Figured I’d give this a shot with LibreWolf, NoScript, CanvasBlocker. First of all, NOTHING loads without JavaScript. Simple websites should work without. What it got wrong: CPU core count, display resolution, timezone.
I do actually feel a bit safer with these, mostly due to NoScript, because arbitrary domains can’t run code on my system and even begin to try and collect that kind of information. I really do wish we could go back to JavaScript not being required, only enhancing UX here and there.
Funny enough, I have noticed some big sites have reversed course on what loads with out JavaScript.
e.g. Amazon is the biggest one I noticed, obvious reasons for them, somewhat functional without JavaScript running (go back a month or so and you couldn’t do shit), though you still have to enable js to go through pictures etc. Not getting any more of my money, but it was definitely funny to see
Good old times… Unfortunately, as that website points out, it doesn’t really matter if it detects incorrect values: for fingerprinting it’s sufficient that the values be "consistent* through visits, even if wrong.
I’m not sure whether it needs JavaScript to read the values? I’d like to know.
If it reports the same values for everyone, or randomizes them every start (like display resolution and timezone), then it becomes less useful for fingerprinting. In fact, it calculated a different fingerprint altogether this time, though it did know it was the second time I visited.
I’m not sure whether it needs JavaScript to read the values? I’d like to know.
Yeah no, it actually will need JS for most of that information. Otherwise the server will just get the HTTP request header which includes your browser’s user-agent and some other less identifying stuff, plus maybe your IP (unless you’re behind a VPN).
Yeah no, it actually will need JS for most of that information.
99% of the Internet doesn’t work without JS. Yes, having a script blocker that blocks google static & whatever else will help you some, but it’s not perfect & this type of script blocking specifically is under heavy attack right now.
Thanks for the useful info!
Indeed randomizers are good. But as you wrote, it’s sad that so many sites just don’t work, or work badly if one alters some of those values…
Maybe the long-distance future of sane people will be I2P or similar infrastructures…
Letterboxing could help here making consistency a bit more random by setting each websites height/width to different values. Mullvad-browser does this by default. I think on other FF forks you have to turn it on in about:config.
There are valid reasons for websites to use JavaScript, but I agree that especially nowadys with the modern HTML and CSS standards a lot can be done without it.
Figured I’d give this a shot with LibreWolf, NoScript, CanvasBlocker. First of all, NOTHING loads without JavaScript. Simple websites should work without. What it got wrong: CPU core count, display resolution, timezone.
I do actually feel a bit safer with these, mostly due to NoScript, because arbitrary domains can’t run code on my system and even begin to try and collect that kind of information. I really do wish we could go back to JavaScript not being required, only enhancing UX here and there.
Funny enough, I have noticed some big sites have reversed course on what loads with out JavaScript.
e.g. Amazon is the biggest one I noticed, obvious reasons for them, somewhat functional without JavaScript running (go back a month or so and you couldn’t do shit), though you still have to enable js to go through pictures etc. Not getting any more of my money, but it was definitely funny to see
Good old times… Unfortunately, as that website points out, it doesn’t really matter if it detects incorrect values: for fingerprinting it’s sufficient that the values be "consistent* through visits, even if wrong.
I’m not sure whether it needs JavaScript to read the values? I’d like to know.
If it reports the same values for everyone, or randomizes them every start (like display resolution and timezone), then it becomes less useful for fingerprinting. In fact, it calculated a different fingerprint altogether this time, though it did know it was the second time I visited.
Yeah no, it actually will need JS for most of that information. Otherwise the server will just get the HTTP request header which includes your browser’s user-agent and some other less identifying stuff, plus maybe your IP (unless you’re behind a VPN).
99% of the Internet doesn’t work without JS. Yes, having a script blocker that blocks google static & whatever else will help you some, but it’s not perfect & this type of script blocking specifically is under heavy attack right now.
Thanks for the useful info! Indeed randomizers are good. But as you wrote, it’s sad that so many sites just don’t work, or work badly if one alters some of those values…
Maybe the long-distance future of sane people will be I2P or similar infrastructures…
Letterboxing could help here making consistency a bit more random by setting each websites height/width to different values. Mullvad-browser does this by default. I think on other FF forks you have to turn it on in about:config.
There are valid reasons for websites to use JavaScript, but I agree that especially nowadys with the modern HTML and CSS standards a lot can be done without it.