Your browser engine is very easy to identify, it would be useless to lie and it would also cause a lot of breakage.

What do you mean by this? It already reports Linux in the navigator UA, are you talking about the HTTP header? If so, I agree with you and I’m hoping to see a change as it is overkill (although there are reasons against namely passive fping protection in some rare cases).

It causes breakage too, ideally reporting this could influence a change in RFP but there are some blocking issues (things to discuss) at the moment and it is low priority. We could anticipate the change with a patch but we haven’t thought about this yet as we are usually against changing RFP.

I shared this a while ago in the Firefox community --> https://lemmy.ml/post/209597

see y’all there, I updated the lemmy sidebar already :-)

Mull is super nice and its dev does a lot of good open source stuff, recommended!

2mo later I gotta say I’m sorry that I haven’t been able to keep up with lemmy (or even worse with reddit where I haven’t logged in ages) lately, I’ve been pretty busy to the point where even release announcements disappeared.

indeed it does, but most people wouldn’t really care in 2023.

https://librewolf.net/docs/faq/#will-you-provide-an-android-version-of-librewolf

https://librewolf.net/docs/testing/ says:

These tests are not intended to be used as oracles, but rather as a way to check your setup and verify that your changes are applied. You should not read too much into the results unless you are sure you understand them, as explained in this article.

https://blog.pastly.net/posts/2019-01-19-about-to-use-tor/#testing-your-fingerprint

BTW I commented about this in the past, see https://gitlab.com/librewolf-community/browser/windows/-/issues/276#note_1137125815

it’s covered, yes. we enable a built-in list that strips some query params and we also add an extra one that strips more stuff (courtesy of the great https://github.com/DandelionSprout).

btw Firefox also has native query stripping now, so there’s one extra layer of protection! see https://privacytests.org/

your browser finger print will change

it’s about the traffic fingerprint more than anything IMO; for example, to an external observer it would be very obvious that some domains are not being loaded.

it’s worth noting that all Tails users look (looked? IDK if they still ship uBO with TB) the same as they all had uBO included, so Tails had their own user bucket.

Dark Reader can be detected, if not from the injection at very least from the fetching behavior. the creator of the extension states this very clearly on Github:

• https://github.com/darkreader/darkreader/issues/2385#issuecomment-619629021
• https://github.com/darkreader/darkreader/issues/3274

as you already said, extension that alter the traffic fingerprint (eg. ad-blocker or things like LocalCDN) are rather easy to identify. however I wouldn’t go as far as saying that’s an actual issue with the ad-blockers themselves: they do their job, they are just not adequate when you try to fit into a crowd hence when using tor browser; I guess the same can be said about Dark Reader: the extension is doing it’s job, there’s just no way for it to hide.

tldr: extensions can be detected and there’s no way around it. while it doesn’t make them bad in general, maybe don’t use them with TB.

this extension is glorious

I still think enumerating badness (eg. blocking trackers) is not a final solution. it’s nice to have, but it should be only an initial level of protection.

also, strict mode blocks known fping scripts so arguably you don’t need extensions for that, a nice plus :-)

one of the most important changes for privacy that firefox ever made, I hope people realize this. huge win for all the users!

when did you last use it? it hasn’t been that way for me in ages.

also -> https://blog.torproject.org/congestion-contrl-047/

I don’t have the same issue and I update daily as I’m using Nightly, weird.

relevant -> https://lemmy.ml/post/209597

I would also argue that the about config changes he points to are a bit…meh

other than websites that return a score I argue that websites that return values are not of much value if you do not know how much entropy they carry (eg. are they the same for all the people on the same OS?) or how they are handled in the browser with various mitigations. it’s one thing to read a value, but it’s a whole different thing to understand if and how it can be used, leave alone against a specific tool.

everything is documented on TB’s official gitlab btw, people working on it know their stuff.

Firefox has a bigger userbase than Tor Browser users, and it is a pretty uncontested claim logically. Firefox has Tor Project’s code for anti fingerprinting and per site data isolation upstreamed to Firefox’s private browsing mode since the past 15-20 or so versions now.

Firefox does not have the crowd that Tor Browser has, it does not have the Tor network, RFP is not enabled by default and users will make changes to their settings. even if Firefox has the larger user base there’s no argument for Firefox having a better crowd, sadly there’s no linear correlation in this case.

yes, you can harden it, but the crowd is so small that you will not defeat advanced scripts, nor you should expect to. hardened setups are also not equal as projects like arkenfox and librewolf are going to be tweaked by users post hardening (as they very much should).

applying stylometry analysis

this is opsec and it does not strictly apply to the tool you’re using so I don’t think it’s a valid argument for any of the points explained above.

as for the list you wrote:

