I understand that PG discourages the use of unnecessary browser extensions. Unfortunately, while I can find sources that explain this advice for gecko and chromium browsers, I can’t find much information about it for WebKit browsers.
Hypothetically, if I’m using Noir, Wipr 2, and RedirectWeb, could websites recognize me as more unique than other safari users? Can sites detect either which extensions are used or how many extensions I have?
The short answer is generally, yes.
The long answer is that it depends on the extension and how it works. If you are using a content blocker that works natively in Safari to block content then it is unlikely to be a fingerprinting risk. However, any extension that modifies the code displayed on the webpage will be detectable.
For the extensions you mentioned, Noir will definitely be fingerprint-able as it is changing the displayed code. Wipr 2 could be fingerprintable depending on how you use it. If you are just using the blocklists that integrate natively with Safari content blocking, then no it is not going to be a fingerprinting risk. If you have “Wipr Extra” enabled then it probably is contributing to a fingerprint since it is adjusting javascript in the displayed webpage.
I’m not familiar with RedirectWeb but I would guess this is low risk but this is also a low-confidence answer.
On the bright side, Noir and Wipr are pretty popular. I use them myself. So it is making it easier to finger print you but more by reducing the population of other people you might be and not making you unique in your fingerprint.
For general advice I would say not to worry about the fingerprinting risk from your current setup on normal day to day browsing. However, if you need to do something particularly sensitive that you are really worried about being identified, then it may be better to use a ‘stock’ browser setup along side other anonymizing techniques.
So basically, when Noir changes the colors of a site, that site then receives data back to their own server? I’d assumed otherwise since Noir works without a network connection. But if you’re right, can sites further track me via specific color schemes? That’s my biggest concern. I’m pretty certain no other Safari user employs my personal theme.
The app Noir is privacy respecting in that Noir isn’t sending your data anywhere.
However, when Noir changes a webpage, that website can inspect changes to its own Document Object Model (DOM) via JavaScript and report that back if it is configured to do so.
As for a specific color scheme, it is also possible to detect what those changes are and potentially create a very unique finger print,
If you are using a standard setting of Noir, this concern is limited as you may be sharing that setting with thousands of other Noir users. If you have done something really unique to your color scheme….that may make you much more identifiable.
Thanks. I appreciate the explanation.
Hyper specific side-note: While testing Dark Reader, I noticed that its default theme is identical to Brave’s night mode, and it also matches the default theme of several popular dark mode extensions. Thus, the most privacy-friendly dark theme for Safari users (in sRGB) should hypothetically be this: #e8e6e3 for text; #181a1b for background.