%---------------------------------------------------------------
\chapter{Browser Approaches to Fingerprinting Defences}
%---------------------------------------------------------------
\label{chap:browser_approaches}

As concerns about user privacy continue to escalate, the issue of browser fingerprinting has attracted significant attention. 
In response, leading browser developers have implemented a variety of defensive measures in their software. 
These measures are designed to diminish the distinctiveness of individual users' browsing environments, thereby undermining the reliability of fingerprinting techniques. 
This chapter presents a comprehensive exploration of the strategies used to protect against fingerprints in prominent browsers including Google Chrome, Mozilla Firefox, Apple Safari, Brave, and the Tor browser. 
Each of these browsers implements its own set of measures ranging from subtle alterations in their API implementations to more assertive anti-fingerprinting measures demonstrating their diverse priorities and philosophical approaches to ensuring user privacy.

\section{Google Chrome}
Google's flagship web browsing tool, Google Chrome, represents the world's leading Internet browser in terms of user numbers. 
Constructed upon the foundational Chromium Engine, it is acclaimed for its rapid performance, wide repository of extensions, and robust compatibility with the most recent Web standards. 
Google Chrome's availability spans across all significant operating platforms, and it features seamless integration with a wide range of Google services, enhancing user experience.

As of April 2025, Google Chrome lacks specific anti-fingerprinting features, which increases its vulnerability to fingerprint-based tracking~\cite{chrome_sec}. 
However, Google is working on the Privacy Sandbox, a privacy-centric initiative designed to reduce the dependence on third-party tracking~\cite{google_sandbox}. 
In~addition to~eliminating third-party cookies, certain proposals, such as restricting passive fingerprinting surfaces, could help decrease fingerprinting in the future.

It is crucial to note that Google Chrome, the most widely used web browser worldwide, provides a wide range of extensions that enhance its security features. 
These extensions augment the browser's protective capabilities beyond its native functionalities. 
However, it is imperative for users to note that these enhancements are developed by external third-party developers. 
Consequently, this reliance introduces the potential for additional security vulnerabilities, as~these developers may not always adhere to~the~same stringent standards as~the~primary developers of~the~browser itself.

\section{Mozilla Firefox}
\label{chap:firefox}

The Mozilla Foundation, in partnership with its division, Mozilla Corporation, developed Mozilla Firefox, an open source and cost-free Internet browser~\cite{firefox_www}. 
First introduced to the public in 2004, Firefox was designed with the primary goal of providing a faster and more privacy-orientated experience compared to its contemporaries, initially Internet Explorer and subsequently Google Chrome. 
This browser employs the Gecko rendering engine for the purpose of web page visualisation and is accessible on multiple operating systems, including Windows, macOS, Linux, and mobile platforms.
It is essential to note that Firefox often incorporates numerous security features that were initially implemented in the Tor Browser. 
This is largely due to the significant collaboration between the development teams of both browsers, which facilitates the~exchange and~integration of~security advancements.

Mozilla Firefox employs a sophisticated multiprocess architecture designed to separate the handling of web content from the essential functions \linebreak of~the~browser itself~\cite{firefox_architecture}. 
This architectural strategy improves performance and stability by~partitioning resources in~a~manner that minimises interference between web tasks and browser operations.
There are three levels of~processes.
The~parent process manages the core of the browser, including the user interface, permissions, and tabs.
Each individual website subsequently operates within its dedicated content process, thereby ensuring the isolation of~its memory as~well as resources.
The functional aspects of graphic rendering, networking, and~media decoding are managed by a dedicated utility process, which efficiently coordinates and executes these tasks.

Mozilla Firefox user protection system is called Enhanced Tracking Protection (ETP)~\cite{firefox_etp}.
Its main purpose is to block or limit third-party tracking.
It offers 3 different settings: standard, strict and custom.
The standard is used by default.
ETP implements a variety of strategies to protect user privacy.
ETP effectively blocks recognised third-party trackers according to a comprehensive list provided by Disconnect~\cite{disconnect}.
The aforementioned list encompasses a~range of~tracking mechanisms, such as social media trackers, cross-site tracking cookies, fingerprinters, cryptominers, and embedded tracking content within advertisements, videos, and other page elements.
ETP encompasses a~feature known as \textit{Total Cookie Protection}, which ensures that each cookie is restricted to the domain from which it originated. 
This restriction prohibits cookies from being used to monitor users' activities as they navigate between multiple websites.

Anti-fingerprint protection mainly uses unification, but also uses randomisation as a source of uniqueness.
At first, Firefox blocks all fingerprinting scripts from sites listed in the Disconnect list. 
It can also block scripts that are suspicious for fingerprinting.
This process is active during private browsing or when the string setting is turned on.

