Browser Fingerprinting Without JavaScript

What's your threat model? Is it more secure that you as a user can execute root code? Or that your phone manufacturer can without asking for your permission?

Modern smartphones are basically spyware distros. I would argue it's far more secure to run a decent distro (Lineage/Replicant) with root, than it is to run any SamWeiMi crapware without root. Oh yes, the manufacturer's crapware has system privileges whether you ask for it or not, and so does Google Play Services, Google's universal backdoor for Android.

On paper, no root is better. In practice, even on a crap distro, rooting it will enable you to remove most crapware to reduce attack surface.

Also related: if you're concerned about security, you should probably only use applications from F-Droid.org repos. Google Play Store (and others) are just full of spyware! See also the Exodus Privacy project tracking trackers via static analysis of APKs.

Tor is not Tor Browser. Detecting outdated Tor Browser version would help you detect well-known vulns. Detecting non-TBB browser over Tor would suggest that side-channel attacks are available to defeat onion routing (eg. WebRTC leaks).

If you want privacy, use Tor Browser. It's the only privacy-friendly browser out there. All others have many holes and leaks and very little intentions to close them. Although Firefox has a "Tor uplift" project upstreaming patches from Tor Browser into Firefox's strict privacy mode.

We need to boycott Cloudflare and others like them. They are pretending to protect websites, but in fact they create a walled garden where they decide who gets in.

People who use privacy tooling are left out, people from poorer countries are left out (due to bad IP range reputation), and legit bots scraping websites are left out.

If you need DDOS protection, use network-level mitigations from your host and basic rate limiting. If you need to protect your admin area from bruteforce and known vulns, restrict it to localhost queries and use SSH tunneling with public-key auth. If you need geo-replication, think again, you probably don't: make your pages lighter (why JS? why custom fonts?) and reduce the number of queries at all costs (the biggest slowing factor on high-latency links).

You don't need Cloudflare, even for a popular international website. Designing your website properly will make it more user-friendly and faster to load. From anywhere in the world, it should be fully rendered before any similar Cloudflare-powered page could load the JS spyware blocking access to the content.

> And since most websites require JavaScript to function properly, using this method to preserve your online privacy will invariably lead to a suboptimal web experience.

Great article and a good demo and insight into CSS capabilities in particular but I have to disagree with the above quote taken from the article. I surf the web with JavaScript disabled and the words 'most', 'properly' and 'suboptimal' in my view are debatable.

most - for me, about 99% of websites still work best with JS disabled. If I see the 'please enable JavaScript ' message on a content site (like a blog) I generally bail immediately because delivering content with JS is my definition of suboptimal and a sign of inexperienced devs or a CMO with way too much influence over dev.

properly - when I view a pure content site (like a blog), actually seeing the content is my definition of 'properly'. Seeing a blank screen or the 'please enable JavaScript ' is my definition of not functioning properly. Using JavaScript to deliver content seems like overkill to me.

suboptimal - for me, rather than leading to a suboptimal web experience, disabling JavaScript leads to an optimal web experience. I avoid most ads and I don't suffer JS download delays. All I want is the info. Helping to preserve my online privacy is just a side bonus.

I have a simple rule. If a website is an application (i.e. it has instrumental value) and it's behind a login screen, then by all means use JS. If it's not (i.e. it has intrinsic value like a blog post) then don't. To me, a PWA is the optimal app experience, not the optimal content experience. JS is not for delivering content, it's for delivering functionality, instrumentality.

Does private browsing in FF solve this by not caching between program starts?