Other than spoofing device model, how does Bromite mitigate fingerprinting?

[deleted]

I try to compartmentalize my browsing habits. I use two browsers, one exclusively for logins and the other for casual browsing. Vanadium exclusively for logins (shopping, banking, taxes, etc.) and Bromite for everything else.

In Vanadium, all browser settings are default except custom DNS set as Adguard DoH and Disable JIT set to On.

In Bromite, all browser settings are default except always-incognito and custom DNS set as Quad9 DoH.

So the other day I used Vanadium to create another Google account just for logging Youtube history in SmartTubeNext on my Firestick. After account creation I wanted to secure the account with TOTP, but the option for authenticator was not present as it knew I am on a Pixel 4a and it wanted me to use the phone as the 2FA security key. I didn't want to do that, so I switched over to Bromite and logged in to Google to try and secure my account. Low and behold, the option to secure my account with authenticator was present and I was able to add the code to Aegis.

So how does Bromite mitigate fingerprints? I noticed in 'About Bromite' the phone user agent is set as SAMSUNG SM-G960U which is a Samsung Galaxy S9. Could it have been just that, or is there more to fingerprint mitigation in Bromite?

[deleted]

Bromite's anti-fingerprinting methodology is to randomise nearly everything and remove a bunch of things which can end up being significantly worse for privacy or better in some areas as it can make you stick out significantly. A Samsung Galaxy S9 does not come close to a Pixel and if you're throwing a random resolution that doesn't match a Galaxy S9 then you stick out enough already. An adversary can figure out if you're running GrapheneOS or not, directly or indirectly even through things like background performance measurements. Some of Bromite's patches and fingerprinting mitigations are very questionable and appear to just want to pass bogus fingerprint test websites.