What's wrong with Mullvad and Tor Browser's fingerprinting protections?

yooooh

https://discuss.privacyguides.net/t/how-secure-is-the-mullvad-browser-because-privacy-security/22620/29

@GrapheneOS
GrapheneOS has previously said that Mullvad and Tor Browser have inadequate fingerprinting protections and did not elaborate. What specifically are those browsers lacking in fingerprinting protection? The lead dev of Mullvad Browser implied that they would be willing to accept feedback if that claim was specified upon.

argante

yooooh The requirement for a browser to protect privacy is that it must first be secure. Firefox is not secure. Mullvad Browser is based on Tor Browser, and Tor Browser is based on Firefox.

yooooh

argante
Graphene's post never implied that the fingerprinting protection weaknesses were because of Firefox's security shortcomings

mmobder

Vanadium is even worse. One may try Cromite, as it's shows up better in fingerprinting tests

GrapheneOS

mmobder

Vanadium is even worse.

You're using flawed tests which have a disproportionate number of users from those browsers testing them.

One may try Cromite, as it's shows up better in fingerprinting tests

Cromite is essentially gaming the tests with randomization which can be bypassed by a test aware of the approach.

argante

yooooh Graphene's post never implied that the fingerprinting protection weaknesses were because of Firefox's security shortcomings

Really? So how do you understand this:

At the moment, the only browser with any semblance of privacy is the Tor Browser but there are many ways to bypass the anti-fingerprinting and state partitioning. The Tor Browser's security is weak which makes the privacy protection weak.

yooooh

argante
That is a slightly better explanation, but I would appreciate it if they specifically explained how the anti fingerprinting and state partitioning could be bypassed.

mmobder

GrapheneOS Cromite is essentially gaming the tests with randomization which can be bypassed by a test aware of the approach.

Don't care as soon as I'm not fingerprintable for the average corp that will not hunt for 0.0001% of users using Cromite.
Altogether with the ability to set socks5/https orbot proxy in Cromite, it's good Cromium-based browser for 90% of my needs.
Unfortunately, with Vanadium, it exposes device-specific characteristics (gpu, mem, etc) that I'm not happy with.
However, it's awesome Vanadium supports webauth/fido2 and some of server admin consoles, as it's the remaining 10% that can't be covered by Chromite.

Delaney

mmobder Don't care as soon as I'm not fingerprintable for the average corp that will not hunt for 0.0001% of users using Cromite

Corps don't need to hunt cromite users in order to fingerprint them.

argante

mmobder Altogether with the ability to set socks5/https orbot proxy in Cromite

You can directly open an onion link in Vanadium and it will work with Tor. You don't need to configure anything. Orbot is not secure - it's a bad piece of code.

argante

mmobder Unfortunately, with Vanadium, it exposes device-specific characteristics (gpu, mem, etc) that I'm not happy with.

Advanced fingerprinting methods don't have to rely on such primitive assumptions. It's more about analyzing your web traffic and the fingerprints of the sites you visit. Even if you change browsers, the match to the profile will be significant enough to assume that it's most likely you.

If you want to browse the web more anonymously, install Briar (or RSS/atom browser) and instead of going directly to sites, subscribe to Briar's atom/RSS links.

DeletedUser313

mmobder There are always ways to circumvent fingerprint randomisation. The most obvious method is time-zone fingerprinting and language fingerprinting. EFF is not a reliable test because the fingerprint 'database' consists mainly of privacy conscious individuals who skew the results. You would want to blend in with normal users which make up a far greater proportion of the internet rather than a tiny proportion of privacy-conscious individuals who use all sorts of extensions and unusual configurations to 'anonymise' themselves. Randomisation when applied wrongly only makes your fingerprint stand out more if certain other properties remain consistent enough to identify you

mmobder

I wish I could use single Chromium-based browser, and I would be happy if it's Vanadium, as I trust your product and it's backed by more efforts than (afaik) single-dev Cromite, but unfortunately it lacks few features that I (maybe mistakenly) consider important
I wish it would be single Vanadium with generic/custom modes instead of two browsers Vanadium and Cromite

mmobder

Delaney
meaning?
https://www.malwarebytes.com/blog/news/2025/02/google-now-allows-digital-fingerprinting-of-its-users

Delaney

mmobder meaning you are fingerprintable using cromite

DeletedUser313

mmobder For major websites (not niche websites), it does not matter that Vanadium exposes device-specific characteristics because only Pixel users can use it. To my limited understanding, you will blend in with other GOS/Pixel users in websites like Wikipedia. That's one type of anti-fingerprinting measure, blending in. However, Vanadium doesn't offer time zone spoofing which I feel is a major flaw

argante

If you want to browse the web more anonymously, install Briar (or RSS/atom browser) and instead of going directly to sites, subscribe to Briar's atom/RSS links.

Does it require an account? How does it deal with sites like Reddit where you have to click on the post in order to read the comments?

yooooh

argante If you want to browse the web more anonymously, install Briar

That may be useful, but note that anonymity is not on Briar's threat model:
https://code.briarproject.org/briar/briar/-/wikis/FAQ#does-briar-provide-anonymity

DeletedUser313 To my limited understanding, you will blend in with other GOS/Pixel users in websites like Wikipedia.

This thread delves into the possible limitations of Vanadium fingerprinting:
https://discuss.privacyguides.net/t/any-advantage-in-using-cromite-instead-of-vanadium-if-youre-on-grapheneos-or-should-you-just-copy-the-recommended-configuration-of-cromite-to-vanadium/27764/16

argante

DeletedUser313 However, Vanadium doesn't offer time zone spoofing which I feel is a major flaw

The best thing you can do about it now is to set UTC globally and add your own time zone to your clock. After a while, you don't have to look at the clock anymore because you remember the offset.

RSS/atom doesn't allow you to reply. It's just downloading data from the server. It's convenient for me because I read pure information, without having to download the whole page with javascript and ads.

DeletedUser313

yooooh https://old.reddit.com/r/GrapheneOS/comments/ciizae/vanadium_and_bromium_privacy/ev6m2ot/

It's worth noting that the Vanadium canvas / WebGL / audio fingerprints match 100% with Chrome on the stock OS for the same device family (based on SoC). This is a good thing. In general, Vanadium avoids site visible changes at the moment. This means not shipping some of the anti-fingerprinting features because it makes the browser more easily fingerprinted due to having those features.

argante

yooooh That may be useful, but note that anonymity is not on Briar's threat model:

This refers to the IM function. Briar is a bit more than just an IM. What I wrote is an RSS/Atom client. You can use it without having to use IM - it will automatically download RSS/Atom via the Tor client (you don't even need to have Orbot/TorVPN installed).

DeletedUser313

argante Would you suggest UTC-0 or some country known for having many users (of a specific website or just the internet in general)?

Edit: Also Briar seems to be exclusive to android which is unfortunate

argante

DeletedUser313 Ideally, your time zone should match your VPN/Tor exit node. If you can't provide that, it's better to use UTC.