I ran the EFF’s Cover Your Tracks tool against three different browsers on the same machine last month, expecting the privacy-focused one to come out clean. It didn’t. The browser I had configured with the most protection settings enabled registered as more uniquely identifiable than a stock Chrome install, because the unusual combination of protections itself formed a distinctive fingerprint. That experience pushed me to spend a few weeks actually understanding how browser fingerprinting works and which defenses hold up in practice.
This is not a survey of every privacy tool on the market. It’s field notes on what I tested, what worked, and where the tradeoffs landed.
What Browser Fingerprinting Actually Collects
Browser fingerprinting assembles a profile from dozens of data points that your browser leaks during normal page loads. The obvious ones: user-agent string, screen resolution, timezone, and installed fonts. The less obvious: how your GPU renders specific WebGL test scenes, the timing characteristics of your CPU doing JavaScript math, the exact set of audio codecs your browser supports, and whether your canvas element draws anti-aliased edges identically to other users running the same browser version on different hardware.
Each data point on its own is close to meaningless. Combined across 30-50 signals, they frequently produce a unique identifier. The EFF’s Cover Your Tracks project, which tests real-world fingerprinting against a database of millions of browser profiles, found that the majority of browsers they tested were uniquely identifiable—or nearly so—without any cookies at all.
The key difference from cookie tracking: there’s nothing to delete. Clearing your browser history, blocking third-party cookies, and using incognito mode all leave your fingerprint intact. The fingerprint is based on the state of your hardware and software, not on stored data.
Testing Your Own Browser Fingerprint
Before changing anything, it’s worth establishing a baseline. The most useful free tool is Cover Your Tracks from EFF. It tests your browser against a live database and tells you whether your fingerprint is unique, gives you a protection rating, and shows you which signals are contributing most to your identifiability.
The second tool worth running is BrowserLeaks, which breaks out individual API leaks—WebGL renderer info, canvas fingerprint, AudioContext fingerprint, font enumeration—so you can see exactly which vectors are exposing the most identifying information.
A few things to note when interpreting results:
- A “unique” result doesn’t mean someone is currently tracking you—it means you could be tracked stably if any site embeds a fingerprinting script.
- Results change with browser updates, OS updates, and hardware changes, so fingerprints have some natural decay.
- Testing with a VPN active tests the VPN’s IP reputation but doesn’t change your browser fingerprint at all. Those are separate threat models.
Which Defenses Work and Which Backfire
Tor Browser remains the most technically effective solution. It normalizes the fingerprint across all Tor Browser users by using the same default window size, the same font set, the same rendering behavior, and by funneling all traffic through the Tor network. The cost is performance and broken functionality on sites that block Tor exit nodes. For high-stakes privacy work—journalists, activists, researchers accessing sensitive materials—this is the correct tool.
Firefox with privacy.resistFingerprinting enabled is the most practical daily-driver option. The privacy.resistFingerprinting flag in about:config enables a suite of protections that spoof or normalize many fingerprinting signals: it reports a fixed screen size regardless of your actual display, randomizes canvas output per session, and limits timezone leakage. Combined with uBlock Origin and Firefox’s Enhanced Tracking Protection set to Strict, this produces a substantially more private profile than default Chrome.
The caveat I encountered: layering too many additional protections on top of this actually increases uniqueness. A Firefox install with privacy.resistFingerprinting, plus a custom user.js with 40 additional flags, plus a fingerprint-spoofing extension, registers as more unique than Firefox with just the one flag enabled, because the combination is rare. The EFF’s fingerprinting research explicitly documents this paradox—being in a crowd of users with identical settings is the goal, not having the most aggressively customized setup.
Brave Browser takes a different approach: randomizing fingerprint signals per session rather than normalizing them. Instead of making your canvas output match everyone else’s, Brave makes your canvas output slightly different on every page load and every session. This breaks the cross-site tracking use case but doesn’t make you blend into a crowd the same way Tor Browser does.
