On one hand, I am thinking that due to having to load all elements afresh when visiting a page, I appear more like a fresh 'New Identity' (thus decreasing linkability and trackability across Tor IPs within one Identity), EVERY single time I load a page; but then I'm wondering how much of a fingerprinting issue it also raises, decreasing anonymity instead.
Is it a case of an anonymity trade-off? (An analogy would be: using an email masking service where you're trading having 1000 websites all knowing your email address and having it stored on all of their vulnerable, breachable servers, for ONE website having the outline to your entire digital life and storing those same 1000 sites in one solitary but juicy basket, on THEIR potentially, equally breachable server.)
Would it be a similar trade-off here?
Perhaps it depends what other anti-tracking add-ons and settings you have enabled. For me, I have:
- NoScript set to global blocking
- Third party cookies blocked via FF settings
- Self-Destructing Cookies with default set to expire 'after you close the tab' (so I assume with such cookie sanitizing I will more properly look like a truly fresh user on every given page)
- RefControl with default set to 'no referrer' (again, making sure that I truly come across to every page as if I've literally entered the URL into the address bar and visited the page for the first time, ever)
- RequestPolicy to massively sandbox every domain I visit to keep other domains from knowing I'm visiting that domain (via blocking third-part cross-site images, scripts, css, scripts, objects, etc.)
layout.css.visited_links_enabledset to false in
about:config(to plug this in case you have enabled history)
- FlashBlock and BetterPrivacy
- HTTP Nowhere to block EVERY HTTP connection in the entire Tor Browser (short of direct handshakes to establish a domain's HTTPS with the Firefox default trusted CA store)
So although it's very unusual behaviour, I'm guessing that it still gives stronger anonymity for each individual site I visit, via my stringent blocking of cross-site object tracking. I simply come off as a phantom user, someone maybe visiting the page from a saved bookmark, just with a Tor IP / User Agent / HTTP_ACCEPT Headers, no previous identifiable cookie, and a few other 'blank' returns that just make me look like a total unlinkable (but unique) ghost, to that one site.
To me, that's anonymous, IF that unique behaviour can't be linked, by that website's sysadmin, to other sites, which unless there was some collaboration or communication between the two (and it would have to be so for every single site on the web, two-way), I don't think is likely.
Or is the issue, that parties like the NSA, who are hoovering EVERYTHING up in their servers, will be the ones that can detect this extremely unique fingerprint across multiple sites, and so this being useless against the NSA and I should just fall back to 'crowd anonimity' once more?
Is it a case of, would I rather look more anonymous to the NSA, or more anonymous to each website that I visit on the Internet?
If so, is there a set of behaviours that can then combine the best of both worlds, with more knowledge of how TBB's default crowd behaviour of cache expiry, cookie settings, session length (how quickly things are 'reset' by default in TBB already), and other such fingerprinting considerations, work?