'Randomized fingerprint' is the wrong goal on Cover Your Tracks

Cover Your Tracks, the EFF's fingerprint test, gives its friendliest label to a browser with a randomized fingerprint. That label is right for what the EFF is testing: whether a tracker can follow one person across the web. It is the wrong goal if you run separate browser profiles, because a fingerprint that changes on every load is something a site can see, and an account whose browser never looks the same twice stands out. For profiles, aim for a normal-looking browser that stays the same.

What Cover Your Tracks is measuring

The test, the successor to the EFF's Panopticlick, runs in two parts. One checks whether your browser blocks tracking ads and invisible trackers. The other reads your fingerprint, the screen, fonts, canvas, WebGL, timezone, language and the rest, and compares it with the browsers it has seen. It reports how many bits of identifying information your fingerprint carries and puts you in one of a few groups: unique, nearly unique, or randomized.

Randomized means the test found values that change. Brave is the usual example: its fingerprinting protection adds small changes to values such as canvas and audio readouts, seeded per site and per session, so the same script on two different sites gets two different answers. A tracker that relies on a canvas hash to join a visit to a news site with a visit to a shop gets two hashes and nothing to join.

For a single person browsing as themselves, that is a sound defence, and the EFF is right to reward it. The Tor Browser takes the opposite route to the same end, making every copy look alike so that nobody stands out. Both strategies answer "can someone follow me around".

How it works: Machines that exist

A profile is asking a different question

A browser profile in an anti-detect browser is meant to be one account's computer. The site that account logs in to is supposed to see the same browser every time it comes back, just as it would if the account really had its own laptop. The question is not "can I be followed" but "do these two accounts look like two different people, and does each one look like the same person tomorrow".

Randomization fails the second half. A site that reads canvas twice in one page load and gets two answers has learned that something is rewriting canvas. A site that sees one logged-in account arrive with a new fingerprint on every visit has a fact no ordinary computer produces. FingerprintJS's demo shows the same rule from the other side, and we wrote about it as a pass with two halves: a different visitor ID per profile, and the same ID across two launches of one profile. Profiles that collide can be linked, and a profile whose ID changes every launch looks like a spoofer.

The same goes for blocking a value outright. An extension that returns a blank canvas or a fixed fake one is easy to read, as canvas blocker extensions shows: a fresh iframe asks the browser directly and gets the real answer beside the fake one.

What we count as a pass

Cover Your Tracks is one of the public detectors in Mosaic's detection catalogue, in the uniqueness group. The pass we wrote for it says that a "randomized fingerprint" verdict is the wrong goal for us, because randomisation is itself detectable, and asks for a normal-looking browser with entropy in line with a real one: roughly 16 to 18 bits.

The measured row read pass, 18.28 bits of entropy, fingerprint unique. "Unique" sounds bad and is not: on Cover Your Tracks most desktop browsers come out unique among the browsers the EFF has seen, because a few dozen ordinary values multiply out quickly. What matters is that the number is in the range a real browser produces, and that the next launch of the same profile produces the same browser.

Getting that row to read anything at all took two fixes, which is worth knowing if you automate the test yourself. The landing page runs nothing until its button is pressed, so a reader that only loads the page records a poster. And the results page prints a "How to read your report" section before any measurement arrives, so a check that waits for the words "bits of identifying information" fires too early. We wait for a number in front of the word "bits", which only the real result has.

How Mosaic keeps a profile stable

Each profile is drawn from one real device record and keeps it: the same GPU, screen and fonts every launch, with canvas, audio and WebGL noise derived from the profile's own seed rather than drawn per page load. Two profiles differ from each other. One profile does not differ from itself. Repairing a profile's hardware redraws the machine from its own seed and keeps its canvas identity, cookies and locale, so a repair does not turn it into a stranger to the sites it already uses.

The values are changed in C++ inside Tesseract Chrome, our own Chromium, so a second read from an iframe or a worker gets the same answer as the first. Real fingerprints covers how a profile is drawn, and what a browser fingerprint is lists the values a page can read.