3

I know window size shouldn't be changed for anonymity reasons, but what if the page has already loaded?

Does it still affect anonymity?

Improve this question

1 Answer 1

Reset to default
3

edited due to @DJCrashDummies comment

http://ip-check.info/ has proven this to be insecure. That is, window size change can be determined even after the page has loaded completely. As a proof of concept, try the code from https://stackoverflow.com/a/26879317/1587329, and resize your browser width after the page has loaded (with JavaScript disabled). You will see that it is dynamically adjusted.

This could unfortunately yield the browser width (and height) for an enterprising attacker.

Improve this answer
2
  • 1
    WARNING: also with javascript disabled your inner window size (and a modification of it) can be tracked also after the page has loaded. -- simply use tails (enable noscript) and checked it with the test on ip-check.info.
    – DJCrashdummy
    Nov 11, 2016 at 22:23
  • @DJCrashdummy: If JavaScript is disabled (on ip-check.info, you see if JavaScript is disabled right above the screen size test) They might use something akin to stackoverflow.com/a/26879317/1587329: you could then use CSS to request resources based on screen size. Ouch.
    – serv-inc
    Nov 18, 2016 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy