fingerprint protection, I think they should provide equal protection. Here, you can test browser fingerprinting using these sites:
1. https://nothingprivate.ml
2. https://fingerprintjs.com
Make sure you pass #1 before going #2 test because #2 is stronger. To test, open the website in a tab/window to be recognized, then open a new tab/window and type the same website address to see if you’re trackable or fingerprintable.
Hi Sven,
Great guide!
This guide has finally convinced me to use the Brave browser (Have never been opposed to Brave I just like the idea of using Firefox to maintain diversity in the market place). My thoughts are that the Brave out of the box experience should be be harder to finger print than a highly customised Firefox? What are your thoughts?
My new plan is to use Firefox for Youtube; Brave for browsing and research and Chrome for business. (Its not a privacy extension but “Youtube Enhancer” is so good.)
Regards,
BoBeX
Why use Chrome for business? Have you tested Brave for business instead? It’s also based on Chromium, just more private. Should work OK.
For Firefox, install multi account containers extensions eg Firefox container, Temporary containers and/or SnowHaze containers. Use containers to isolate website activities and data (cookies, script etc.). It’ll be the same as having multiple Firefox browsers.
Hi Restorer,
Thank you for your kind reply.
When I said ‘business’ I meant ‘personal business’ not ‘commercial business. All my stuff is linked to a Gmail account and will be very time consuming to change. For the time being, I erase my account info regularly, they say they delete all collected data. My view is that if all this stuff is linked to a gmail account changing the browser would be of little value (though I could be wrong) I don’t use the in app Chrome P/W manager. I believe Chrome to be a very secure browser (I am not suggesting other browsers are not) and this too is important to me.
I do believe account and browser segmentation is a very powerful and convenient privacy tool and personal organisational method. I note your suggestion for account containers, I prefer segmentation. I don’t know if one is more private than the other but I like to segment both on the browser and account, it’s easier for me cognitively.
Thanks again for your advice. It is welcomed.
Regards,
BoBeX
You are using gmail. Then browser fingerprinting will not matter as you already in their system. And everything you do will be in vain
Trace looks good , he should add euro opion too so i could buy it