The Recommendations pages about browsers make Tor seem more omnipotent than it is

Site Development
1

Right now, the Recommendations pages inflate the capabilities of the Tor and Mullvad browsers:

In Desktop Browsers

If you need to browse the internet anonymously, you should use Tor instead. We make some configuration recommendations on this page, but all browsers other than Tor Browser will be traceable by somebody in some manner or another.

Like Tor Browser, Mullvad Browser is designed to prevent fingerprinting by making your browser fingerprint identical to all other Mullvad Browser users, and it includes default settings and extensions that are automatically configured by the default security levels: Standard, Safer and Safest.

(Emphasis mine)

This strategy is the only way to thwart advanced tracking scripts, and is the same anti-fingerprinting technique used by Tor Browser.

(Emphasis mine)

In Mobile Browsers:

These are our currently recommended mobile web browsers and configurations for standard/non-anonymous internet browsing. If you need to browse the internet anonymously, you should use Tor instead.

(Emphasis not mine)

This language can give the reader the notion that Tor browser guarantees absolute protection from tracking, which isn’t true from what I’ve read, based on the discussion here.

Further proof of my point:

If I’m wrong about something, please correct me.

Edit: People have interpreted what I’ve said as meaning I don’t think people should use Tor or Mullvad. I do think people should use them, and I use them constantly, but I don’t think we should use such strong binary language talking about them or say demonstrably false things like “This will make you look identical to all other Mullvad browser users,” to make it seem like an untrackable browser, since that could give new users who don’t know better a false sense of security.

2

To fix this, it would help to change the text in the first quote changed so that it doesn’t look like Tor is the one browser that can’t be traced. The second quote should be changed to something like “make your fingerprint similar to a large number of other users,” instead of “all users.” In the third quote, I think the word “thwart” should be replaced with a softer word like “impede,” or a phrase like “reduce the capability of.”

The fourth quote could honestly probably be fine as it is if other things were changed.

3

So what browser should one use if they want privacy (Android)?

Say they’re using a vpn, how close could they get to anonymous browsing and what would be identifying?

4

Nobody can guarantee you anything, but Tor Browser is the best option we currently have. The most I would add is a small disclaimer that it isn’t perfect, but this basically applies to all software.

5

I’m not saying “Don’t use Tor, it can’t actually protect you.” It just needs clearer language.

6

I agree with you that Tor is the best option we currently have, but the language in the examples I gave makes it seem more capable than it is, which could give users a false sense of security. Again, the Rec page says the Tor and Mullvad browsers are designed to make the user look identical to all other users of that browser. A small disclaimer isn’t enough for a statement like that.

7

When I first read the pages, and I didn’t understand this stuff very well, with statements like “You will be somewhat traceable unless you use the Tor browser,” or “This browser makes you look identical to everyone else using that browser,” I got a false sense of security. That’s why I’m worried this happening with other users, because it happened with me.

8

Yeah, the entire browser section needs an overhaul. I already spent way too much time explaining stuff the past few days, so much of the info could be taken from there.

9

I’m honestly shocked such a basic misconception as “Tor/Mullvad browser makes you look identical to all other users” made it into the official guide pages and never got addressed.

10

https://mullvad.net/en/browser#:~:text=Therefore%2C%20Mullvad%20Browser%20has%20been%20developed%20with%20the%20purpose%20and%20ambition%20for%20all%20its%20users%20to%20appear%20as%20one

This gets repeated everywhere and everyone just runs with it, even though it makes no sense at all

11

Wow. From the devs themselves. Wtf??!

12

https://support.torproject.org/tor-browser/features/fingerprinting-protections/#:~:text=Tor%20Browser%20is,individual%20users%20effectively.

The Tor Browser page has it correct

13

We also desperately need that page explaining how browser tracking actually works. I’m frustrated that I don’t have a way of calling the needed attention to this issue.

14

I opened a PR, let me know if y’all think it looks good or if you would change the wording:

15

I’d add a caveat that Tor and Mullvad browser can’t guarantee that you won’t be tracked, just for the sake of clarity.

16

This is an interesting discussion

I personally read those sections to mean “every browser except Tor can definitely be deanonymized by someone”

I like Fria’s improvement

I think you could go a level deeper & make a reasonable argument that Tor Browser’s capabilities & limitations can’t be expressed without a full explanation of anonymity vs privacy, onion routing, etc, and propose that those resources should be compiled directly under the Tor Browser recommendation. I do not care enough to advocate for that

17

https://www.privacyguides.org/en/tor/#tor-browser:~:text=When%20modifying%20the%20security%20level%20setting%2C%20you%20must%20always%20restart%20the%20browser%20before%20continuing%20to%20use%20it.%20Otherwise%2C%20the%20security%20settings%20may%20not%20be%20fully%20applied%2C%20putting%20you%20at%20a%20higher%20risk%20of%20fingerprinting%20and%20exploits%20than%20you%20may%20expect%20based%20on%20the%20setting%20chosen. This could also be removed, since it forces you to restart now. Not sure if this would need to be in a different PR though.

18

I think that should be a separate one yeah but good to know.

19
20

I think there should also be some disclaimer about the security levels and how/when they should actually get used.