The unification of some return values is already implemented in the Gecko engine as it is shared with the Tor Browser~\cite{gecko_unification}.
The user-agent contains constant values that depend on the user's OS.
The timezone is always set to~UTC+0 and~the~date format is US~style.
The preferred colour scheme is always set to light and the hardware concurrency to 2.
To mitigate the potential for data leakage via the list of plugins, Firefox imposes restrictions on~the~identification of~plugins through JavaScript. 
Importantly, these limitations do not compromise the operational capabilities of scripts that remain hidden.

To mitigate Canvas and WebGL fingerprinting, Mozilla Firefox uses noise injection~\cite{gecko_unification} only when the setting is set to strict or during private browsing.
The noise is injected into the background of the image when it is being read by the website and is applied to each colour channel of the pixel.
The entire procedure can be explained as follows~\cite{firefox_canvas_randomisation}.
Initially, a function is invoked that attempts to extract image data from either the canvas element or the WebGL API, depending on the context. 
Subsequently, a verification step is performed to verify whether the current fingerprint protection settings are configured to~a~strict level. 
Following this, the image data are accessed, by~which a~specific randomisation function is executed~\cite{firefox_webgl_randomisation}. 
Within the scope of this function, a cryptographic function is used to obtain a random number from -3 to 3.
The cryptographic function uses a seed based on a session id, coordinates of the pixel, original RGBA values and its neighbours.
Consequently, each individual pixel channel is modified by applying a distinctive offset, ensuring the randomisation of the image data.
The difference between the original image data and the modified image data should be less than 0.02\%.
It is important to mention that this process includes heuristic behaviour that can stop the~randomisation.

Among the initial security measures implemented within the Tor network, letterboxing stands out as a significant component~\cite{firefox_letterboxing}. 
This mechanism involves deliberate alterations to the resolution of the browser window. 
Although Firefox offers support for letterboxing, users must manually activate this feature to take advantage of its benefits.
The procedure involves adjusting the screen dimensions such that the width is modified to the closest multiple of~200~pixels, while the height is altered to~align with the nearest multiple of~100~pixels.
Any extra space resulting from this process is filled with grey and~is called a~letterbox effect.
Another security measure adapted from the~Tor browser is standardisation of available fonts or removal of the Battery API.

Mozilla Firefox lacks any mechanisms to protect against fingerprinting via~the~Audio~API~\cite{firefox_audio}. 
The~Mozilla developer team states that the additional entropy obtainable from fingerprinting through the Audio API is insufficiently significant, thus reducing the urgency and priority for either altering or eliminating this particular API.

Mozilla Firefox provides a comprehensively structured and multilayered security system for its users. 
Its Enhanced Tracking Protection employs a~blacklist strategy to~effectively obstruct most commercially utilised tracking devices. 
By standardising various semi-identifying data, user fingerprints become homogenised, allowing them to blend into larger cohorts. 
For users seeking additional privacy measures, randomisation can be applied as an additional layer of~defence. 
This browser is frequently regarded as one of the most secure options among the top three globally popular web browsers.


\section{Apple Safari}
\label{chap:safari}

Apple’s standard web browser, Safari, is pre-installed on both macOS and~iOS devices~\cite{safari_www}. 
It is renowned for its flawless integration within the Apple ecosystem, including devices such as iPhones, iPads, and Mac computers. \linebreak 
Apple~Safari stands out due to its enhanced performance and remarkable energy efficiency, making it particularly optimised for~Apple hardware. 
The~browser is specifically designed to provide users with a fast and fluid browsing experience, ensuring seamless operation and connectivity across all compatible Apple devices. 
This high level of performance consistency is a key feature, especially advantageous for those who are deeply embedded in the Apple user environment.

Apple Safari implements a comprehensive, multilayered approach designed to protect users from browser fingerprinting~\cite{safari_paper}. 
This strategy primarily seeks to complicate the process for websites and advertisers attempting to~uniquely identify and track individual devices, thereby offering enhanced protection to users.
Apple Safari employs both unification and randomisation methodologies, though both are applied in distinct contexts.
Unification is a technique used to establish what is termed \textit{herd immunity}, a concept that represents the inclusion of the user in a larger group, or cohort, of individuals whose fingerprinting data exhibit common characteristics. In contrast, randomisation is a method applied within private browsing windows to ensure that the user's fingerprint remains entirely distinct, thereby allowing the user to noticeably differentiate themselves from others.

