2026 Private Browsers: Ask Us Anything, Then Help Us!

WEH 2026 - Private Browsers: Ask Us Anything, Then Help Us!

• GitHub issue: https://github.com/Igalia/webengineshackfest/issues/100
• URL: https://meet.jit.si/WEH2026-private-browsers

(presents slides)

Justin: What about when a browser is trying to be private, doesn't this fingerprint you?

Elena: Yes, tor browser will stand out. Our strength is that all tor browser users will look the same. We are not concerned when it comes to tor browser, the list of relays IP addresses is public. By checking your IP address, someone will know you are using the tor network. We would like to start making the configuration appear like a computer that would have those properties. We are returning the screen width and height equal to the inner window, instead we want to report a normal screen, to make it seem more normal. If we can pretend to be a normal user, we will try.

Giorgio: one thing you could do to help us is use tor browser an hour per day, so that other people blend in. Another synthetic information we add and try to be more natural is the timezone, we used to return UTC for all users. Sometimes that would get us blocked as bots. We increased the population of Iceland by changing to icelandic timezone. Which is a real timezone.

Justin: If I am using the snowflake extension, then this is still public?

Elena: Someone would try to see who is offering snowflake, but generally speaking, it isn't a big problem. Even in more oppressive regions, I don't think snowflake is percievable.

Morgan (online): as a website, if someone comes to you, all you know is that some exit relay has contacted you. Snowflake guard and ordinary guard. The snowflake extension is opensource, and users are connect to snowflakes... you might be able to do the same ennumaration (of users??)

Rodrigo: Privacy and anonimity are not necessarially the same.

Elena: You can't hide your platform because there are so many non-standard properties, hiding your user agent is a false sense of security. Because people can detect it is a lie. You can't lie about your browsers version. Doing feature detection can reveal your user-agent version. About fonts, you can even detect which ones are available with a CSS-only solution.

(back to slides)

Lola: It sounds like a user of the tor browser, there are no user customizable features. Because it can open the door for fingerprinting.

Elena: A lot of settings are not available, anything that is detectable by JS or http headers. As an example, we allow customizing the language of the UI, but you won't be able to customize the language header. It either reflects your UI language, or it'll be en-US if you opted in for spoof English. But nothing custom as it would stand out too much.

Morgan: one of the main exceptions to this is accessibility features. Accessibility settings affect the dom, and can be affected by the website. But we can't blanket disable accessibility APIs because now users can use your browser. We discourage people from changing things, but we keep them around.

Elena: For colors, we have a profile of more accessible profiles, but you can't customize every single color. Tried to meet a middle option.

Cynthia: I think you support accessibility APIs, that can affect timing.

Elena: I don't know about timing, we change the performance API for sure. In addition to that, requestFrameAnimation also runs at 60Hz/every 16.6ms. So, I think that they might run in the same event loop with this quantization.

Justin: Making tor users look like non tor users is out of scope. Can you enable accessibility features for all users?

Elena: There isn't really settings we can turn on for everyone.

Justin: As a user who tries to use Tor for 1 hour a day, how, to make users more anonymous (?).

Zoe: You said that underlining all links is a bit much for all users, if you don't style your website, all links will have an underlining. That’s the accesible option, if there’s no CSS. So why not use that?

Morgan: There are a lot of different dom modifying things will alter the accessibility of the page, like the default text size or zoom, but there is no default setting which is globaly accessible and appropriate for all users. As a throw back, we have the mantra, anonimity likes company. Defaults are sensible enough to grow the user base, the goals is to have a sufficient number of users so that adversaries can't treat you differently. If you want to contribute to the herd of users, but don't want to use it to browse full time, use tor browser as a private browsing user. They use tor browser for things they don't want associated with their account. you can use tor for these kinds of things.

Daniel: about comments about customization, we try to find a middle ground for colors. There are people who are color blind who can't percieve certains colors. It's hit and miss, not sure if the colors you chose will work for every color blind. Maybe you can ask users which colors they can see.

Elena: I didn't work on the color feature, i don't know how the colors were chosen exactly, it was a collegue of ours who works on accessibility.

Daniel: maybe accessiblity needs to be considered in a way to involve the users in the choices.

Giorgio: we are a small team, there is one person in our small team who does mostly accessibility.

Elena: Between gatekeeping and user freedom, we are a FOSS software, we don't want to impose too much on users, they should have their freedom. But at a certain point, you don't know if users realize something will weaken their privacy.

Justin: I'm curious about the threat model is here. I guess I work at a company, and the company is doing something against the law, I download tor to report it. If I report a human rights violation at my work place. A tor user with low vision made this report, but we know a person with low vision at this company.

Morgan: Having to support accessibility (and customization) makes this work much much harder. The problem you mentioned is bad. The alternative is to disable accessibility features, so they can't use the browser to begin with. Try to inform users that they will increase risk. A real world example, a kid emailed a bomb threat to his school through tor. But he did it on the school network, and they were able to see who was using tor at that time, and narrow it down quickly. Another thing people miss out on, without tor browser, if you try to submit a human rights complaint through chrome, it offers the user information on a silver platter.

Justin: the alternative is that the subset of these features that provides the most accessibility to the most people could be enabled by default. If I want to help, can I turn on accessibility settings to help these users? Along with running tor most often to contribute to the tor.

Giorgio: we will put that in the bucket to think about with our accessiblity person.

(back to slides)

Rodrigo: Can translation extensions do fingerprinting from dom modifications?

Elena: if you can detect the text that is changed.

Rodrigo: Because it is local html, it doesn't go to server side

Elena: if you have javascript, you can watch.

(back to slides)

Lola: do you have any ideas of what parts of RFP you want to standardize?

Elena: it is a totally new thing, just came to mind since we are at a meeting of people who work on web standards.

Giorgio: starting with the list of Firefox code we upstreamed, understand if it is possible to create a resisting fingerprinting fallback. The prototype for that kind of work, would remove the responsibility on us and Firefox. We did the original research and implementation. When you use firefox you don't use it but you can enable it. Firefox is trying to uplift more things.

Justin: along these lines, I'm wondering, it seems like I don't use private browsing often, anything that could help increase usage like the tor network would help. Because if someone was like, who uses tor in my apartment building? it would be obvious is was me. At one of these events 3 years ago, I had a discussion, about what would it take to make default private browsering mode go through tor. The response then was that it was technically very hard. Is there anything like this?

Elena: The tor demon runs as a seperate process. Browsers are usually multi-process, but maybe managing a different process is more difficult or has some additional challenges (it sure has some on Android, where you aren't really allowed to spawn processes with the usual system calls).

Morgan: the other large elphant in the room is you can't dump all the private browsing users on the tor network because it would overload the tor network. We looked into it a bit. Too many internet users. Mitigations for that, you can always run tor relays, that would help.

Justin: Philospohically, I would love to run a tor relay, but when I tried, my internet connection was flagged as full of bots. I could only do it if the percentage of traffic that is normal enough is high enough.

Morgan: There are several different types of relays. The problem is that you were trying to run an exit relay, we don't recommend that for personal users. We do recommend it for big things like universities. It should be perfectly fine to run guard nodes or middle relays because your ISP isn't going to be able to determine this is bot traffic. If it comes in from a tor node, and leaves to a tor node.

Elena: or a snowflake proxy.