Well today I learned there's this fun site: https://www.amiunique.org/fp that'll show you how "unique" you are in terms of finger printing.
Turns out even with Orion you're pretty unique 
So some sort of anti finger printing stuff would be nice (good one to start would probably be finding out the most common user agent and keeping that up to date).
But yeah not sure what can be done to prevent fingerpringting but I'm sure there's something
I would be curious about this too. In the FAQ is written "The only efficient protection against fingerprinting is what Orion is doing - preventing fingerprinter from running in the first place." How do the report above and that relate?
Thanks for all the great work on Orion, it's my default browser nowadays!
https://privacytests.org is also interesting for this. Maybe these features could be added to orion? Brave does a pretty good job in most of the cases...
Websites that test fingerprinting are useless. Not only they use test methods that are out dated 20 years ago, but the whole point of good fingerprint protection is to not allow a malicious ad/tracking javascript to run in the first place. So when such site reports Orion is "unique" it is only because Orion let its .js tu run (because it did not qualify it as malicious).
The main point with fingerprinting to understand is that is you can not outsmart a sophisticated fingerprinter if one is allowed to run. (we are talking about audio driver or GPU fingerprinting here, not screen width nonsense popularized in marketing by browsers and fingerprinting 'testers' that are not serious about this)
Your best bet is blocking the .js that runs fingerprinting which is the whole point of built in total ad/tracker protection and this is exactly what Orion is doing.
What some browsers do is ship a product that checks the non-sensical "screen.width" anti-fingerprinting test , but do nothing to protect you against real fingerprinting out there in the open today.
Screen resolution fingerprinting was a thing in 2005. Here is what we are up against these days:
GPU fingerprinting
https://arxiv.org/pdf/2201.09956.pdf
https://www.techpowerup.com/291518/researchers-exploit-gpu-fingerprinting-to-track-users-online
Audio fingerprinting:
https://www.cs.princeton.edu/~arvindn/publications/OpenWPM_1_million_site_tracking_measurement.pdf
https://techcrunch.com/2016/05/19/audio-fingerprinting-being-used-to-track-web-users-study-finds/
Your browser does not protect you from that UNLESS the .js with the fingerprinter was blocked in the first place.
If you are serious about fingerprinting, you need to mercilessly block everything you can and that is what we are doing. Orion blocks all ads and all trackers by default with a combination of both block lists and machine learning driven ITP avaialble only in WebKit.
We are already throwing everything we have at the problem, the right way. Again, the reason you may see you are 'unique' in a fingerprinting 'test' is only because Orion allowed the js to run on that site, because it did not qualify it as malicious (which it isn't). Frankly, any browser that employs so called 'anti-fingerprinting' for something that was a thing 20 years is contributing to false sense of security of its users.
Note also, that privacytests.org is ran by a Brave employee, and does not test for what is the biggest threat to user privacy in browsers - telemetry. Orion is zero-telemetry by default, unlike Brave and other mainstream browsers.
After some testing, it appears to me that the stance Orion has taken may not bother sophisticated fingerprinting tools, such as fingerprint pro (aka fingerprint.js). The URL for the CDN can be blocked but that doesn't stop the library from being bundled in a website's own first party scripts.
See https://fingerprint.com/demo/ to show how Orion users seem to be easily fingerprintable in the wild using today's technology.
It doesn't seem to matter whether I use Orion's built in content blocking, or uBlock with lots of lists - I am accurately fingerprinted every time. However this is not the case with a hardened copy of LibreWolf using containers; with this I am not uniquely fingerprinted. LibreWolf browser utilises uBlock AND the evasion techniques disregarded by Orion.
Assuming that most sites won't go to the lengths the demo site has to not load scripts from identifiable domains or URLs for their libraries, I checked to see how the paid version of Fingerptint Pro tool might be used in practice. If the developer included the script using npm and bundles their javascript, it would be undetectable by a content blocker. I dont know how the intelligent tracking prevention works so I am unable to say if thius could detect the code and isolate it. It would be good to create a website where this technology is put to use in order to test Orion against it, since apparently 12% of the top largest 500 websites use this fingerprinting library.
I feel like the way to settle this is "proof is in the pudding". If we can build a site that uses commly available fingerprinting libraries to show that Orion can evade them, that would settle the privacy argument. As it stands, I do feel a little uneasy using the browser - even though I love it.
Excerpt from "What Works (Sometimes) to Prevent Browser Fingerprinting":
There are a few ways to mitigate browser fingerprinting techniques, but these are not foolproof. Some browsers offer browser fingerprinting mitigation strategies as an in-built feature. For example, Firefox allows users to block third-party requests to sites known to utilize fingerprinting, providing added protection but would not be able to catch first-party scripts.
Excerpt from "Creating a Fingerprint":
It is worth restating that Fingerprint generates an accurate visitor for each browser-device combination and not for each device. Because Fingerprint visitorIDs are derived from many browser attributesāsome universal, others vendor-specificāa website visitor using both Chrome and Firefox will most likely be assigned a separate, unique visitorID for each browser type. This means a user could escape being associated with a previous visit if they used a different browser, though this trick would only work as long as they had new browsers.
More info on how it works: https://dev.fingerprint.com/docs/understanding-our-995-accuracy
The only solution I see to this is for there to be some way to scan the contents of scripts to discover bundled trackers (unless this is what ITP does?), and/or introducing the same mitigation methods as Firefox/LibreWolf/Tor do that obfuscate their browser signals and prevent certain third-party cookies from being set.