Apple Safari incorporates the so-called Intelligent Tracking Protection (ITP), which is a sophisticated on-device machine learning model that protects its users from cross-site tracking without breaking web functionality.
ITP effectively prevents third-party cookies and tracking mechanisms from collecting data regarding your activities and interactions on the Internet.
Permissions are not granted by default. 
In the case of Apple Safari, user consent is invariably requested whenever a website seeks to access resources such~as the~microphone or~webcam.
Apple Safari includes an enhanced feature known as~Advanced Fingerprinting Protection, which is specifically designed to address and combat a~variety of fingerprinting techniques and the associated issues that arise~\cite{wilander_private_2024}.

According to Apple's developer guidelines, various categories of fingerprints can be identified as follows:
\begin{itemize}
    \item \textbf{Device fingerprint} -- fingerprint based on device characteristics such as hardware, OS, browser
    \item \textbf{Network and geographic position fingerprint} -- fingerprint based on how the device connects to the Internet and determines the user's location by any means
    \item \textbf{User settings fingerprint} -- fingerprint based on the browser's settings such as dark mode and window size
    \item \textbf{User behaviour fingerprint} -- fingerprint based on repetitive patterns in the user's behaviour
    \item \textbf{User traits fingerprint} -- fingerprint based on the user's age, interests, etc.
\end{itemize}


Advanced Fingerprinting Protection focuses on three main problems.
Apple Safari tries to block cross-site tracking.
This is also done by ITP by collecting resource loads and matching them with known patterns of cross-site tracking~\cite{webkit_anti_fp}.
In the event that the domain corresponds to~at~least one of~the~given patterns, it is classified as~possessing the~capability for~cross-site tracking.
The~biggest challenge is to make the user unique when visiting a specific website.
As an example, webkit developers list languages such as US/EN, which can help build herd immunity on English websites.
However, having such a setting can put the user in a very small cohort when visiting foreign websites.
Another less known problem is per-site user recall.
Essentially, the~website possesses the capability to recognize users even after they have deleted stored website data or when browsing in incognito mode.

To address these problems, Apple has found two main solutions:
\begin{enumerate}
    \item Make the fingerprint be shared among many users, the so-called herd immunity.
    \item Make the fingerprint unique per website and generate a new unique fingerprint for every fresh start.
\end{enumerate}

The unification strategy is used to ensure that each user's device resembles other devices operated by Apple Safari users as closely as possible. 
By~delivering a homogenised and standardised system setup to websites, Apple Safari significantly decreases the distinctiveness of each device's fingerprint~\cite{safari_paper}. 
This approach results in a \textit{herd immunity} effect, whereby individual users are indistinguishable within a large group, complicating the~efforts of~trackers in~identifying any particular device.
In particular, the Apple Safari web browser restricts websites from using fonts that users have added to their devices, offering only the set of default fonts of the device as available options~\cite{webkit_anti_fp}.
The~user-agent is altered in such a manner that it remains consistent and unchanged with minor updates to the software.
Another instance of~standardisation that occurred involved the removal of certain vectors that can be fingerprinted, such~as the~DNT header or plug-ins.
The developers \linebreak of~Apple~Safari have decided not to implement certain APIs in case they do not offer a~safe way to protect its users~\cite{webkit_anti_fp}.
A full list of APIs not implemented since the development of~Webkit in~2005:
\begin{itemize}
    \item Web Bluetooth
    \item Web MIDI API
    \item Magnetometer API
    \item Web NFC API
    \item Device Memory API
    \item Network Information API
    \item Battery Status API
    \item Web Bluetooth Scanning
    \item Ambient Light Sensor
    \item HDCP Policy Check extension for EME
    \item Proximity Sensor
    \item WebHID
    \item Serial API
    \item Web USB
    \item Geolocation Sensor (background geolocation)
    \item User Idle Detection
\end{itemize}
This list has grown in size since that date.
Initially, the Screen API provided random values, but it has since been adjusted to consistently return standardised values.
Apple has refused to integrate Google's Topics API into Apple Safari, as it causes fingerprinting problems mentioned in a recent study by Yohan Beugin and Patrick McDaniel from the University of Wisconsin-Madison~\cite{beugin2024publicreproducibleassessmenttopics}.

