We ran some tests with a similar library and about 15% of the time we'd get hash collisions from completely different users. Sure, my setup might be totally unique, but other peoples vanilla installs are identical.

What would help against modern browser fingerprinting technologies?

Maybe Tor to some degree?

The design doc is full of references regarding fingerprinting and "fingerprinting anonymity/reduction" itself is mentioned explicitly within the adversaries chapter.

https://www.torproject.org/projects/torbrowser/design/

I'm not an expert, so there may be a better answer for this, but I choose to act online as if they are not defeatable.

What about a disposable VM in Qubes OS?

Sounds like all the fingerprinters would build up a profile of the one person running Qubes from your IP.

Be more specific, I know there are things like Canvas Fingerprinting. I'm not sure I can appreciate your claims without you citing specific examples.

That's not the nicest way to ask for additional information, but see:

https://panopticlick.eff.org/about#browser-fingerprinting

> The site you are visiting may choose to analyze your browser using JavaScript, Flash and other methods (just like Panopticlick does). It may look for what types of fonts you have installed, the language you’ve set, the add-ons you’ve installed, and other factors. The site may then create a type of profile of you, tied to this pattern of characteristics associated with your browser, rather than tied to a specific tracking cookie.

Presumably this is the kind of tracking that the EU ePrivacy directive prohibits.

Browser fingerprinting is really scary, but AFAIK there are no major websites using it yet right?

It should be fairly easy to detect if something you Google in an different browser session suddenly turns up as an ad on Reddit after you've deleted cookies and cleared history. Also it seems unlikely that Reddit would implement something like this after considering the outcry over the possibility of the Facebook mobile app recording audio. Especially since Reddit has a large technical userbase who are aware of privacy concerns in fingerprinting technologies.

E: why is this being downvoted?

Simplest way to see if you're fingerprintable is to go to https://panopticlick.eff.org/. I can't promise they are up to date, so if you get a 'Not fingerprintable' result, it may be incorrect.

But, if the EFF can fingerprint you, almost any website in the world can, or their ad network can.