Leverage Firefox's upcoming All-in-One Fingerprint resistance

[RoxKilly]

Describe the issue

Hello Raymond. You made it clear recently (#2378, #1647) that you don't want to go down the rabbit hole of implementing fingerprint protection because it's a wide and deep endeavor that warrants its own add-on.

I understand. How about one all-encompassing option that puts the burden of implementing fingerprint resistance on the browser? As part of the Tor Uplift project, Firefox devs intend to implement a single config that tells the browser to resist fingerprinting.

privacy.resistFingerprinting = true

The devs will strengthen the effect of this setting over time, a bit like Private Browsing mode. In fact there is discussion on bugzilla about possibly enabling this by default when in Private Browsing mode (same as Tracking Protection). Initially, the discussed effects are:

It does offer some significant protection (including hiding system colors, screen orientation, screen dimensions, device pixel ratio, window position on screen, screen click coordinates, supported mime types and installed plugins) (source)

This alleviates your concern (no need to continually update uBO to block new fingerprinting vectors) while still providing ever-improving protection to users.

[uBlock-user]

Does this include Canvas Fingerprinting too ? Also I suppose this is limited to Firefox only ?

[gorhill]

I've been subscribed to this bug since a while to see how it evolves and see if I can make use of the feature in uBO.

[Atavic]

@uBlock-user Yes, with a low-priority.
pyllyukko/user.js#203

Related: arkenfox/user.js#7

[gorhill]

AFAIK WebExtensions cannot change FF internals

I am assuming the setting will be available through the browser.privacy API.

[tumpio]

There is no All-in-one solution to browser fingerprinting. uBlock can be used as a blocker for fingerprinting hosts or scripts for which there are some filter lists available.

The bug discussed in this topic (bug 1308340) is about enabling the in-build browser fingerprinting countermeasures through a privacy setting option. The comment by Simon provides a valuable information regarding the browser fingerprinting : https://bugzilla.mozilla.org/show_bug.cgi?id=1308340#c20

AFAIK WebExtensions cannot change FF internals

Yes, as observed in comment by Kris, https://bugzilla.mozilla.org/show_bug.cgi?id=1279371#c6

Traditional extensions had access to all requests because they ran with the full privileges of the browser. WebExtensions are designed to be sandboxed. They're not meant to have access to implementation details of the browser, and they're especially not meant to have access to security-sensitive requests such as update checks and OCSP checks.

[elypter]

its kind of a srtetch calling something a countermeasure when the browser actively included the methods in question and knew about its misuse for over a decade. but at least finally something is being done about it. there is currently no way to browse comfortably(without losing all cookies&history) and with the smallest possible fingerprint. and even if you modify the TorBrowser to be be an every day solution by switching on saved passwords, history and cookies(managed with an addon) and install ublock you still have many more safety measures than a default firefox but its worth nothing because you are already unique because of your unique modifications. this could only be stoped if there was a comfortable option that many use of active spoofing by sending different plausible looking information on each request.

[Atavic]

Maybe it's off-topic, but various discussions like this do not mention a simple solution: use more than one browser.

Usually internet users deal with two kinds of browsing, a casual one that includes various searches and clicks on RSS feeds and a personal one where the users logs into a site or forum with it's own nickname.

Different browsers for different purposes render this problem easy, IMHO

[elypter]

but some people have dozens of identities and it becomes impractical to have everything spread over multiple browsers or profiles.

[Atavic]

I always use the same browser to log into some site. If I'm on an hardened browser, I use an addon as Open with to start the other browser that I use to log into sites.

[gorhill]

I prefer to decline for now, it turns out enabling resistFingerprinting has a lot of consequences and very often users are unable to understand many apparent malfunctions are directly linked to their use of the setting, and it's the reason the setting is not currently exposed in Firefox's Preferences.