Apple Safari uses random noise injection to modify the outputs of specific web APIs, which are frequently targeted for browser fingerprinting.
However, this is performed exclusively within the limits of a private browsing session.
The purpose of this is to maintain herd immunity while acting unique.
This randomisation was introduced in Apple Safari 17 and includes Audio API, Canvas and WebGL API.
The audio API can serve as a great example.
An~audio produced using the Audio API consists of a sequence of samples, each represented by a numerical value indicating the amplitude of the audio signal.
Noise is applied uniformly to every audio sample and is different for each \texttt{audioBuffer}.
The Listing \ref{lst:safari_audio_randomisation} shows the current code implementation~\cite{webkit_aply_noise}.
\begin{figure}[H]
\centering
\footnotesize
\begin{lstlisting}[caption={Apple Safari randomisation of Audio API}, captionpos=b, label={lst:safari_audio_randomisation}]
void applyNoise(float* values, 
                size_t numberOfElementsToProcess, 
                float magnitude)
{
    WeakRandom generator;
    for (size_t i = 0; i < numberOfElementsToProcess; ++i)
        values[i] *= 1+magnitude*(2*generator.get()-1);
}
\end{lstlisting}
\end{figure}
The fingerprint is recalculated every time in a private mode which makes this fingerprint useless.

According to a FingerprintJS investigation on the M1 MacBook Air the fingerprint fluctuated between 124.03516 and 124.04545 with the difference range only being 0.008\%~\cite{fp_js_bypass_safari}.
FingerprintJS has identified a method to bypass this security measure by collecting numerous audio samples from a single browser instance, in which the only variation among these samples is the noise.
This has been done by creating an \texttt{AudioBufferSourceNode} loop that has multiple samples of the same audio with a different noise applied.
While it does not entirely eliminate the noise, it significantly diminishes its intensity.
When the number of samples reaches approximately 250,000, a process that requires roughly 8 milliseconds, their algorithm reaches peak accuracy and can successfully generate a distinct browser fingerprint.
However, this test was performed on the M1 MacBook Air and would take much longer on low-end devices.
They had to create an optimised version of the algorithm that selects a lower number of samples and rounds the results.
According to the research, only five significant digits are needed to tell the browsers apart, and seven significant digits are needed to have a stable fingerprint.

The \texttt{CanvasNoiseInjection} class is responsible for~the~randomisation \linebreak of~canvas~\cite{webkit_canvas_api}.
The injected noise is generated by employing a hash function that takes into account both the source and the initial colour value of~the pixel and is applied to each colour channel of every pixel~\cite{safari_canvas_bypass}.
This class carefully monitors designated ``dirty''
 sectors of the canvas that have undergone modifications and subjects them to a process that integrates minute noise variations into the pixel data. 
During this operation, for every individual pixel located within these modified regions, the algorithm conducts a~thorough analysis of~the adjacent pixels. 
This examination is crucial in determining the most precise and restrictive colour boundaries possible, which guarantees that the noise introduced complies to limits that preserve a natural appearance.
The~random nature of this modification ensures variability in~pixel readings, which effectively counters the practice of canvas fingerprinting while simultaneously maintaining the integrity of the visual appearance to~the~user.
However, according to new research, this security mechanism can be bypassed by manipulating the noise adjustment of its neighbours~\cite{safari_canvas_bypass}.
This can be done by scaling the canvas, allowing the attacker to recover the original canvas.
The~primary weakness arises from the scenario in which adjacent pixels share an~identical colour, resulting in a clamping range that is restricted to~this singular colour~\cite{safari_canvas_bypass}. 
Consequently, this condition renders the generated noise both deterministic and predictable.

Apple Safari protects its users from language preference base fingerprinting by always reporting only the most preferred language.
To protect against font-based fingerprinting, Apple Safari reports only the set of OS native fonts.

Overall, Apple Safari provides extensive safeguards against multiple forms of browser fingerprinting and integrates additional layers of security as required for enhanced protection.

\section{Brave Browser}
\label{chap:brave}

Brave is an open-source web browser dedicated to privacy, built on~the~Chromium engine yet significantly modified to enhance user privacy and security. \linebreak
The~browser's fundamental principle is to safeguard users as a default setting, significantly reducing online tracking and data collection. 
Brave is distinguished by an elegant user interface, built-in ad-blocking capabilities, and the integration of~crypto-based incentives facilitated by its Basic Attention Token (BAT) system. 
Its primary objective is to provide users with a quick and uninterrupted browsing experience free of unnecessary distractions.
Chromium source code is fetched during the build process.
The Brave code from the brave-code repository that contains all the modifications and features that make the Brave browser.
Then, the chromium is patched with the brave-core code.
Brave has used some sort of randomisation since its beginnings. 
However, in 2020, it went through a major update called fingerprinting 2.0 that focused mainly on~fingerprinting and has not changed much since.
Brave Shields offers two levels: \textit{Classic} and \textit{Strict}, with \textit{Classic} being the default setting, while \textit{Strict} blocks more elements but may break site functionality.
The \textit{Classic} configuration is a balance between privacy and web compatibility. 
Its main purpose is to protect users from tracking. 
However, it should not break the web functionality.
The \textit{Strict} configuration includes additional layers of obfuscation.
The maximum privacy provided can lead to a poorer user experience.
Before version 1.64, Brave used to have a \textit{Classic} and \textit{Strict} settings for fingerprint protection.
Nevertheless, due to its infrequent usage and the disruption it caused to web functionalities, the \textit{Strict} settings has been phased out, leaving only the \textit{Classic} version available for ongoing use.
This change occurred during the~course of this thesis. 
Importantly, this modification was implemented after the data collection phase. 
Consequently, this thesis covers analyses related to~both \textit{Classic} and \textit{Strict} configurations.

Brave offers several layers of user security mechanisms that are not focused solely on fingerprinting.
Its top-level security mechanism is called Brave Shields.
Brave shields consist of security mechanisms focused on fingerprinting, ad blocking, cross-site tracking, cookies, etc.
The user can view and adjust what is being blocked on each website.
Brave also introduces several enhancements for Chromium that help in strengthening user security.
Brave forces websites to use an HTTPS connection and does not allow any unsecured one, reduces server calls to reduce data exposure.
It also blocks third-party ads and trackers, detects problematic scripts and replaces them with secure ones, controls cookies, and provides temporary ephemeral storage, which helps limiting tracking.
All Brave Shields settings are customisable globally or site-specifically.

To fight fingerprinting, the Brave browser uses both randomisation and unification.
However, Brave's aim is to make each browser's fingerprint as unique as possible through something called ``farbling''~\cite{brave_fingerprinting_2020}.
Farbling stands for~slightly randomising semi-identifying browser features.
The Farbling technique employs deterministic randomisation that is based on \linebreak a per-session eTLD+1 seed. 
This approach guarantees that a website will generate a consistent fingerprint for a single session, while producing a different fingerprint upon each subsequent visit to the site.
Certain services and features are completely deactivated, a condition that can be categorised as standardised, while others generate consistent, unified results. 
The entirety of this service includes 43 individual services, inclusive of the comprehensive suite found within Google's Privacy Sandbox.
Developers at Brave have expressed significant concerns about the Privacy Sandbox initiative, as it primarily serves to enhance the~already inadequate security mechanisms of Google Chrome to a minimal extent, without offering benefits to other security-focused browsers~\cite{brave_privacy_concerns}. 
In~fact, it could potentially compromise certain security features of these alternative browsers that prioritise user privacy and security. 
Moreover, there is an apprehension surrounding the Topics API, which is perceived to exacerbate the centralisation and monopoly of Google's advertising ecosystem, further consolidating its dominant position in the digital advertisement sector.

Brave focuses significantly on combating the practice of Canvas fingerprinting, a method that uses minor variations in the rendering of canvas elements to~create a~distinct identifier for each user~\cite{brave_fp_canvas}. 
As a countermeasure, Brave has deployed a defence mechanism that relies on farbling, modifying the resulting output from the canvas element in a manner that diminishes its effectiveness and dependability for the purpose of user tracking.
In~Figure~\ref{fig:brave_webgl}, a~comparison is provided between the WebGL canvas fingerprints obtained from the~Google~Chrome and Brave browsers, both of which were generated using the~identical device configuration and produce different fingerprints.
\begin{figure}[h]
    \centering
    \begin{tikzpicture}[baseline]
        \node at (0, 1) {\includegraphics[width=0.2\linewidth]{figures/webgl_chrome.jpg}};
        \node at (7, 1) {\includegraphics[width=0.2\linewidth]{figures/webgl_brave.jpg}};
        \node at (0, -1) {(a) Google Chrome};
        \node at (7, -1) {(b) Brave};
    \end{tikzpicture}
    
    \caption[Illustration of farbling of WebGL canvas fingerprint]{Illustration of farbling of WebGL canvas fingerprint (own work)}
    \label{fig:brave_webgl}
\end{figure}
Randomisation occurs when one of these four functions is used:
\begin{itemize}
    \item \texttt{CanvasRenderingContext2D.getImageData}
    \item \texttt{HTMLCanvasElement.toDataURL}
    \item \texttt{HTMLCanvasElement.toBlob}
    \item \texttt{OffscreenCanvas.convertToBlob}
\end{itemize}
The default configuration farbles the output using the eTLD+1 seed combined with the canvas contents.
This technique involves the random alteration of specific lower-order bits within the data of the canvas. 
These modifications are subtle enough to remain undetectable to the human visual system, ensuring that the overall appearance of the image is not noticeably altered.
During \textit{Strict} settings, the browser generates pseudorandom canvas data that rely solely on the eTLD+1 session seed.
By default, Brave alters the WebGL2 parameters to reduce the risk of fingerprinting~\cite{brave_fp_webgl2}.
However, brave does not change the behaviour of some functions of the WebGL API~\cite{brave_fp_webgl}.
During \textit{Strict} settings, the browser completely blocks some parameters and returns neutral values to prevent data leakage and reduce the possibility of use for fingerprinting.
This completely eliminates all possibilities of using canvas HTML element for fingerprinting.

Brave also randomises the names of the media devices that are accessible via \texttt{MediaDevices.enumerateDevices}~\cite{brave_fp_devices}.
The behaviour during default settings depends on whether the user has given access to any media device.
If the user has given access, then no randomisation occurs.
If no access was granted, the eTLD+1 session seed is used to randomise a 4 character long string that is appended after the device kind.
So the label of each device looks like this \texttt{\{mediakind\} - [0-9a-zA-Z]\{4\}}.

Despite the reduced frequency of usage for browser plugins \linebreak in contemporary times, it is noteworthy that the utility \texttt{navigator.plugins} \linebreak and~\texttt{navigator.mimeTypes} remain operative and can still be used to reveal the~presence of such plugins~\cite{brave_fp_plugins}.
By~default, old versions of Brave returned only an array of 2 plugins: \texttt{Chrome PDF Plugin} and \texttt{Chrome PDF Viewer} and~its variations.
These variations are created by substituting each word from the substitution table listed in Table~\ref{tab:brave_plugins_subs}.
\begin{table}[H]
\centering
\caption[Brave plugins substitution table]{Brave plugins substitution table \cite{brave_fp_plugins}}
\begin{tabular}{|>{\raggedright\arraybackslash}p{0.25\textwidth}|>{\raggedright\arraybackslash}p{0.70\textwidth}|}
\hline
\textbf{Word} & \textbf{Array} \\
\hline
Chrome & Chrome, Chromium, Brave, Web, Browser, (empty string), OpenSource, Online, JavaScript \\
\hline
PDF & PDF, Portable Document Format, portable-document-format, document, doc, PDF and PS, com.adobe.pdf \\
\hline
Plugin & Viewer, Renderer, Display, Plugin, plug-in, plug in, extension, (empty string) \\
\hline
Viewer & Viewer, Renderer, Display, Plugin, plug-in, plug in, extension, (empty string) \\
\hline
\end{tabular}
\label{tab:brave_plugins_subs}
\end{table}

Since the Fingerprint 2.0 update, Brave has introduced an algorithm to~generate \texttt{random plugins}.
The~\texttt{random plugins} consists of~5~parts:
\begin{itemize}
    \item \textbf{Description} -- 3 words taken from a \texttt{spellcheck\_hunspell\_dictionary.h} from the chromium repository 
    \item \textbf{Filename} -- 32 random characters from a-z 
    \item \textbf{Name} -- 3 words taken from a \texttt{spellcheck\_hunspell\_dictionary.h} from the chromium repository 
    \item \textbf{Length} -- 0 
    \item \textbf{namedItem()} -- always null()
\end{itemize}

Since the Fingerprinting 2.0 update, Brave returns an array of 4 plugins, 2 of them have a~name created via the substitution table and use have a~filename and~description randomised with using the eTLD+1 seed.
The other two plugins are \texttt{random plugins} and are created by the algorithm explained above.
The order of the plugins is then randomly ordered.
Within the context of~a~\textit{Strict} configuration setup, only a~set of two \texttt{random plugins} is generated, and~no other details or information regarding additional plugins are disclosed.

The Audio API fingerprint protection is done by slightly altering the output volume~\cite{brave_fp_audio}.
By default, the output volume modifier is based on the~random choice of the [0, -0.01] interval and is then multiplied by eTLD + 1 seed.
With \textit{Strict} settings on, the volume is unchanged, and low-amplitude white noise is generated based on the eTLD+1 session seed.
However, this method has also been broken by FingerprintJS by~discovering the~multiplier factor and dividing the sample data~\cite{fp_audio}.
Because the multiplier factor is a~floating point number, the division operation performed in the calculation introduces imprecision. 
Consequently, this results in final fingerprints that are not precisely identical.
Subsequently, the results are evaluated in conjunction with the fingerprints collected previously through the application of a fuzzy algorithm. 
If~the~difference falls below the threshold of~0.0000022\%, FingerprintJS posits that the~device in question is identical.

