Hacker News new | past | comments | ask | show | jobs | submit login

The Tor Browser is designed to be "un-fingerprintable" as well, though instead of randomizing return values it prefers to return the same thing for every user.



I mean it sounds reasonable, right, but it just doesn't work that well. Brave's Tor windows might be a better way of using it.

Fundamentally, trying to make everyone look exactly similar is going to leave a lot of chances because you can only ever try, and it'll leave a machine learning algorithm or even a statistician with diff with a lot of information about what is important. The worst offence is that it relies on everyone else doing the same thing. It doesn't really work.

Randomising takes all that out. With no real way to predict it, no easy way of telling what's random and what isn't, and with no reliance on everyone else doing the same, you have just as many if not actually less bits of identifiable information, rely on no-one else, and feed garbage to algorithms which throws them off and possibly confuses you with many other people, protecting them at the same time.

I really don't get why the biggest and most well-known Tor browser, the Tor browser, would keep using such a flawed method. Better than nothing though.


If everyone looks similar you don't have to worry about trackers identifying individual sessions. In any case, if implemented correctly, both methods will achieve the same results.

Sure, an incomplete implementation of the randomizing method is less trackable than one of the same fingerprint method, but in practice

* even a non-perfect TBB method will protect you against pretty much all trackers

* and the TBB is, as a matter of fact, not fingerprintable on any of these tracking test sites.

Therefore I think saying that it "doesn't work very well" doesn't quite reflect reality (unless you have a good source on that, I might be mistaken here). And if your threat model requires 100% anonymity (which is an entire level above not being tracked by adtech), the only realistic way to achieve that is to disable JavaScript anyway.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: