I have JavaScript turned off, and so no leakage of screen resolution to Panopticlick.eff.org fingerprint testing tool.

However, JonDonym's one - ip-check.info - has an alarming-looking vector down the bottom called 'Browser window'. Even with JS off, this value persists, and reveals even more uniqueness than the 'outer' screen resolution itself can - if you have Firefox's Menu Bar showing, the value changes - if you even zoom in (e.g. use NoSquint add-on on a larger screen), it changes, in fact it's in real-time as you change anything inside Firefox that affects the 'inner' window dimensions itself!

Without using JS, Flash or anything else aside from standard HTML and CSS - does this value get passed onto the webserver and thus can be used as a very serious de-anonymization vector?

Or, being dynamic and CSS, is it only local-browser residing, and so nothing to worry about at all?

1 Answer 1


Yes, an attacker can easily pass the value to a web server by using the triggered (size-specific) CSS rule to load a remote resource that encodes the size in its URL. You can even make this pretty efficient (as opposed to ip-check.info's inclusion of thousands of candidate CSS rules) by doing a binary search for the size using nested CSS inclusions.

You may want to set the menu bar to be always visible (and restart Tor Browser), that way it's not measurable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .