Fingerprinting v3: Window size

[riastradh-brave]

This one is difficult because often we can't effectively spoof the window size when various JavaScript and CSS hacks can discover what elements obscure one another placed alternately relative to the content and to the viewport.

Options:

• Do nothing. Bad for user privacy.
• Try to lie anyway. Bad for user privacy against adversaries spending a modicum of effort (unless there is a way to spoof it all the way through the JavaScript and CSS hacks that doesn't break the world).
• Snap window to a grid. Potentially frustrating. May not help with full-screen use.
  • Maybe also warn user not to resize window near checkbox for fingerprinting protection.
• Randomly resize window as user is browsing. Probably a non-starter!
• Other ideas?

[evanstucker-hates-2fa]

https://www.zdnet.com/article/firefox-to-add-tor-browser-anti-fingerprinting-technique-called-letterboxing/

[simonsan]

First I would give a warning about that changing windows size could make it easier to track your web identity like in Tor Browser.

Second I would give an option to Lock the browser window in size to not accidentally change it.

Third I like the "letterboxing"-idea of mozilla. Could be worth a try, tbh.

[houruomu]

Is there an option to reset the window size in every new (private) window of Brave? If not, adding one would be a good start.

[rillian]

Is there an option to reset the window size in every new (private) window of Brave? If not, adding one would be a good start.

This seems like the most feasible proposal. Either way I think it probably wants some kind of user notification.

[rnsjunkmail]

If the most common window size(s) used was researched and used this could be a option the user chooses to increase their privacy/security. If Firefox and Chromium joined in this the # users using the most common would increase (you could have windows open in a rotating pattern of the 3-4 most used window sizes. Maybe rounding window size to a set of most common window sizes could help too.

Another alternative might be to handle the window sizing locally instead of remotely?

Use the methods used by trackers to ascertain the window size and establish a set of recommended common window sizes. using that set would obscure uniqueness.

[yamabiiko]

A letterboxing approach like Mozilla's would be awesome. Any update on this?

[pachainti]

A letterboxing approach like Mozilla's would be awesome. Any update on this?

I strongly agree. According to this comparison, fingerprint tests are where brave performs badly.

[pachainti]

Any update?
Thank you

[derde]

How about varying the DPI and slightly fuzzing the aspect ratio? e.g. Actual screen is 2560x1600, and the reported size is anything from 1024x640 to 1000x600 to 4000x2400.