Brave also protects its users from being fingerprinted based on their language preference~\cite{brave_fp_lang_font}.
Brave automatically reports only the most preferred language with a randomised weight.
During \textit{Strict} settings, Brave will always report English as the preferred language.

Font-based fingerprinting is mitigated by reducing the number of fonts displayed~\cite{brave_fp_lang_font}.
All OS fonts are displayed in random order.
In addition, a~random set of user-installed fonts is reported in random order.
The eTLD+1 session seed is used for both randomisations.

The battery API returns standardised values \cite{brave_fp_battery}.
The Brave browser returns values so that the battery looks as if it is charging as seen in Listing~\ref{lst:brave_battery_randomisation}.
\begin{figure}[H]
\centering
\footnotesize
\begin{lstlisting}[
  caption={Brave browser randomisation of Battery API},
  captionpos=b,
  label={lst:brave_battery_randomisation}
]
bool BatteryManager::charging() => true;
double BatteryManager::chargingTime() => 0;
double BatteryManager::dischargingTime() => infinity();
double BatteryManager::level() => 1.0;
\end{lstlisting}
\end{figure}


An additional altered piece of data is the user-agent string, which consistently returns a predetermined value specific to each operating system~\cite{brave_fp_useragent}.
However, the Client Hints API has not undergone any alterations~\cite{brave_fp_clienthints}.
Note that the API does not reveal any data except the browser name that cannot be obtained from alternative sources.

Overall, Brave offers a multilayered security measure that heavily reduces fingerprintability of user's device.
Although Brave is a typical example of~using randomisation as the main methodology, it also uses unification to block certain data points.
Brave is continually updating its security protocols with the~primary objective of enhancing maximum protection for its users. \linebreak
As~of~April, 2025, the~development of Fingerprinting 3.0 is already underway, with its features beginning to be integrated into existing versions. 
Despite these advancements, official documentation has yet to be released.
Consequently, this thesis does not address or reference these alterations or modifications in its entirety.

%https://brave.com/privacy-updates/3-fingerprint-randomization/ - DONE
%https://brave.com/privacy-updates/4-fingerprinting-defenses-2.0/ - DONE
%https://brave.com/privacy-updates/17-language-fingerprinting/ - DONE
%https://brave.com/privacy-updates/28-sunsetting-strict-fingerprinting-mode/ - DONE
%https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections - DONE
%https://github.com/brave/brave-core/blob/1cb5818aa0b70666c6aeea5ea9c06cc4e712171a/chromium_src/third_party/blink/renderer/modules/battery/battery_manager.cc - DONE
%https://fingerprint.com/blog/brave-browser-privacy-security-guide/ - DONE
%https://fingerprint.com/blog/browser-anti-fingerprinting-techniques/ - DONE

% POUZIT MEGA DOBRE - DONE
% https://fingerprint.com/blog/browser-anti-fingerprinting-techniques/
% https://github.com/brave/brave-core/blob/920bba00b6efb79aa6a1844c2dcca41eee066442/patches/third_party-blink-renderer-core-html-canvas-html_canvas_element.cc.patch
% https://github.com/brave/brave-core/blob/4c20d3c54a0e474f2d7a71d6843816744d957baa/chromium_src/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc

% https://fingerprint.com/blog/audio-fingerprinting/#brave
% Sepsat jak sly zmeny nastaveni, C&A, blokovani/randomizace

\section{Tor Browser}
\label{chap:tor}

Tor Browser is an open source web browser, created to offer users anonymity and privacy during their Internet activities~\cite{tor_www}. 
Engineered by the Tor Project, this browser is an adaptation of Mozilla Firefox and is seamlessly integrated into the Tor network. 
The system routes Internet traffic by transmitting it through a series of nodes to mask both the users' identities and their geographical locations.
Although this rerouting process can result in~slower browsing speeds compared to standard web browsers, it remains a widely favoured option among individuals who prioritise maintaining anonymity and~safeguarding against censorship.