Chrome with third-party cookies blocked is better than unmodified Chrome but still highly fingerprintable. Adding uBlock Origin and keeping the browser updated provides more benefit than any fingerprint-specific settings.
Practical Setup for Daily Use
After testing, my working setup uses Firefox as the primary browser with the following configuration:
privacy.resistFingerprinting = trueinabout:config- Enhanced Tracking Protection set to Strict
- uBlock Origin in medium mode (blocks third-party scripts by default, whitelist per site as needed)
- DNS-over-HTTPS enabled, pointing to a resolver that doesn’t log queries
- Firefox containers for site isolation—financial sites, social sites, and general browsing each get separate cookie jars
That’s five changes, none requiring technical expertise beyond reading a settings page. The result when I re-ran Cover Your Tracks: no longer uniquely identified, fingerprint protected against tracking.
I keep a second browser—Chromium—for sites that break with strict tracking protection. Compartmentalizing rather than fighting every site is more sustainable.
For people running their own servers or homelabs, a Pi-hole DNS sinkhole handles fingerprinting-adjacent ad network domains at the network level and protects all devices including phones and smart TVs that can’t run browser extensions. The post on homelab hardware for self-hosted services covers the hardware side of running always-on infrastructure like Pi-hole alongside other services.
Mobile: A Different and Harder Problem
Mobile browsers are a significantly weaker privacy environment. Safari on iOS has Intelligent Tracking Prevention, which limits cross-site cookie tracking but doesn’t address fingerprinting. Brave on Android provides the same randomization approach as the desktop version. Firefox Focus blocks trackers aggressively but lacks the extension ecosystem of desktop Firefox.
The harder problem on mobile is the app layer. Browser fingerprinting defenses don’t apply to native apps, which can collect device identifiers, precise GPS coordinates, and behavioral data through SDKs embedded in apps you use for entirely unrelated purposes. The most effective mobile privacy measure is auditing what apps have network permissions and deleting anything where the data collection isn’t worth the functionality. iOS’s App Privacy Report and Android’s permission manager both make this tractable now.
For security-focused reading that covers both browser and application-layer tracking, the books below cover the technical and policy dimensions. These are affiliate links, which means I may earn a small commission from qualifying purchases at no extra cost to you.
- Browser privacy and security books on Amazon — covers fingerprinting, tracking mechanisms, and defense strategies in depth
- Privacy engineering practical guides on Amazon — technical treatment of building and auditing privacy-preserving systems
- Raspberry Pi for Pi-hole on Amazon — a low-power board that runs Pi-hole for whole-network tracking domain blocking
- Laptop privacy screen filters on Amazon — physical layer protection for working in public spaces
What to Actually Do This Weekend
If you’ve read this far and want a concrete action rather than another things-to-consider list:
- Open coveryourtracks.eff.org in your current browser and run the test. Note your result.
- If you’re on Firefox, enable
privacy.resistFingerprintingand install uBlock Origin if you haven’t. Re-run the test. - If you’re on Chrome, consider switching to Firefox or Brave for personal browsing. Keep Chrome for work compatibility if needed.
- Check your phone’s App Privacy Report (iOS) or app permissions (Android) and revoke network access from apps that don’t need it.
The goal isn’t perfect anonymity—that requires operational discipline that most people don’t need in their daily lives. The goal is not being the easiest target in the room. Reducing your fingerprint’s uniqueness removes you from the highly-identifiable population that advertising networks, data brokers, and tracking scripts can follow reliably across sessions and sites.
If you’re running your own infrastructure and want to track how tracking works at the network level, the post on NVMe SSDs and Docker development environments is adjacent reading for people setting up self-hosted DNS and security tooling.
For more privacy and security field notes, follow Alpha Signal on Telegram.
📧 Get weekly insights on security, trading, and tech. No spam, unsubscribe anytime.
Leave a Reply