Rewrite Browser Fingerprinting section

[Mikaela]

Description

• https://www.privacytools.io/browsers/#fingerprint

I am under impression that even Tor Browser users get unique fingerprints on Panopticlick at times and that it doesn't tell the full story and at times makes people investigate fingerprint randomizers or trying to lessen their fingerprint which may have the opposite effect?

[blacklight447]

While I agree that the unique fingerprint is no longer really useful, its still a good tool for seeing what your browser sends out. I recall talking about this before, but maybe we can can make a fingerprint page on the ptio website ourselves, not to test "entropy" like panopticlick, but just to show the user what his general fingerprint looks like.

[Thorin-Oakenpants]

I think you should still have a FP section: but almost everything currently in there is just sooooo wrong. I can explain in further detail at some point: and I'm not saying that randomly raising entropy is not a valid technique (that's not what I meant when I said wrong).

This is one section I would like to re-write for you. People, in general, just don't understand how FP entropy works, or information paradoxes, or even what's possible: and the internet is so full of misinformation on this

I have been interested in device/browser FPing for about 8 years or more, since Ekersley's paper. I've followed developments, researched, and read hundreds of papers, thesis's (or whatever the plural of that is), PhD's, studies, and so on, in that time. IN the last 8 months I've actually been doing more in this area.

Disclosure: I have been working with (or badgering) the Tor Uplift guys (well, Tom Ritter mainly: he has a special inbox for my emails, lol) for years, and have recently been to meetings with the tor project and Mozilla guys specifically for my FP'ing knowledge (I guess they deemed me worthy: I don't think that highly of myself or anything special TBH).

but just to show the user what his general fingerprint looks like

No need to re-invent the wheel. But I can talk more about this later. PS: I know you said not to include entropy figures (because that's probably too hard to implement), but those figures are all BS

[Thorin-Oakenpants]

I am under impression that even Tor Browser users get unique fingerprints on Panopticlick

I'll just address this quickly, so people are informed. Yes, they may get a once-in-a-while unique from Panopticlick: but they are not unique.

You can't really look at all visits to Panopticlick, you need to look at Tor Browser users only (or the enclosed set being protected such as RFP users). It is trivial to detect Tor Browser.

Excluding leaks that haven't been patched, if any: math and science will tell you that the TZ (timezone) is immaterial is a moot point: because everyone is the same. So that TZ entropy figure does not apply. Math and science will tell you that the user agent and navigator properties and Firefox version number = 4 different buckets or FP's (the distribution of those 4 would determine the entropy, but it's not high at all). So Panopticlick's figures are not correct in this sense.

It is precisely because Panopticlick is trying to provide entropy for everyone, that it fails. Because it isn't everyone. This is just the nature of the site: not a design issue per se. It was designed to show users that FPing is a real thing.

• The data sets are very small
• The data is epoched now to 45 days from memory (it wasn't always), but the time frame isn't good science (IMO)
• The tests can be flawed (at least one is)
• The tests are very limited (there are many more in the wild)
• The data is tainted by the nature of the visitors: that is, it is not a real world sample - it only attracts those interested in FP'ing
• The data is tainted by repeat visits from said visitors: as they try to lower their entropy
• The data is tainted: especially the higher value items (such as canvas) because like a self-fulfilling prophesy, these will be the first items they will want to lower. Some of the entropy figures here are really appalling when compared to some larger real world studies
• I have more points, but I'll stop

Again, this is not a criticism of Panopticlick (well, maybe a little): it is a criticism of how people perceive it. It's great for showing what values your browser returns on certain metrics, but that's it. Panopticlick's purpose is to scare and inform people: and that it achieves.

[blacklight447]

That was exactly my thought as well, is great to see what values your browser gives away, which is why I wonder if we should consider to make our own fingerprint scanner, your knowledge of fingerprinting techniques would be especially helpful.

[Thorin-Oakenpants]

which is why I wonder if we should consider to make our own fingerprint scanner

you really don't want to go down that road :)

[blacklight447]

Care to elaborate?

[Thorin-Oakenpants]

Ummm .. not here maybe .. parts of it .. not sure .. will sleep on it

[blacklight447]

We can talk over it on chat or email.

[beerisgood]

I find this test more useful:
https://www.bromite.org/detect