Tor vs Brave - which is technically more effective to hinder user tracking - fingerprint generalization or randomization?

Question

TOR's method to countering fingerprinting is to make as many users "appear the same" as possible, let us call this to "generalize". While Brave tries to randomize all fingerprints of each and every user in a unique way (for each new opened session).

A short quote from Brave to get the context (as you are all Tor experts, I am not quoting Tor).

"We're adding subtle, non-human perceivable noise to the JS readable outputs of the audio, canvas and WebGL APIs. The randomized end points give you unlinkability across sessions for (for any fingerprinter who consumes a randomized endpoint)"

https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections

Question can you please explain: Which of those two methods (randomize vs generalize fingerprints) is technically more effective in making it more difficult to track/pinpoint that a user across weeks of different browsing sessions is the same user?

This is about technical facts not opinions. I am not a expert, but I assume that this is a clear technical question and experts should be able to tell the difference of both approaches's impact on user identification.

Thanks

Answer 1

I think you're not going to get a lot of good answers because no one has done a study comparing the two in detail and AFAIK that hasn't been done yet.

If we think about it, The Tor Project wants everyone to look like a white sheep that is indistinguishable from all other white sheep. Brave makes you look like you are wearing a "shimmer suit" from A Scanner Darkly.

Which one is more or less likely to get you fingerprinted? That's to be determined. However, there is more to it than that. Tor Browser is heavily locked down and does not allow any changed that aren't already planned for a tested. We really don't know the security testing practice at Brave. It is a general purpose browser. However, Tor Browser has a single purpose and that is anonymity.

Also the fact that it is using Chromium will give some people pause because they don't trust anything from Google for good reason. However, Mozilla is not completely pure and innocent either and have their share of history when it comes to data privacy.

To summarize, there isn't much to say until more people take Brave seriously as a tool for Tor and independent research is done. I personally feel safe enough to use it as my daily driver browser, but if I am in a situation where my anonymity is of the utmost importance, I will use Tor Browser.

Answer 2

TBB's generalization beats Brave's randomization.

If you view a product page on Amazon using TBB, then go off and read product reviews on another site for a while, then go back to Amazon, Amazon won't be able to tell that the two product views are from the same user. All Amazon will be able to tell is that the two views are from people using TBB.

If you view a product page on Amazon using Brave, Amazon will be able to catch your session fingerprint, and then tell that all other product views from that fingerprint are from the same user. (In theory, Amazon could then track you across session fingerprints based on what sorts of products you view, but I don't think they actually do this -- the downsides of false positives outweigh the advantages.)