3

Yesterday I put some effort into getting the best "score" I can on Panopticlick. The following is my result:

panopticlick result

I did several things to get the lowest numbers for "unique in x browsers".

  • I looked up what the most common screen resolution is and set my browser to it. It's not the default setting of the TOR browser though.
  • I've tried several user agent strings and it seems an empty string is way better than others.
  • I deactivated WebGL, so that the WebGL canvas thing cannot be used.
  • I got an addon to block HTML5 canvas and that asks me whenever someone tries to use HTML5 canvas on a site - shocking how often that is! But when I use it consequently on panopticlick, the test stops working at the last step, not letting me see the results, so that is not included in the screenshots. (Is there a better way to test my "uniqueness" somewhere?)
  • I can deactivate the JS, but then I'd not see the information about all the things, which can be exploited when I have JS on, so that's also not in the screenshot.

However, despite all this effort, it seems I am still unique in 145k browsers. If I am still a unique profile, then all the confusion created by the TOR network is for naught, if someone really wanted to track me. If I multiply those "unique in x browsers" numbers together, I'd get the combined "uniqueness" when someone considers really all of the listed things there. The number is still sooooo high, I am still far from a not unique fingerprint. Now the question is:

Can I still improve this? If so, how?

And for everyone else I hope you have use for this configuration and that it helps you.

7

This approach of trying to shoehorn yourself into the middle of the bellcurve is ultimately destined to fail. Part of the problem is that you seem to be viewing each part of the various things they fingerprint on as a distinct challenge to approach and try and sit in the middle of the bellcurve of for all browsers.

Instead, an observer knows you're using Tor Browser, Panopticlick is measuring how unique your own Tor Browser is against the set of all browser. You should instead be considering how you look amongst all other Tor Browser users. You are adding granularity to a previously smooth surface of Tor Browser users, you stand out from other Tor Browser users rather than blend in with them, with every change you make.

While fingerprinting methods like Canvas, AudioContext and other features might leak information about configuration specifics and need to be addressed with patching or being disabled making your own "special snowflake" changes might make panopticlick say your browser is less unique amongst the set of all browsers in truth you're making yourself stand out from the set of Tor Browsers and harming your anonymity.

Recommended reading: The Design and Implementation of the Tor Browser


Response to comment(s):

"that is what your argumentation is based"

Not entirely, they don't need to know what your browser is, just that it doesn't match any known fingerprints which almost all other stock browsers (even with "privacy" add-ons) will. It's a bit like the famous "parable" or "urban legend" of the thief who removed his fingerprints and then was the only person who didn't have any fingerprints, making him the only suspect when they found the blank set of fingerprints at the scene of the crime.

"how would an observer know that? [x and y guess incorrectly]"

Most browser fingerprintings sites are pretty naive PoC attempts, they're not performing advanced fingerprinting. One tell-tale sign, for example that a user is using Tor Browser would be to try to canvas fingerprint them. If you get back a hash of an empty string, they're probably using Tor Browser because currently no other browser implements that functionality. More advanced fingerprinting methods that are much harder to hide would be how it renders the page, given a page with a series of resources to be loaded embedded into the page, the order and means by which it loads each of the sub resources can be used as a distinguisher between browser engines (gecko, webkit, trident, etc) because each has it's own parser. Other distinguisher that are often overlooked are accepted encoding types and content types, especially given a specific context and file extension, what sort of images do you support? What sort of compression do you support? What about your TLS Cipher Suite?

As such (and as suggested in the original answer) your efforts would be best served at blending into the crowd or Tor Browser users as best as possible, providing as little distinguishability as possible.

  • You're stating, that an observer knows what browser I am using and that is what your argumentation is based on. If that's true, you're probably right, however, how would an observer know that? For example on this site: computec.ch/projekte/browserrecon/?s=scan it guesses wrong actually. Can you provide a website, which correctly identifies my browser, to prove your point? Found another one: whatismybrowser.com also tells me it cannot know. – Zelphir Kaltstahl Jun 6 '16 at 22:21
  • see my updated answer – cacahuatl Jun 6 '16 at 23:04
  • I think I get it now. Provided, it is impossible to get around all those approaches (especially the order of the loading of resources seems hard to get around for a user, if it's really that different between browsers), it would really rather make me stand out, if I changed anything in my TOR browser to get better scores. In this case, I'd have to A: look like most FF users and be as common as possible, or B: look like TOR browser and not change anything, hoping that others didn't change anything either. Question is then what is more common. – Zelphir Kaltstahl Jun 6 '16 at 23:27
  • Also could a server differentiate between those fingerprinting method's results in a standard FF and in TOR? Because if they couldn't, then my approach would actually work (Or would they simple be able to check for TOR network exit node to determine?). One would have to compare the differences between standard FF and TOR, I guess. – Zelphir Kaltstahl Jun 6 '16 at 23:29
  • 2
    They would be able to easily determine that you are using Tor Browser, by for example asking you to load a resource with a tag at a seconary domain that they control in a new window or by changing the window, this would mean you'd use two different circuits and show that one users traffic was exiting in multiple locations and the list of Tor exit addresses are publicly available. This behaviour is also unique to Tor Browser. Appearing as stock firefox would not work, they could determine you were using Tor Browser. – cacahuatl Jun 6 '16 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.