Hello Mozilla,
I'd like to share two findings about Firefox's fingerprinting resistance
(resistFingerprinting) that I believe are working against their own goal
of making users less unique, rather than more.
1. Enhanced Tracking Protection automatically enables the Do Not Track
header, and this cannot be disabled without also disabling tracking
protection itself. According to my testing on EFF's "Cover Your Tracks"
tool, sending DNT actually adds around 1.9 bits of identifying
information, because relatively few browsers send it today, making it
counterproductive to the goal of blending in.
2. When resistFingerprinting is enabled, navigator.hardwareConcurrency
is spoofed to a fixed value of 2, based on a 2017 Mozilla statistic
showing most users had 2-core devices at the time. In my testing, this
value now adds around 4.5 bits of identifying information, since most
devices today report 4+ cores by default. An updated statistic reflecting
current hardware trends might result in a more common, less distinctive
value.
Both findings came from comparing a hardened Firefox profile (custom
user.js) against Mullvad Browser on Cover Your Tracks, then investigating
the source of each remaining difference.
Thanks for your work on privacy in Firefox ❤️
