You can have what Tof browser does by using Firefox and setting privacy.resistfingerprinting in about:config. But be prepared to solve a lot of recaptchas, and don't hold your breath on Google implementing something similar in Chrome. Google is still an adtech company. They didn't spend millions (if not billions) on making and promoting Chrome only to support fingerprint resistance.

Maybe minor nuisance (probably major for some): with privacy.resistfingerprinting, Wastsapp web does not even allow authentication.

That's what distributions are for: patching out anti-features among other things.

This will only shift efforts to extract uniquely identifiable information through side channels instead of directly. So you also need to disable javascript or redesign it to prevent side channel attacks (it's possible, but would be a completely new javascript compiler with not entirely compatible language, also this would mitigate spectre attacks).

However first you need some serious regulations to split Google and take away its browser "business". As it is Google is doing everything to preserve and advance tracking and fingerprinting in web browsers.

Apple has done this with safari, now we need other vendors to follow suit. I wouldn’t hold your breath given the near-monopoly chrome has as of late.

it hasn't, it was PR. look up amiunique.org or panopticlick.eff.org with Safari.

Apparently one in 900 browsers has my list of system fonts, by far the most identifying thing Panopticlick could detect. However, the font list looked completely vanilla to me. I wonder if there's a telltale one in there that I installed manually.

Are they in alphabetical order? The order of installed fonts used to be a dominant attribute in browser fingerprinting, before some browsers took steps to normalize it.

Other than that, things like presence/absence of common variants like bold, and possibly some common fonts come packaged with office software rather than the OS.

How does this work? For instance I have an iPhone model, so why would screen resolution help increase identifying bits coupled with the user agent? Everyone with my phone version and OS version will have the exact same values.

>For instance I have an iPhone model, so why would screen resolution help increase identifying bits coupled with the user agent? Everyone with my phone version and OS version will have the exact same values.

The user agent for mobile safari doesn't identify the iphone model, only that it's an iphone[1]. Knowing the precise model definitely helps to fingerprint more.

[1] random search: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Yep, I was super disappointed when I tested this.

the marketing department probably decided that it needs to be done and the safari engineers realized this would completely destroy usability for a majority of users, so they quietly abandoned it.

Especially as it isn't as simple as a standardized list of fonts when the Canvas hash is 100% unique for everyone.

Still very disappointing.

The Safari team has not "abandoned" this effort: they are still working on reducing the fingerprinting surface area (of recent note, Safari has removed its "do not track" preference, which was used as a fingerprinting datapoint, no longer presents installed third-party fonts to websites, and no longer supports most plugins). The issue is that they have not "solved" the issue yet.

Intelligent Tracking Protection is a work in progress in which Apple actively checks what trackers are using and disables it. The next iOS/MacOS releases will have the next version with new restrictions on tracking.

The issue will be solved when all tracking companies have collapsed and that industry is dead. Clearly we aren’t there yet.

the test shows unique system fonts for me.

Here's a quote: "There will also be new security measures to prevent digital fingerprinting, or the use of things like installed fonts and plug-ins to help track users across the internet even with privacy settings active. Websites will be given a stripped down, simplified system configuration so every user's Mac looks like every other user's Mac."

This is what my modern Safari exposes:

Andale Mono, Arial, Arial Black, Arial Hebrew, Arial Narrow, Arial Rounded MT Bold, Arial Unicode MS, Comic Sans MS, Courier, Courier New, Geneva, Georgia, Helvetica, Helvetica Neue, Impact, LUCIDA GRANDE, Microsoft Sans Serif, Monaco, Palatino, Tahoma, Times, Times New Roman, Trebuchet MS, Verdana, Wingdings, Wingdings 2, Wingdings 3 (via javascript)

I have hundreds more fonts installed. Panopticlick says that about 1 in 14 browsers have this value, so your browser should have it too.

I have to withdraw my original statement, Looks like I have the same set of fonts as you.

So that part seems to work, I was just confused because the effect on overall uniqueness is very low. Still I applaud the efforts by the WebKit Team.

The engineering department should have told the marketing department that they didn't implement it.

But this is how big companies behave. They have this unwritten policy to justify any anti-competitive, anti-user behavior with "security" and "privacy" PR.

Probably not; that task is equivalent to coordinating between browser vendors to make their software behave in every way identically, and these are generally radically different pieces of software.

Ideally every browser implements web standards the same and looks identical…

You can't even get TCP/IP implemented consistently, which is why we can passively identify operating systems just by observing packets. What hope do you have of getting browsers to be indistinguishable?

Practically, not much. Ideally, though…

This is the problem with anti-fingerprinting. It's a genuinely hard problem, not in the "it takes a lot of code and a lot of will to get it done" sense, but in an "it's unclear what computer science has to say about this problem right now" sense. It's up there with DRM/antimalware (two sides of the same coin).