Does browser fingerprinting leak data only to the server that is answering my request, or also to my ISP or other network-level eavesdropper? Assuming HTTPS (HTTP should leak to the HTTPS "leak set" plus the exit node, I imagine).
Add a comment
|
3 Answers
When using Tor the metadata provided by your browser (the data primarily used for fingerprinting) is only accessible to the server as all communication between you and the server is encrypted. If you were not using HTTPS, third parties between the tor exit node and the server would also be able to get the browser metadata.
Only to the person answering the request (unless there is a faulty SSL setup at their end, which is very unlikely). There are also ways you can avoid sending "fingerprintable" headers at all, but I wouldn't bother.
The accepted answer is only partly correct. Such fingerprinting data is common to be sold to others by tracking websites. It's a real market out there. So in the first step your data on an HTTPS connection might only be at that server, but whoever is behind that server might decide to sell you to the highest bidder.
