Browser Fingerprinting Without JavaScript

That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstreamed) explicitly to combat fingerprinting (some kind of digital black block if you will).

Overall that's an amazing compilation of modern web fingerprinting vectors. I'm just a little disappointed they left screen size (and maybe other obvious avenues) out of the demo. That would be a really cool way to demonstrate how Tor Browser's window cutting (or whatever that's called) works [0].

I read somewhere (but i can't vet the claims) there's enough variance on TCP implementations across systems to be able to distinguish, and i'm curious how the Tor Browser deals (or doesn't) with that. Could be an idea for v2 demo.

Thanks for the cool demo! I definitely enjoyed the script-like UX of the page. I wish more sites did stuff like that instead of defaulting to JS for every little animation or dynamic content.

[0] Tor Browser enforces actual width and height of the web rendering part of the window to be multiples of certain numbers, so that websites can provide experience for smaller/larger screens while retaining limited fingerprinting (eg. your fingerprint will not be affected by a user-configured or desktop-dependent window border, scroll bar width, or anything such)

If these techniques were combined with more well-known such as screen size or DPI, uniqueness would be more relevant.

The browser, if it's asked to retrieve that thing (image, page, etc) later, sends the "etag" back in the request via a If-None-Match header. The server then knows whether the image/page/etc has changed since the client last requested it. And, it can send back either the new version of the image/page/etc, or a "304 Not Modified" if the page hasn't changed...that is, the computed etag hash value is the same.

Here's the problem. There's no spec for how an etag is computed or how it's used. So on the server side, I can use it like a marker tag. Say, I generate a known unique tag for every new visitor that doesn't send me If-None-Match, like a GUID. And I keep a table of those Etag values. You're now fingerprinted...your browser will send that value back every time you visit, no JavaScript required.

The "Standard" and "Safer" modes give the same fingerprint tho.