I must use some Google services with my real identity. I do so in a different web browser with split tunneling, however I’m concerned about Google’s ability to correlate my identity in other web browsers (Librewolf + VPN). Is there a way to prevent this correlation (if my concern here is even valid) without putting the “less private” browser that is tied to my identity in a virtual machine?
2 Likes
I think this is a great question and I was hoping to see some informed answers and debate. I am not an expert here but let me do my best to answer. Maybe I can invoke Cunningham’s Law. 
Since you are genuinely using a different browser, any fingerprinting which is purely browser-based is presumably going to be “fooled” by this.
Based on a recent question I asked, fingerprinting you as a human being by things like your typing style might be possible but is probably not a big concern. Putting one browser in a VM wouldn’t help with this anyway.
That leaves fingerprinting which (even if it’s normally treated as a form of browser fingerprinting) is dependent in part on your hardware - most obviously things like your screen resolution - and OS. Anti-fingerprint protection in your browser(s) may help with this, but perhaps trying (if it’s not already too late) to always use one browser with a window size significantly smaller than your screen size might help obfuscate this.
I could imagine that things like checking how the OS renders text might give the same results on both your browsers, though there is probably also an element of browser-specific behavior layered on top of this which might obfuscate things.
Since both browsers are running on the same OS, there might be a theoretical possibility that something like nmap’s passive OS fingerprinting based on packet analysis could help someone detect this. I don’t know if this kind of fingerprinting works across a VPN though.
Perhaps just because it’s one of the more complex areas and where I really don’t think I understand it all, my biggest concern with this setup would be whether some kind of DNS-based leak might reveal that the two browsers are running on the same machine, with DNS not being correctly “segregated” via the split tunnelling. I hope an expert will chime in, but in the absence of expert opinion I would try some DNS leak checking websites and if they say you are OK, you are probably OK.
2 Likes