Palemoon (firefox fork) have a lower score

[momala454]

trust score: 69% D+

Not sure if it's caused by this :

1: plugin name contains gibberish: [AAMDe, eAAMD, eAAMDe] AdobeAAMDetect
2: plugin description contains gibberish: [NPRu] NPRuntime Script Plug-in Library for Java(TM) Deploy

[abrahamjuliot]

I adjusted the letterCaseSequenceGibbers and made the detection less strict. It now only flags these gibbers if there are 4 or more in a string, but I imagine there will still be false positives.

Each item of trash withholds 15.2% from the total score, so I'm adjusting the trust score to provide visitors 20% extra credit for not switching the loose fingerprint more than 1x.

[momala454]

not sure if 120% is an expected result :D

trust score: 120% A+

also, now firefox have 99% instead of 100%, is it normal ?

[abrahamjuliot]

I applied a fix. More on that in #128.

Firefox

Yes, it's normal in Firefox. The loose fingerprint is unstable: window properties change if the console is open, WebRTC connection can be a hit or miss, CSS import media queries can fail to load, fonts may not be fully loaded on the initial visit, and if privacy.resistFingerprinting is on, every visit generates a new canvas fingerprint.

I could find ways to address this by targeting Firefox, but it's also an issue in chromium development and experimental builds. For example, if I'm use Chrome Canary, the window properties change frequently.

[momala454]

thanks, it could be a good idea to display easily readable the list of things that made the score lower (by how many percent each also), because right now i have no idea why i'm at 98

[abrahamjuliot]

That's a great idea. I published this with a number of fixes:

• the percent loss and reward is now displayed alongside header metrics
  • trash, lies, errors, loose switched
• css @import now defaults to unsupported in Firefox. It seems to be the major offender in Firefox - it fails frequently at random. Also, I suspect it's overloading the event loop and causing Voices and WebRTC promises to fail (will test more). Firefox still has loose metrics on the window features, but this is less frequent.
• session detail is now displayed in the header
  • I'm currently not tracking loose metrics that switched on the server, but the section hashes are tracked per session. So, if something does switch during a tab session, it will show up under Session Switched. The detail, however, on what changed is minimal: I'm only checking the section hash. To review greater detail on properties that changed, I copy the JSON from the console and run diff comparisons at diffchecker.com.

[Thorin-Oakenpants]

There are a number of things going on here

• metric trust: is a metric the real value or is it being faked (e.g. random or static)
• metric stability 1: changes with prefs/flags especially in beta/devs/nightly/canary etc, browser updates (version) etc
• metric stability 2: random changes from extensions: e.g. extension sliders (cydec standard vs strict, brave standard vs strict), or privacy possum heuristics .. etc
• metric stability 3: changes to underlying equivalency: such as blocked document fonts (which can be per site), or things like zoom level

The science of linking fingerprints is a difference branch IMO. In Firefox I can detect the zoom level with some degree of certainty, in chrome I cannot (yet, and can't be bothered). And some metrics you can eliminate the offending equivalency/factors: don't use fonts in canvas, use relative measurements in domrect/textmetrics etc.

Stability is important, as long as it doesn't compromise overall possible entropy: e.g. does removing fonts from canvas/webgl tests reduce entropy that isn't already gained elsewhere? Fingerprinting canvas randomizing: is this stable: what determines the metrics in this: e.g. low vs medium vs high is based on what % e.g of pixels changed, or degree of channel values moved, etc?

At the end of the day, you can collect everything you want and FP loose-as-you-like to show that things change, but you can still connect different loose FPs, especially if you have enough information: such as was changing doc fonts blocked, what is the zoom level, etc

Class, discuss!!