You can't get around giving nearly the entirey of the User Agent string simply thorugh feature detection (well, except for the phone model when on mobile). Canvas and WebGL can be fixed by limiting their functionality, or at least that's what Firefox does in the aforementioned mode. Canvas could conceivably be fixed to just behave the same everywhere, but for WebGL you have to limit it to some common denominator to hide the GPU model, so privacy nessesitates less functionality. The list of plugins can be spoofed to be empty. Screen resolution (or more importantly, window size) has to be somewhat accurate because lots of websites use it for responsive design. Firefox can round the window size to the nearest multiple of 200x100 which doesn't break too many things, but that's still far from giving the same value for everyone.

https://wiki.mozilla.org/Security/Fingerprinting

> Canvas could conceivably be fixed to just behave the same everywhere, but for WebGL you have to limit it to some common denominator to hide the GPU model

You can just measure performance of those things then.

Unless two browsers are identical there's almost always a way to detect some particularity.

And even if the browsers are identical there are still some ways to detect different user based on client side behavior (assuming JS is enabled, or some particularly crazy CSS)

Just giving the same value for everyone on the latest version of Firefox using Windows 10 with a maximized window on a 1920p display would seriously hamper fingerprinting. It can still be enough when used with other information (IP, visited sites etc), but at least it would dilute the signal a lot.

Section 3.2 'Advancing fingerprinting' shows some more ways you can find particularities which will be hard to hide.

Yes it really should.

Chrome on Android reports your phone model and build number. If you're using a lessor known phone with a carrier specific ROM, then you're in a really tiny population.

Yes, but it will break functionality because servers use it to apply hacks on the website before the content is served.

WebRTC is another one which you can disable. JavaScript, in general, as well, requiring uMatrix.

Chrome leaks the extensions you use, Firefox does not (AFAIK). As for blocking canvas, see [1]

To test your fingerprinting I can recommend IPleak [2]

The problem of this all is, its a usability nightmare.

[1] https://addons.mozilla.org/en-US/android/addon/canvasblocker...

[2] https://www.ipleak.net

They’ll manage. Just standardize to a fixed value.

> Chrome leaks the extensions you use,

Sure... "leak", wink wink.

Not without breaking Grandma's favorite online banking website.

User agents are not that great of tracking.

If you use a common device and browser kept up to date to the latest versions, then you are not going to be unique. Using Safari on an iPhone will make you similar to 30% of web traffic.

Browsers also update all the time changing the user agent so it isn't that reliable tracking over extended periods of time.

The am I unique websites seem to compare your user agent to a database with outdated browser versions from the past data, making your score look much scarier than it really is. If you keep things up to date, chances are that you are not that unique.