Viewport width can be obtained via CSS, e.g. by using a media query for every screen width:

    @media (min-width: 400px) {
      .thing {
        background-image: url(size-400.png);
      }
    }
    @media (min-width: 401px) {
      .thing {
        background-image: url(size-401.png);
      }
    }

You could combine this with pixel density for even more specificity.

The tor browser bundle does have settings to disable media queries for this reason, but it is still conceivable to be identified by browser size unless you completely disable all embeded media (including images). Perhaps the browser delays loading images that aren't visible on the screen.

This seems almost trivial for the browser to fix. Just load all CSS resources, regardless of media query matching.

IIRC TOR is already slow. I am now sure you want to do this.

Yeah, it's speed for anonymity, just like everything else about TOR.

What idiots thought this was a good idea? I swear, sometimes it seems like browser writers, standard writers, and website writers are actively colluding with advertisers and spies to make it easier to uniquely track everyone.

Well, the idea was to do stuff like

    @media(max-size: 200px) { #container { background: url(tiny_mobile.png); } }

    @media(max-size: 400px) { #container { background: url(small_mobile.png); } }

    @media(max-size: 800px) { #container { background: url(medium_tablet.png); } }

    @media(max-size: 2000px) { #container { background: url(large_desktop.png); } }

    @media(min-size: 2000px) { #container { background: url(retina.png); } }

Not always loading the same image is a good idea on mobile.

See my reply elsewhere. Background images are bad meaning this isn't a very compelling argument.

Often these aren't really background images, they're just using that to set image sources via CSS. These days you can do the same thing with srcset, which also allows someone to learn your screen resolution.

It's almost as if when your goal is to track someone you can use widely available, generally innocuous means to do so.

People being smart is the horse, and programmers colluding with "advertisers and spies" in a massive fashion is the zebra.

There's kind of a long-term issue about the web platform changing in ways that increase trackability, often without people thinking about it (or maybe in a few cases without people admitting that they thought about it).

There is a W3C TAG document that touches on this at

http://www.w3.org/2001/tag/doc/unsanctioned-tracking/

One problem is that there are so many ways of tracking user-agents in the web platform today that it can be hard to convince anyone that addressing one of them will improve the situation. :-(

You're the one who sent an HTTP request to a web server. They're only "tracking" requests your browser makes to them. If you don't want a site tracking you, stop sending them data.

I can and do control many of the requests a website tells my browser to make. I deny javascript. I deny cookies (strictly speaking I have cookies deleted when I close the page). I deny flash. I deny third-party objects. I do this because I have knowledge about them (and just the right amount of paranoia about other parties). I lament the fact that other people don't and bitch about it when appropriate.

Well, if I put a HD background picture on a website, I sure don't want it to load on a mobile and use all of this user's data. It only makes sense.

Don't put HD background images on your website! Desktops have bandwidth caps too and most people are only interested in the page text not frilly multimedia.

Indeed. Background images were bad in the geocities age, background images were bad in the myspace age, background images are bad in the current tumblr age.