Questions about Mullvad Browser's fingerprint

[Bankable835]

Hello, I know similar things have been asked before, but my question is a bit more specific.

1. Does installing the Proton VPN extension and the Proton Pass extension change your fingerprint?

2. Does changing “permissions.memory_only” to false (to keep cookie exceptions) change your fingerprint?

I did all of the above and my fingerprint on Cover your Tracks is still the same as in the default configuration (1 one 900), so I assume it doesn’t worsen the fingerprint, right?

3. actually, when using Mullvad’s default settings, and I go on cover your tracks, it says I’m “1 in 4867” (so worse than on my own configuration) but when I retake the test with the same default settings immediately after, only then it changes to “1 in 900”. But on my configuration it always says “1 in 900”, why is that the case?

(1 in 900 is better than 1 in 4867 btw)

[KevPham (Kevin Pham)]

Generally speaking, installing any sort of extensions or modifying browser settings does change the fingerprint. For Mullvad users, you should stick with the VPN app and the default UBlock Origin extension.

I recommend that you avoid installing unnecessary extensions if fingerprinting is your primary concern on something like Tor Browser. Mullvad Browser as a daily driver is different though. It won’t be a massive dealbreaker compared to doing so on Tor though. It’s not ideal to add additional extensions on Mullvad but you are allowed to do so if your browsing workflow demands it.

[Bankable835]

i know that, but the fingerprint on Cover your Tracks is the same on default Mullvad and on a profile with the VPN and Password manager installed, that’s why I’m asking

[SkewedZeppelin]

@Bankable835

fingerprint on Cover your Tracks

anything it says is useless compared to actual real-world fingerprinting mechanisms.

[ManicMastery]

@Bankable835

Cover your Tracks is the same on default Mullvad and on a profile with the VPN and Password manager installed

I’m glad you’re asking for verification, since coveryourtracks is flawed.

@KevPham

Generally speaking, installing any sort of extensions or modifying browser settings does change the fingerprint.

I am inclined to give the same advice to OP, but given this thread, there is a history of people asking for specifics, not generalities. It seems this thread is asking for specifics as well.

@Bankable835

• Does installing the Proton VPN extension and the Proton Pass extension change your fingerprint?

What we’ve learned from that thread is that some extensions are fingerprintable, and some are not^[1]. @ruihildt says that Mullvad actually plans to “modify the extensions section [to] warn the user when an extension is fingerprintable” at some vague point in the future^[2].

I cannot say much about the Proton VPN extension, but Proton Pass seems to change the webpage since it creates drop downs for the autofill feature, so it will certainly be fingerprintable. Someone correct me if this is wrong.

---

To quote @ruihildt:

@ruihildt

Basically, we need to look at the permissions an extension requires. The permissions an extension request on install through the browser user interface is not fine-grained enough to determine whether the extension is potentially fingerprintable.

An extension is just an archive you can extract packaging some HTML/CSS/JavaScript.
So if you look at the source code of an extension, you will find in it a file called the manifest, which lists resources and permissions of the extension.

This is not an exhaustive list and you should not use it to determine if an extension is fingerprintable.
Furthermore, the situation is different for Firefox and Chromium browsers! This is focusing on the Firefox side.

Here are some things we can look out for:

• Web accessible resources, this can be icons, CSS or other, which a page can view, is probably unique per extension
• Content scripts, this is basically whether the extension can inject a script and modify the webpages directly
• Network/DNS requests, extensions can intercept requests an potentially modify them
• specific URL or <all_urls>, which allow extension to make intervention in specific websites
• others I forget now most probably

To function properly, an extension will sometimes requires multiple of those permissions. To take the example of an extension adding a button to YouTube, it will require at the minimum to use a content script, and to access youtube.com.

There are cases where an extension will require more permissions than needed (the <all_urls> is a classic one), but for example uBlock Origin needs it. Sometimes an extension doesn’t need that much permission technically, but the permission you can ask is not fine grained enough.
Sometimes, if your extension need to be displayed as an overlay on the page, you can only do it by modifying the page (an example would be a mouse gesture extension: since it relies on the position of the cursor, this can only happen by using a content script injected into the page. Even though, the function of the extension is not reliant on the website itself)

Now, even if an extension modifies the page content, it doesn’t mean that this can be used as a stable fingerprintable indicator. For example if an extension only randomly modify a webpage, it can’t be used as a reliable signal/metric.

As you can probably guess, it’s hard to reason about all of these parameters, even if you know what to look for. Which is why we recommend not to use extensions at all.^[1:1]

---

1. I want to like Mullvad Browser, but - #21 by ruihildt - Discussions - Techlore Forum ↩︎ ↩︎

2. I want to like Mullvad Browser, but - #17 by ruihildt - Discussions - Techlore Forum ↩︎