Eh. If you're enabling JS because you think it's going to help you blend into the crowd, I am skeptical that you understand how powerful JS fingerprinting actually is, particularly around cache abuse and super-cookies.

You don't need to go all the way, but the very least I would advise turning on the resist-fingerprinting config in Firefox. At a minimum, block things like canvas/webGL. You're making yourself more identifiable by doing so, but the alternative is worse.

Now, if you're not using a VPN, and you're in a rural area, and you're on Linux/Firefox with Javascript disabled -- sure, I definitely buy that I could do some pretty decent correlation with that info. That's why VPNs (for all their flaws) still matter.

Sure, I do understand that, and yes IP hiding does matter. I'm merely pointing out that disabling Javascript (and eventually enabling some set unique to you, to un-break a broken site) is just another way to leak some bits one might want to be aware of. Faking the common fingerprinting vectors known to expose you uniquely is possibly a better way... until the new ones are found. I don't know. The leaking bits need to be carefully accounted for, and you don't know the site userbase for sure to blend into the largest cluster possible. I don't think that fingerprinting is something that can be fought by the end user efficiently, besides the very obvious things like blocking the major vectors.

That's a good point.

> Faking the common fingerprinting vectors known to expose you uniquely is possibly a better way...

I wish there was more research being done around this. I appreciate what Firefox is doing, and I assume there are good reasons for their fingerprinting strategies. They know more than me about this stuff. But... it still sets off some alarm bells in my head. It seems like it would be strictly better to spoof location/canvas/microphone data instead of only blocking it.

Yes and no.

Disabling javascript is like wearing a ski mask in a crowded mall.

It makes you much more obvious and easier to track, but harder to identify on the outset.

Are there really so few of us? It feels like there should be millions of us: https://addons.mozilla.org/en-GB/firefox/addon/noscript/

modern "web apps" written purely in tens of MB of javascript complicate it a bit

But who wants to put in the effort to develop tracking for non-JS users? In reality, most will just ignore the few users that don't want to be tracked. Even ublock origin should be enough for most.

However, IP is certainly used. I know of a few cases where IP is at least used as a filter. Most websites won't see that many users from one IP address.