Even Firefox, Firefox Privacy on Android gives away android version in the User Agent. New Tor browser (android) fakes it, I remember even old Orfox used to give away device name as well & there used to exist an open issue to address it in their issue tracker.

> Browser plugins really need to go away. If it's not implementable normally then it shouldn't be on the web. In my opinion at least.

So no more ad blockers?

There’s a difference between plugins and extensions. Plugins add support for new types of media (think Flash, Java) while extensions are your adblockers and userscripts.

Plugins also provide support for new video codecs. Plugins are definitely the wrong place for it but I would be so happy to see codecs factored out of individual browsers.

That would make the list of supported video codecs a better fingerprinting mechanism.

Is there any reason why we couldn't have all browsers on all platforms use the same user agent header? I realize some sites use the user agent as a crude form of feature detection, but it's my understanding that that's generally considered to be bad practice.

Sometimes there are browser bugs that are impossible to do feature detection for, in which case have no better option than looking at the user agent.

For instance, several versions of Firefox had a serious bug in shared workers, which appeared intermittently when users opened your site in multiple tabs https://stackoverflow.com/questions/51092596/feature-detecti... - I had to use the user agent to work around this.

Sure, this is a fair use case. But then can't the browser tell the end user that someone wants to read this browser data so the user has a chance to say "no"?

Changing user-agent is virtually always possible, though a vanishingly small fraction of users will do so.

Bundling into adblockers or browsers directly would help.

Apart from the difficulty of obscuring this information from JavaScript, it's politically impossible.

Chrome could change its header to the header of a competitor or a neural one, but has no reason to (Google's main business is delivering ads). For other big browsers like Firefox and Safari it would be a huge loss to change the header: they would vanish from browser market share statistics, and with that the business case to make websites work well with their browser dwindles. That in turn would reduce their actual market share. That only leaves the browser with a market share so tiny they are ignored by developers, and those browsers do often spoof the user agent header (or at least make it very convenient to do so).

> GPU models also should not be given

You don't need the model to fingerprint it. It's performance is probably more than enough.

you can get both primitives values+settings in addition to entropy similar to canvas fingerprint using shaders which will render slightly different across different devices.

thats like saying programs should go away if its not implementable by the OS. its just a different layer. browser plugins are tremendously useful

edit: also your comment seems to imply that plugins are used for websites trying to do something the browser doesnt support (ex flash) -- while this is sometimes done, most plugins add additional functionality for the user, ex adblockers, usability improvements, etc

Plugins and extensions are different things.

The `navigator.plugins` used for fingerprinting is just for NPAPI/PPAPI stuff like Flash, Java, Silverlight. Just about all browsers are also in the process of deprecating support for them.

(it can also be possible to fingerprint browser extensions, but that is a bit trickier as it's not served up directly by the browser as a handy array)

oh yes my bad, thanks. i was thinking extensions (maybe thanks to all the ff news!). wrt fingerpritning plugins, it seems to be the least of the issues and hopefully not an issue for long :)