I have been testing Tor Browser and Mullvad Browser using fingerprint.com. I get unique persistent identifiers that are unique per machine and persist over rebooting sessions. Javascript was on during this test.

This could be very dangerous to people using Tor Browser and Mullvad Browser.

For example, if someone visits Rainbow Railroad, an organization for leaving repressive countries with hostile LGBT policies, and then watches a video about the organization on YouTube, and then also does something, like create a Discord Server, and use Tor Browser to get around geoblocking but link it to their personal phone number, then a hostile regime buying data from data brokers could possible determine that user is considering using rainbow railroad. Even if this exact example isn’t realistic or plausible (although governments do buy form data brokers), users should be aware that persistent identifiers in Tor Browser and Mullvad Browser allow for continuous tracking of a user using the same machine.

I posted this information on privacyguides forum and they deleted my account after, leading me to wonder if the forum is a giant honeypot that curates acceptable privacy discussions and unacceptable private discussions. I honestly wonder if they are infiltrated by the government. They repeatedly delete the posts of other people as well and the whole thing is starting to not sit well with me.

  • fatcat@discuss.tchncs.de
    13·
    23 hours ago

    I can actually replicated that. Tor Browser without extensions (only the default https anywhere and noscript) on Mac OS. Pretty scary? Wondering how this works.

    • fatcat@discuss.tchncs.de
      34·
      23 hours ago

      Aha! I figured it out. Apparently my Tor browser got old extensions in there from older Tor versions (Tor Button and something i can’t remember, they were set to deprecated and were disabled). I had Tor literally installed for… over 10 years or something, so I would imagine it didn’t reset itself properly after doing one update or another. After removing the Tor Browser data folder and reinstalling it (for good measure, don’t think that was necessary), I get random values on the page.

      EDIT: One additional thought on that… I feel this is something Tor Browser should consider automatically when applying updates. At least a warning would be good to reset your data once in a while to stay non-unique.