Vanadium poor fingerprinting resistance

hello-gos

I found the website below recently and it gives a poor result with Vanadium related to fingerprinting:

https://coveryourtracks.eff.org/

Blocking tracking ads? Yes
Blocking invisible trackers? Yes
Protecting you from fingerprinting? Your browser has a nearly-unique fingerprint

Running the same test with brave gives this result:

Blocking tracking ads? Yes
Blocking invisible trackers? Yes
Protecting you from fingerprinting? your browser has a randomized fingerprint

Brave also seems to be the best privacy browser according to this site as well: https://privacytests.org/android

Firstly, do you agree that the result is accurate?

If yes, is this being addressed? And are you concerned about this?

userofgos

hello-gos this has been discussed numerous times (here's a few examples):
https://discuss.grapheneos.org/d/2539-vanadium-privacy-questions/11
https://discuss.grapheneos.org/d/19692-vanadium-fingerprinting/4

And here's a great plethora of information on the GrapheneOS website: https://grapheneos.org/usage#web-browsing

We recommend against trying to achieve browser privacy and security through piling on browser extensions and modifications. Most privacy features for browsers are privacy theater without a clear threat model and these features often reduce privacy by aiding fingerprinting and adding more state shared between sites. Every change you make results in you standing out from the crowd and generally provides more ways to track you. Enumerating badness via content filtering is not a viable approach to achieving decent privacy, just as AntiVirus isn't a viable way to achieving decent security. These are losing battles, and are at best a stopgap reducing exposure while waiting for real privacy and security features.

tux_

I don't think you should not be worried about the unique canvas fingerprint. The idea is that it is unique, but randomized. Desktop Firefox has that mitigation built-in as well, and also appears unique. Harmful trackers are ideally blocked at the DNS level and are not loaded at all. You can go further and use uBlock to block all scripts or third party scripts. It is a surefire way to prevent fingerprinting, but will result in a lot of breakage however.

KCne

tux_ Harmful trackers are ideally blocked at the DNS level and are not loaded at all

https://privsec.dev/posts/knowledge/badness-enumeration/

DNS filtering solutions. while not having any negative impact on security, are trivially bypassable

tux_ You can go further and use uBlock to block all scripts or third party scripts. It is a surefire way to prevent fingerprinting

tracking can be done without any scripts at all. For example, a website only needs to know your session ID using a cookie and save all logs associated with that ID. It can then analyze when you visited the website, how long you visited the website for, which page on the website you spent the most time on, what you looked at, and so on. Another problem is that a website can just host its own tracking code or proxy third party tracking code under its own domain. Just because your adblocker blocks connections to Google Analytics does not mean that you you are actually “safe” from Google Analytics at all. Even if you are successful in doing so, there is nothing stopping the website from sharing the analytics data it collected on its own with Google either.

tux_

KCne The points in that article are well taken, but it's more or less a given that "hardened" browser configurations already take obvious countermeasures (flush cookies/on-device data, etc.) The more insidious forms of tracking nowadays use JS. There is very little you can do with a purely static website to reliably fingerprint users.