Sam Bent: Tor Browser’s Latest Update Could Get You Fingerprinted

privacy4all · July 20, 2025, 1:09pm

This discussion isn’t happening without context. The context was operating system spoofing removal for Tor Browser.

I wasn’t aware there’s a class of attacks.

Thank you.

So there’s fonts which Tor Browser mitigates and the paper helped to fix related bug in Tor Browser.

And there’s CSS calc to detect the operating system. Here’s their proof of concept that I haven’t tried.

github.com/cispa/cascading-spy-sheets

pocs/browser/poc_firefox.html

ecad63da6

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>CSS Calc Fingerprinting PoC</title>
  </head>
  <body>
    <h4>Calc OS Fingerprinting</h4>
    <p>
      This is designed to distinguish installs of Windows 11 and Ubuntu
      22.04 LTS.
    </p>
    <style>
      .wrapper {
        width: fit-content;
      }
      #containerCalc {
        container: calccontainer / inline-size;
      }

This file has been truncated. show original

I’d hope these bugs could be fixed instead of giving up on OS spoofing entirely.

Topic		Replies	Views
Accuracy of Sam Bent video criticizing TOR (and PrivacyGuides) on HTTP Header OS spoofing removal? Questions video	58	3283	July 26, 2025
Tor Project removed OS spoofing, then lied to all it's users General	1	699	July 25, 2025
Help with VPN/Tor and fingerprinting Questions	3	321	February 26, 2025
Fingerprint.com can Fingerprint me when I use Tor General browsers	6	1102	February 7, 2025
Is web fingerprinting still mostly "naive" rather than "advanced"? Questions browsers	3	555	December 4, 2024

Sam Bent: Tor Browser’s Latest Update Could Get You Fingerprinted

Related topics