Update:
I found this about ITP within Fingerprint Pro's own documentation:
From "Safari ITP":
Fingerprint Pro and other services use both 3rd-party (Secure, HttpOnly) and client-side cookies (set with document.cookie), which are both affected by ITP. To fix this, we require using our Cloudflare Integration or Custom subdomain.
From "The benefits of using a custom subdomain":
Significant increase to accuracy in browsers with strict privacy features such as Safari or Firefox.
Cookies are now recognized as āfirst-party.ā This means they can live longer in the browser and extend the lifetime of visitorIds.
Ad blockers will not block our JS Agent from identifying the browser. Attempts to connect to an external URL will be stopped by most ad blockers while attempts to connect to an internal URL (like a subdomain) will be allowed.
Fingerprint becomes harder to detect. Requests made directly to our website domain can be easily detected. By routing through a subdomain on your domain, Fingerprint becomes harder for automated blockers and fraudsters to detect.
I hope this is of some help to Orion developers.
I've been digging in to this and it appears content blockers are no longer a final solution to fingerprinting. Using cloudflare workers or custom subdomains, websites can sidestep all the protections of ITP and content blockers.
The only thinjg I have come up with so far is to create a feature that scans javascript for markers used in fingerprinting libraries, and disallow that code to execute.
It is easy to build anti-fingerpriting solutions that work with popular fingerprinting demos.
It is impossible to build anti-fingerprinting solution against a sophisticaed fingerprinter like
GPU fingerprinting
https://arxiv.org/pdf/2201.09956.pdf
https://www.techpowerup.com/291518/researchers-exploit-gpu-fingerprinting-to-track-users-online
Audio fingerprinting:
https://www.cs.princeton.edu/~arvindn/publications/OpenWPM_1_million_site_tracking_measurement.pdf
https://techcrunch.com/2016/05/19/audio-fingerprinting-being-used-to-track-web-users-study-finds/
If a sophisticated fingerprinter is allowed to run, it will fingerprint the browser.
Therfore the best solution is to prevent fingerpritner from running. Any other approach is doomed to fail, and can only give sense false sense of protection, when tested with fingerprinting demos that use basic fingerprinting methods, that are easilly avodied.
There is no perfect solution and we simply avoid to play cat and mouse game played by other browsers, giving users false sense of protection. Our approach, blocking fingerprinters from running, is protecting probably agaisnt 99% of what is used out there.
Vlad thank you Vlad - yes I understand the above. I agree, also.
I also understand you donāt have time to play cat and mouse.
The point is, itās not a popular fingerprinting demo. Itās a real (and popular) fingerprinting product, in use in the wild, who are able to get around the traditional ānot allowing it to runā technique.
Hopefully you were able to read what I wrote above.
I was just trying to help Orion be the best privacy focussed browser there can be. Thatās what Iām interested in, and Iām sure itās what draws many users.
I felt you should be aware that your ādonāt run itā solution (as it is) isnāt watertight, and increasingly this will be the case as these methods get further adoption. Sadly I donāt think 99% protection is a realistic figure anymore, given the discoveries above.
Maybe Iāll find the time one day to write an extension that mitigates these new methods (subdomain, cloudflare worker), as I think itās important.
The point is, itās not a popular fingerprinting demo. Itās a real (and popular) fingerprinting product, in use in the wild, who are able to get around the traditional ānot allowing it to runā technique.
A difference to understand is that their script is allowed to run on their site because it may not have been flagged as malicious (because it is clearly a technology demo). That does not mean it will be allowed to run in wild, when ad/tracking companies package it into their scripts, which are already well documented and publicly known and a part of many blocklists that Orion uses. This is what I meant by 99% protection.
Yes, one can incorporate this into new scripts, custom subdomains etc, but these either:
a) get detected by the broad privacy community fast (if they are impactful/used by a large ad/tracking network it will be in a matter of hours)
b) if a random small site did this - well there is also no harm because you are likely to not visit it ever (and fingerprinting only makes sense when deployed at large scale anyway, which is what a) considers)
Because this statement holds true:
"If a sophisticated fingerprinter is allowed to run, it will fingerprint the browser."
It is clear that the best and only defense against fingerprinting is to block it (we will be adding feature for custom block list so you can stay up to date in a matter of minutes in the future), and not try to avoid it once it is running with stuff like masking your screen resolution and what not, which are basically just gimmicks as proven by those two whitepapers I linked to earlier.
Currently if you run the fingerprinting test from the EFF website Orion has a nearly-unique fingerprint. All the tracking protections in the world won't help much when the browser is so unique and easily identifiable.
Heres the Mullvad browser for comparison:
Love the work youre doing. Great to see another browser that's not made on chromium
Possibly related: https://orionfeedback.org/d/2450-anti-fingerprinting
Results with most common user agent from useragents.me "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" set in the browser.
I wish there was a fine-grained way to allow what .js to run on what sites. I don't mind having to prune a whitelist. Most services can get on alright without JS, and the few that don't I would like the option of not letting 'scripts/tracking.js' run but allowing 'scripts/post-display.js'
Even without Javascript enabled though the browser is still very identifiable. Surely theres more that can be done so the browser 'blends in'. Mullvad/Tors letterboxing? Braves Fingerprint randomization?
What does the project need to make it happen?
Vlad Are there more resources of GPU fingerprinting complexities?
It seems to me that there doesn't exist much research or consensus.
I think it would involve alot of advanced mathematics to spoof a GPU fingerprint, and if it could be done for the Orion browser, but that would probably be too complex.
@Vlad you consider even the EFF test a gimmick?
