Discussion
New Fingerprinting Tests!
I'm excited to announce a major addition to http://privacytests.org: we have developed two dozen new fingerprinting resistance tests to obtain an objective head-to-head comparison of how different browsers protect you against fingerprinting.
Our results show that no browser has perfect fingerprinting defenses. The strongest protections are seen in LibreWolf, Mullvad Browser, and Tor Browser, but every browser has room for improvement!
The "Device" tests measure whether your browser is leaking detailed information about your computer hardware. Fingerprintable properties of your computer that we measure include audio processing, GPU, memory, CPU cores, math processing, chip architecture, and OS version.
The "Settings" tests measure whether system settings are leaking through your browser. Fingerprintable settings that we measure include screen resolution, system toolbar dimensions, display preferences, keyboard layout, timezone location, and user-installed fonts.
Traditionally, services such as https://coveryourtracks.eff.org, https://fingerprint.com, and https://amiunique.org survey a population of browser visitors and analyze the uniqueness of your browser's fingerprint.
http://privacytests.org's fingerprinting tests take a different, complementary approach across browsers. These tests directly measure whether each browser is leaking characteristics of the computer it is running on.
For example, to check if the number of CPU cores is leaked, our test runs the same browser on virtual machines with different numbers of CPU cores and asks: does the browser spoof or randomize the value? If so, the browser passes the test (✅)! If, instead, it leaks the true value, then the browser has failed the test (❌)!
We apply this approach to many system settings and device properties that are commonly used by tracking scripts to fingerprint your computer.
The fingerprinting test results shown here are part of the larger context of browser privacy protections reflected in our many other categories of privacy test results, all presented at http://privacytests.org.
We hope these fingerprinting test results are useful to everyone looking to switch to a browser that respects and protects their privacy. We also hope they are galvanizing to any browser engineering team working to improve their browser's privacy.
We'll keep testing over time! ✅❌
@privacytests Do you think it's reasonable to show a "leaked timezone" as something meaningful, given browsers will never be able to give an incorrect time for compatibility issue? I wonder if that's just an impossible and therefore meaningless goal post. If you disagree, why not add the operating system to your tests? :-)
@freddy This test is actually for a leaked timezone region. For example, Europe/Berlin and Europe/Paris are effectively the same timezone, but leak what city you are located in. Your recent paper points out this same issue. 🙂
Fingerprinting is a common method that online trackers use to uniquely identify your computer and track you invisibly as you browse the web. Browsers can protect you against fingerprinting, but the current level of protection varies greatly between browsers.
Our fingerprinting resistance tests, currently run on desktop browsers, are organized in two sections: Device tests and Settings tests.