Fingerprinting Protections (original) (raw)
What is Fingerprinting Protection?
Fingerprinting Protection is a privacy feature that makes it harder for sites to track you while you browse.
Technical details
Brave includes best-effort defense against browser fingerprinting. Broadly speaking, browser fingerprinting is the detection of browser and operating system features that differ between users for the purpose of covertly identifying users and tracking them across the web. Although fingerprinting attacks will always be possible, it is worthwhile for us to make these attacks as slow / costly / difficult as possible.
Brave includes two types of fingerprinting protections, (i) blocking, removing or modifying APIs, to make Brave instances look as similar as possible, and (ii) randomizing values from APIs, to prevent cross session and site linking (e.g. making Brave instances look different to websites each time).
In cases where we block, remove or modify API behavior, we attempt to return empty, or non-identifying values, that have the "shape" of expected values, to minimize web compatibility issues.
In cases where we randomize API values, we attempt to make modifications that are imperceivable to humans, but distinguishing to computers / fingerprinters. These randomization values are derived from a seed that changes per session, per site (eTLD+1) and per storage area. Third party frames and script share the seed value of the top level, eTLD+1 domain. This approach is especially useful in fingerprinters that hash together a large number of semi-identifiers into a single identifier, since randomizing just one value "poisons" the entire fingerprint.
More information about Brave's "privacy through randomization" systems can be found in the privacy series on Brave's blog.
Why does fingerprint.com or some other website say that I am fingerprintable?
You may see claims online that fingerprinting services can accurately fingerprint Brave users. This can be confusing when using Brave, but it doesn't mean your privacy is compromised.
FingerprintJS vs Fingerprint Pro
Brave's anti-fingerprinting measures comprehensively defeat FingerprintJS, the open-source browser fingerprinting library. Try visiting the FingerprintJS demo website in Brave: first in a normal Brave window, and then in a Private Window (or use any of the testing approaches listed here). Because Brave introduces "noise" into your browser's data, the library cannot generate a stable identifier based on your browser. This has been confirmed by the library's own developers, who concede that FingerprintJS doesn't work on Brave.
Fingerprint Pro, on the other hand, is a closed-source commercial product selling a user-fingerprinting service. Instead of evaluating browser attributes client-side, the Fingerprint Pro commercial product sends your browser's attributes to their backend, where they are combined with heuristics such as your IP address, time of visit, etc. to generate a fingerprint.
Importantly, Fingerprint Pro uses the exact same browser attributes as FingerprintJS (which Brave is already able to defeat). We verified this by comparing the data sent in the network requests.
Demo vs real-life
Commercial demos are designed to look impressive. If you visit a demo website twice in one minute from the same IP address, their server can "guess" you are the same person, even if Brave has changed the browser's website-visible attributes. In the real world, this fingerprinting method is much less effective. As time passes or you move to a different Wi-Fi network (or use a good VPN such as Brave VPN), these server-side guesses fail. These issues are amplified on larger platforms and websites. Our research with privacy browser peers shows that these services have an extremely high false-positive rate, meaning that instead of uniquely identifying you, they are incorrectly lumping you together with many other Brave users.
How does Brave protect me?
Brave actively blocks network requests to fingerprint.com's domains and other known fingerprinting services as part of our broader anti-tracking features. This is in addition to the best-in-class fingerprinting protections described on this page.
For an unbiased evaluation of fingerprinting resistance, we recommend tools including the Electronic Frontier Foundation's Cover Your Tracks. Unlike product demos that aim to sell a service, tools including Cover Your Tracks are built to inform and empower users. We also recommend checking out open-source automated privacy tests such as those done by privacytests.org as well as academic research for a broader and better evaluation of browsers for privacy.
How to check that Brave's fingerprinting protections are working
Visit a site such as https://browserleaks.com/canvas, note the fingerprint, and then visit the same site in:
- Private Window
- Private Window with Tor
- After restarting the browser
- In a different profile
- After clearing storage for the site
You should get a different fingerprint each time.
Fingerprinting methods randomized
You can see a complete list of completed anti-fingerprinting work here. For a comprehensive test suite for all the APIs we protect, see our test website.
How do I see fingerprinting protections active on a page?
You can select Shields > Advanced > Press the > arrow next to Block fingerprinting