The Tor Browser provides a range of security features which might occasionally disrupt the normal operation of certain websites. 
Nevertheless, its user base predominantly tends towards it for its robust security capabilities, and thus, they are generally mindful of and accepting of these potential functional interruptions.
The use of onion routing protects the user's IP address from being fingerprinted as it hides behind multiple nodes~\cite{tor_onion_router}.
In every communication session, a distinct encryption key is used, ensuring perfect forward secrecy. 
This means that even if a private key from one session is compromised, past communications remain secure because they were encrypted with entirely different keys.
Tor Browser enhances Mozilla Firefox by integrating various extensions, including NoScript~\cite{tor_noscript}.
This extension is one of the core security components of this browser.
It controls the execution of JavaScript scripts execution.
A notable feature of Tor Browser is its ability to access \texttt{.onion} websites, which are not reachable via standard web browsers due to their unique domain designation and the Tor network's specific privacy architecture.
Tor employs a containerisation strategy for its sessions that mirrors the approach used by Mozilla Firefox. 
This methodology is implemented to inhibit cross-site tracking, thereby enhancing user privacy by isolating sessions and preventing websites from accessing tracking information across different web activities.
By default, Tor blocks third-party tracking tools and advertisements. 
This functionality significantly diminishes the likelihood of user behaviour being subject to fingerprinting based on observed actions.
Tor Browser also forces HTTPS communication for all connections.

The methodology employed by the Tor Browser to limit user fingerprinting involves the unification of a broad range of fingerprintable information, effectively ensuring that all individuals utilising the Tor Browser present themselves in a manner that is nearly identical.
Tor Browser has thoroughly disabled or~altered numerous API functions that potentially facilitate user fingerprinting by external entities.
A list of all modified data points can be seen in Table~\ref{tab:tor_api_modifications} according to the Tor Project documentation~\cite{tor_technical_details}.
\begin{table}[h!]
\centering
\caption[List of APIs and their status in Tor Browser]{List of APIs and their status in Tor Browser \cite{tor_technical_details}}
\begin{tabular}{|l|l|}
\hline
\textbf{API Name} & \textbf{Status} \\
\hline
Plugins       & Modified  \\
Canvas API    & Modified  \\
WebGL API     & Modified  \\
GamePad API   & Disabled \\
Fonts         & Modified  \\
Screen size   & Modified  \\
Display Media & Modified  \\
MediaDevices API & Disabled \\
MIME Types & Disabled \\
Web Speech API & Disabled \\
Touch API & Disabled \\
Battery Status API & Disabled \\
System Uptime & Modified \\
Keyboard Layout & Modified \\
User-agent & Modified \\
HTTP Headers & Modified \\
Locale & Modified \\
Timezone & Modified \\
Navigation Timing & Disabled \\
Mozilla Video Statistics API & Disabled \\
Keystroke & Modified \\
hardwareConcurrency & Modified \\
Web Audio API & Modified \\
MediaError & Modified \\
Connection API & Modified \\
Reader View & Modified \\
OS Type & Modified \\
\hline
\end{tabular}
\label{tab:tor_api_modifications}
\end{table}

The design of the user-agent is such that it consistently provides an identical value across all individuals utilising the same CPU architecture. \linebreak
For~an~ARM device, it returns MacOS, for an x86 device, it always returns Windows.
Since the discontinuation of the Flash plugin, all plugins have been completely disabled.
To hide screen resolution, Tor Browser uses a method called letterboxing, which was then included in Mozilla Firefox.
This method is explained in~more detail in~chapter~\ref{chap:firefox}.
Another set of semi-identifiers is standardised: the~timezone is configured to GMT, the language preference is designated as~en-US, and the preferred colour theme is established as light, among other settings.
Font fingerprinting is blocked by returning only a~set of~native fonts for~each OS.

Initially, the Web Audio API was completely disabled, but over time, specific components have been selectively reinstated and modified to ensure their ineffectiveness for fingerprinting purposes~\cite{tor_audio_disable}. 
The development team has implemented a standardisation of floating-point operations, which restricts the~potential exploitability for~fingerprinting techniques~\cite{tor_audio_enable}.
There are currently two possible returns for the returnable values, one for ARM devices and the second one for x86 devices.
This change took place in 2025.

Canvas fingerprinting is resolved by not allowing web sites to read canvas data without the user's permission~\cite{tor_technical_details}.
Every time a website tries to~read the~canvas data, a notification is displayed asking the user to allow such an action.
Tor also standardises several canvas-related properties to reduce the~possibility of fingerprinting.
The WebGL API has not been completely disabled. 
Instead, its functionalities have been subject to significant limitations. 
As~a~result, only a minimal and standardised subset of its features is accessible.
In~April~2025, Tor has experimented with randomising the~Canvas API values to~reduce the risk of~fingerprinting and also enable this API~\cite{tor_canvas_randomisation}.
However, several users have reported that this patch has broken the rendering of QR codes.
This feature is still only experimental and is not yet distributed to the public.



%https://2019.www.torproject.org/projects/torbrowser/design/