Questions about Safari’s fingerprinting protection

Privacy Questions
1

Hi! So I’ve been thinking about switching to android, but I’ve been wondering about the effectiveness of anti fingerprinting on both OSes (a very important thing for me) after reading this here and here. My previous impression was always that Safari is the next best thing after Firefox + RFP/FPP and Brave. Is this true, or is Safari actually better at protecting against naive fingerprinters than brave?

Here are some excerpts:

“Fingerprints can be used to track the user across websites. If successful, it defeats tracking preventions such as storage partitioning and link decoration filtering.

There are two types of solutions to this problem:

  1. Make the fingerprint be shared among many users, so called herd immunity.
  2. Make the fingerprint unique per website, typically achieved via randomized noise injection.”

This is something that I never understood. “Herd immunity” is only relevant when talking about advanced fingerprinters because you will need to blend in a crowd to avoid them, but neither safari nor brave, nor firefox for that matter, can deal with them, so why are they always talked about regarding these browsers. For example, the brave recommendations warn against customizing its filterlists, “Using extra lists will make you stand out from other Brave users” but why should this matter for any browser except for mullvad and tor?

“Our tools:

  • Use multi-hop proxies to hide IP addresses and defend against network and geographic position fingerprinting.
  • Limit the number of fingerprintable web APIs whenever possible. This could mean altering the APIs, gating them behind user permissions, or not implementing them.
  • Inject small amounts of noise in return values of fingerprintable web APIs.”

“1. To make it more difficult to reliably extract details about the user’s configuration, Safari injects noise into various APIs: namely, during 2D canvas and WebGL readback, and when reading AudioBuffer samples using WebAudio.
2. To reduce the overall entropy exposed through other APIs, Safari also overrides the results of certain web APIs related to window or screen metrics to fixed values, such that fingerprinting scripts that call into these APIs for users with different screen or window configurations will get the same results, even if the users’ underlying configurations are different.”

“Here are some examples of features we have decided to not yet implement due to fingerprinting, security, and other concerns, and where we do not yet see a path to resolving those concerns:

  • Web Bluetooth
  • Web MIDI API
  • Magnetometer API
  • Web NFC API
  • Device Memory API
  • Network Information API
  • Battery Status API
  • Web Bluetooth Scanning
  • Ambient Light Sensor
  • HDCP Policy Check extension for EME
  • Proximity Sensor
  • WebHID
  • Serial API
  • Web USB
  • Geolocation Sensor (background geolocation)
  • User Idle Detection”

Sorry for the long post :slight_smile:

2

I don’t think it’s binary like that, the fewer parameters that are available for fingerprinting the harder it will be to tell users of a certain browser apart. When arkenfox is talking about naive vs advanced scripts, I believe they’re talking about whether a script will just eat a randomized value or not. If it doesn’t, but you’re the only one randomizing, then it becomes a tracking vector. If the feature is built into the browser and a lot of users are randomizing the same way, then it basically just has to throw that value away because it will be useless for fingerprinting. Firefox, Brave, and Safari all have randomization features built in that lots of people are using, so there’s your “crowd.” Couple that with Private Relay and the fact that Safari is only available on Apple devices with minimal hardware differences between people on the same model of device, and I think there’s a really great recipe for fingerprinting resistance.

You can try out fingerprint.com, it seems to struggle with Safari and they’re a commercial fingerprinting company.

3

Yes, fingerprint.com and creepjs can’t recognize me as long as I change my IP address. This and this can recognize mr though. I’m satisfied as long as it’s somewhat comparable to brave for now

4

Ironically both made by the same company. Keep in mind that your fingerprint staying the same doesn’t necessarily mean they can tell your specific device apart from others, keep in mind that there are millions of people using the exact same hardware and software as you.

Ideally you’d have another identical phone handy to see if you get the same fingerprint on both.

1 Like