OOP uses them to define a methodology for anti-fingerprint browsing. Though the original post is written for Qubes, it should hypothetically apply for other OSs as well
Before I spend some time looking at these, has anyone already done so? I could find no mention of either tool in the PG annals
This is NOT a tool recommendation request, just a request for information
I think for anything to be truly fingerprint resistant it has to be widely used, otherwise you are fingerprintable as someone who is unusually un-fingerprintable. So, I am fairly skeptical of how useful something like these would actually be even if they are otherwise strong solutions.
On the surface, Fingerprint Chromium seems like a no-go; itâs based on Ungoogled Chromium, and likely inherits its same issues
Donut Browser looks more interesting. Claims to randomize your browser fingerprint, akin to Braveâs antifingerprinting techniques. Ill be taking a closer look at it eventually
I opened Donut and it is using Camoufox Anti-Detect v135, which I assume refers to Firefox 135, which is out-of-date.
It displays Firefox 145 to websites, but about:support clearly shows the true version. I wouldnât use it. Not saying they have to have one-day security updates but months is just wild.
Hi lyricism, what you are describing is the philosophy used by the TOR browser. Iâm a big fan of the proejct myself and have used it extensively
Just to clarify any confusion, both TOR and Donut are anti-detect browser, but TOR does it by making browser identity of every user look the same, while Donut makes your browser identity look like a different unique computer, so that the website thinks you are a different real device. This allows you to present your browser identity in a way that works for you (e.g. some websites expose different features for different platforms) while protecting your real browser identity.
Hi, Iâm the creator of Donut Browser. Thanks for checking it out!
It is true that Camoufox is terribly outdated. This is because its creator is having health problems that prevent them from working on the project right now. As they have planned to return before the end of 2025, I was betting that by that time the project will catch up to the latest playwright-patched Firefox which is usually only 1 or 2 major versions behind, which receive security updates.
Itâs January 2026 and there is still no activity from Camofoxâ creator, so Iâm working on my own engine that is based on Chromium and provides comparable level of fingerprint spoofing. I will deprecate Camoufox and release my engine before the end of January.
As a sidenote, the fact that the base version of Firefox used is 135 but you see 145 on web pages is completely intentional. This is because your browser fingerprint is spoofed, covering many things from user agent to webgl shader information. Only websites that test differences between newest and older version of Firefox at a very low level (like experimental css features or math operations) can detect that maybe your browser fingerprint is spoofed, but there are no strong indicators that are not covered in Camoufox.
Sharing this as in the absolute majority of cases zero-day exploits are deployed selectively and are executed when it is clear that it will work for the browser, even if the exploit is already public and has a CVE assigned to it, so that the operators avoid getting their IPs/domains burned.
I want to be clear that there are risks in running an outdated engine inside an anti-detect browser and you are right to flag this. That said, the practical risks are still low.
Youâre right, I oversimplifiedâTor reduces the fingerprint surface to create smaller anonymity sets rather than making everyone identical. I should have been more precise.
Donutâs use case is different from Torâs. Donut is for situations where you need distinct browser identities that appear as normal unique devicesâfor example, managing multiple accounts on platforms that would otherwise flag you, or browsing without the endless captchas youâd encounter with Tor. It also prevents sites from learning your real device specs, which is valuable for privacy-conscious users like myself.
Pretty much all of the freemium anti detect browsers export the entire user profile to their servers. People typically use such browsers for fraud. Think of crypto advertisement campaigns fraud, airdrop botting etc. but a browser developer has an ability to defraud the fraudster by stealing metamask secrets/cookies.
I wouldnât use any of them without carefully analyzing the entire codebase. Itâs not uncommon to have an open source frontend UI while compiling v8 with relevant tweaks in shades. And if the v8 modifications were public, it wouldnât make any sense since itâs essentially a gift to antifraud teams.
I just think that being up-to date is a good heuristic for the project quality.
Also, there is a lot of overlap between the security and privacy folks, especially when going in those âextremeâ solutions.
Nice to see you are working on a replacement.
Whith that being said all the best to you and Camouflox (hope they get better)