Defeat fingerprinting

Everyone in the same raincoat

Picture a crowd where everyone wears the same grey raincoat and hat. Spotting one person is hard, not because you cannot see them, but because they all look alike. That is uniformity: the browser reports the same values as everyone else using the defence.

The other main defence is randomisation (Brave and Floati call it farbling): add small, changing noise so the trait differs on every site. This lab tries uniformity.

Measuring in bits

In Leg 1 you met bits of identity: each bit halves the crowd. Here is a fair way to measure them for one person in a crowd:

bits = log2( (crowd size + 1) / (people who look exactly like you + 1) )

The + 1 counts you as a member of the crowd. If nobody in a crowd of 5,000 looks like you, that is log2(5001 / 1), about 12.3 bits: unique. If 4,999 people look like you, it is log2(5001 / 5000), almost 0 bits.

The plan

1. fingerprint_bits(crowd, fp): count the rows equal to fp on every trait in TRAIT_NAMES, then use the formula.
2. make_uniform(traits): return a copy with every trait in UNIFORM replaced. dict(traits) makes a copy; copy.update(UNIFORM) overwrites those keys.
3. uniform_filter(traits, page): plug it into Browser(world, trait_filter=uniform_filter) and every script reads the uniform values.
4. Measure Sam (recorded_fingerprints()[0]) in 5,000 synthetic browsers, before and after.

One honest detail in step 4: for the "after" number, apply make_uniform to the whole crowd too. Uniformity only hides you among other people using the same defence. If you alone wear the grey raincoat, you stand out more, not less.

What the numbers will tell you

You will remove several bits, but not all of them. Sam still reports a Linux system and a less common browser, and those two traits alone single out a small group. That is the real lesson of uniformity: it works best when everything is the same, including the browser itself. That is why Tor Browser makes every user look like the same browser on the same kind of system, and why it rounds the window size to a few standard steps (letterboxing).

A common misconception

"Faking a rare value hides me." A made-up value that no real browser reports, or a mix that does not fit together (a Mac graphics card on Windows), can make you more unique. Good defences pick values many real users share, and change them together.

const UNIFORM = { screen: "1920x1080", timezone: "Etc/UTC", language: "en-US" };

// Copy, then overwrite: the original object is untouched.
const makeUniform = traits => ({ ...traits, ...UNIFORM });

function fingerprintBits(crowd, fp, names) {
  const same = crowd.filter(r => names.every(t => r[t] === fp[t])).length;
  return Math.log2((crowd.length + 1) / (same + 1));
}

fn fingerprint_bits(crowd: &[Vec<String>], fp: &[String]) -> f64 {
    let same = crowd.iter().filter(|r| r.as_slice() == fp).count();
    ((crowd.len() + 1) as f64 / (same + 1) as f64).log2()
}