Browser fingerprinting with NoScript

Trying to prevent browser fingerprinting? The odds are against you

With recent revelations about browser fingerprinting, the race is on to find ways and means that will help reduce your browser’s fingerprint, and with it, make it difficult for it (and you) to be tracked.

After trying Panopticlick yesterday, a tool released by the Electronic Frontier Foundation to help users determine if their browser is safe against tracking and fingerprinting, I set out to find out how to make my browsers less unique to trackers.

For the very paranoid, the results are not good.

Under default settings, a browser like Mozilla Firefox and Iceweasel emit very unique fingerprints, as shown in the result of a Panopticlick test in Figure 1. “Default settings” implies that DNT (Do Not Track) is disabled, and cookies are accepted. Pay special attention to how many other browsers have the same fingerprint as the target browser.

Browser fingerprinting

Figure 1: Browser fingerprinting under browser default settings

Enabling DNT makes no difference to the result of the test.

Browser fingerprinting with DNT

Figure 2: Browser fingerprinting with DNT (Do Not Track) enabled

Even with DNT and cookies rejected globally, the browser still has a unique fingerprint which was even worse than when cookies were accept.

Browser fingerprinting no cookies

Figure 3: Browser fingerprinting with DNT (Do Not Track) enabled and cookies disabled

With Privacy Badger installed, still keeping DNT enabled and cookies rejected, the result is only as good as when DNT was enabled, which means not very good.

Browser fingerprinting with Privacy Badger

Figure 4: Browser fingerprinting with Privacy Badger installed

Throw NoScript in the mix, and your browser stands out like a sour thumb, which is counter to the expected result.

Browser fingerprinting with NoScript

Figure 5: Browser fingerprinting with Privacy Badger and NoScript plugins installed

On a KDE desktop, there’s an option in the System Settings that can be used to disable browser identification in Konqueror, the native KDE browser and file manager. It can also be used to give a fake identification to the browser.

 KDE Konqueror browser identification

Figure 6: KDE Konqueror browser identification

However, disabling sending browser identification is useless, as it still leaves your browser with a unique fingerprint.

fingerprinting test on Konqueror

Figure 7: Browser fingerprinting test on Konqueror

So despite all the browser tools and options that can be deployed and tweaked to give a browser a less unique fingerprint, nothing seems to make any real difference. And from what I’ve seen so far, the more plugins installed and the more options enabled/disabled, the more unique your browser becomes. It’s like getting your phone number on a “Do Not Call” list. To learn a bit more about this topic, the EFF has some suggestions here.

Please share:

3 Responses

Add a Comment

Your email address will not be published. Required fields are marked *