Why does JavaScript that compares window.screen.availHeight and window.innerHeight help me to detect Tor browser?

Question

For some website we're working on, I've been asked to detect if users are using the Tor browser.

Looking around this came up: https://stackoverflow.com/a/28202492

From that answer, a quick and dirty way of detecting the Tor browser would be to check client-side for the equality of the innerHeight and availHeight properties (plus their width analogues). At the moment, I have JavaScript like the following:

var detect_tor_browser = function () {
  return (window.screen.availHeight === window.innerHeight) && (window.screen.availWidth === window.innerWidth);
}

In my admittedly limited testing, this seems to work.

Why can I sometimes detect the Tor browser by checking for equality of those properties client-side?

Answer 1

Tor Browser does not try to hide the fact that it is Tor Browser.

As such detecting that it is Tor Browser isn't a concern, being able to detect a specific instance/user of Tor Browser would be.

From The Design and Implementation of the Tor Browser:

When applying a form of defense to a specific fingerprinting vector or source, there are two general strategies available: either the implementation for all users of a single browser version can be made to behave as uniformly as possible, or the user agent can attempt to randomize its behavior so that each interaction between a user and a site provides a different fingerprint.

Although some research suggests that randomization can be effective, so far striving for uniformity has generally proved to be a better strategy for Tor Browser...

There are other ways you could detect if they are using Tor Browser too, there's no guarantee that the javascript method will work (e.g. you can disable javascript).

A very simple method is to host some .css or .js in an .onion URL and try to load it onto the page. If the user can fetch it, they're using Tor (even if it's not Tor Browser). That code can then influence the page content to advise Tor users about, for example, an alternative onion service where the site is available like this https://github.com/epidemics-scepticism/onion-redir