• OS Core -> as I said above it can be bypassed even without JS, see TZP and others. that’s why TB has different crowds for different OSes and you just fit in.
• multiple nameserver -> I’m not educated on how the nameserver test works, so I will just shut up on this one.
• resolved and unresolved connections -> traffic analysis does not require JS and using something like uBO or even tracking protection will manipulate your traffic, which is why stock TB does not use any ad blocker. there was a TB issue where LocalCDN was discussed and a dev said it was easy with the proper traffic analysis to detect the extension.
• private mode -> it is detectable but one can just avoid using it even if he has JS on. I’ve never seen it recommended to use always-on incognito so I don’t see the issue.
• tracking protection on or off -> it is off and you cannot enable it in TB (edit: issue).
• browser window size -> rounded values protect the real window size hence you fit in the crowd.
• monitor colour -> iirc it simply doesn’t carry entropy, there were some TB tickets where this was discussed.
• cursor, mouse, last click, caps lock etc -> these are all volatile and fuzzy fping wise. if you can provide a PoC or a paper where these are used to successfully fingerprint a browser then ok, otherwise I don’t see the issue here as well (edit: I found this issue about mouse movement which is 6yo, it’s very low priority apparently and it suggests no JS as only mitigation).
• various estimations and timing -> they are all mitigated, try to run a test and watch TB or Firefox with RFP always return rounded ms values. not to mention Tor circuits provide further protection against everything you mention network wise (edit: in case I’m missing something floating out there I’m ready to stand corrected and I would love a link).

“TB should cover all metrics” (I know you haven’t said it, I just didn’t know how to phrase it better lol) is not a safe assumption: not all metrics are equal, they do not all carry entropy nor they are all valuable fping methods. this brings us back to the initial part of this comment.

the rest of the stuff you discussed, like typing in the wrong tab etc, is mostly opsec and as I said I also value the added peace of mind, but it doesn’t make logins on Tor bad per-se. keyloggers are also a bit out of scope for this discussion imo.

tldr: TB covers enough metrics for most threat models even with JS on - naive scripts swallow the pill, advanced ones are defeated by the crowd, and don’t forget the network -, and the benefits of disabling JS are not that big.

ps thanks for getting back despite the lengthy comments, I added some edits for completeness on both sides of the discussion :-)

I just ran TBB and used deviceinfo.me to verify

ironic how this is posted below an article that says that testing websites are not reliable and that you should not read into the results unless you understand them. I don’t think this is the case, sorry about being painfully honest but I don’t want people to freak out over tests instead of reading a well written article:

• all of the metrics you mention as spoofed (plus a lot more, even ones that you mention in your list like navigator UA, window size, TP on/off, color depth, private mode…) carry close to no entropy. that’s because Tor Browser has a crowd and users fit in that crowd, so even if the script was advanced to go over all the metrics covered by TB (which most of the time isn’t the case), the crowd would allow you to fit in.
• the spoofed UA in the http-header is actually for passive fingerprinting. generally speaking, your actual OS cannot be spoofed and even with JS disabled it can be bypassed by using CSS/fonts. while it’s true that TB safest mode restricts the font list and it will probably defeat most PoC out there (I think? I don’t remember but it should) it’s a big sacrifice in terms of usability when you could simply fit in with the crowd of people using TB on your same OS: arguably that’s good enough for almost everyone.
• timing attacks are mitigated.
• stuff like position in page, last item clicked, cursor position etc is fuzzy, how do you fingerprint based on that? plus https://github.com/arkenfox/TZP#-fingerprints-are-always-loose

You want to know what a JS enabled Tor Browser looks like? A standard Firefox private mode tab with uBlock Origin medium mode and arkenfox user.js applied.

that’s simply not true. TB has further enhancement and code changes, it is based on ESR plus it’s not the same as a private window at all since private mode does not write to disk for example. most importantly tho: TB has crowd and the Tor network, that’s vital and a huge difference. a traffic analysis would also probably identify Firefox + uBO in medium mode vs TB. also, arkenfox does not try to make Firefox turn into TB, that’s clearly stated in the wiki and I would know as I am a repo admin :-)

Can the author explain me why keeping JS on is so helpful

usability, a browser with JS disabled by default is not a good everyday browser for most. the more people use Tor Browser daily and have a good experience with it, the larger the crowd gets.

All the above information I mentioned is trackable for…

I mean once you are subscribed, why would they want to fingerprint you? they already know who you are. when facebook operates as third party it will be isolated plus on a different circuit and with fingerprinting protection, plus (from arkenfox’s wiki):

if a fingerprinting script should run, it would need to be universal or widespread (i.e it uses the exact same canvas, audio and webgl tests among others - most aren’t), shared by a data broker (most aren’t), not be naive (most are) and not be just first party or used solely for bot detection and fraud prevention (most probably are)

I also don’t get what the difference between typing private stuff on facebook on tor or behind a vpn or on your ISP’s network is. however I must say that I still understand why from a “peace of mind” perspective it makes sense to keep stuff isolated, so as I said above mine is not really a strong opinion here.

sorry about typing a lot, but I figured this was valuable information to share, despite being nothing new.