I understand: Javascript is not safe. I know that. But most of the internet, except for onions, use javascript and it’s nearly impossible to use most of the Internet in web browsers without it. The problem is that if Fingerprint.com can reliable detect differences between users when javascript is on for Mullvad Browser and Tor Browser in certain operating systems, users should be aware. Most people would think Mullvad Browser in “safer” mode would not create a persistent per-computer hash of the browser that can be tracked across sessions.

Other users on privacyguides forums have commented on the exact same problem where threads are just completely deleted, even with valid questions.

Then this may be happening only with certain distributions or operating systems. It is definitely happening for me, I checked it over and over. “You have visited once.” I close Tor Browser, restart, come back to fingerprint.com. “You have visited twice.” I also did try this with safer. I did multiple tests. This impacts at least some operating systems or distributions. It may not impact Qubes. I didn’t test that, but I am sure it impacts at least some users.

All users don’t have the same fingerprint. Fingerprint.com is testing other things that Tor isn’t covering. So if they are testing canvas and other stuff that Tor protects, and 2 things that aren’t protected that give unique identifiers, they still create a unique hash. I did not test this using Tails or Qubes and it may not affect all operating systems.

They have different unique hashes per computer, so Tor Browser user on “Computer 1” has a unique hash and Tor Browser user on Computer 2 has a unique hash. I have read Mullvad’s documentation on their browser. Please re-read the original post.

They have different fingerprints PER COMPUTER without any plugins other than default of No Script. I tested this, it is not the same hash for every computer. It varies per computer and was persistent across sessions.

fucking hilarious! I needed to laugh. Thanks @cm0002@infosec.pub this made my day

that’s a brutal hack. so they hacked the hosting update server, made it monitor incoming IPs, and then selectively uploaded a compromised backdoor update based on IP only to certain computers so it would go undetected longer?

it’s awful, but technically impressive that someone could remotely hack the server like that and set up such a complex system to target IPs… unless it was a state actor that compelled the server company to provide local access, in which case it’s less impressive.

Most of the public’s awareness of technology is so naive as to basically stick their heads in the sand because they want the convenience and ease and are willing to overlook evil. So they don’t care about supply chain evils, corruption that is embedded into the system, so they can scroll TikTok and watch netflix on their offtime, while using Klarma to pay the groceries. Real organization against organizers in which people aren’t being data mined would require some technological awareness. The masses just don’t have it.

They join political groups on Facebook then get data mined and classified into oblivion until a computer can process their views and give them a discounted ad-supported Netflix so they are less politically upset.

This is our world.

This information goes right to the US government.

Anyone who doesn’t think Facebook is an arm of the US government is naive at best.

top part of monitor: “genuine” windows qube in HVM -->sys-residentialproxy —> sys-vpn ----> sys-net

bottom part of monitor: tor browser chatting w/ ai ----->sys-whonix--------------> sys-vpn ----> sys-net

but it’s easier said than done, and more than that, it’s fucking infuriating having to do any of this shit.

i fucked up an interview because it took me an extra 30 minutes to find out chromium wouldn’t work, firefox wouldn’t work, and only plain vanilla chrome would work. you’re not the only one who has been fucked by this. the interview platform demanded chrome but won’t tell you; you have to trial and error find out. corporations want grateful docile slaves. it’s time consuming to figure out what normie bullshit each asshole corp wants.

it’s really fucked. when i use privacy preserving techniques, often company anti-fraud systems flag me as “fraud.” but if i actually use “white hat” tactics that “ethical pen testers” use, suddenly i’m allowed to have privacy and use my own system and they think i’m a normie.

sometimes i don’t even care any more and use systems that obviously seem like fraud, because it’s just me and not fraud and i hate them, and then if they think it’s fraud who gives a fuck. if they flag me as fraud, i’ll go with another company. none of their shit stops anyone good and these anti-privacy companies get a false sense of security from all the “amazing” cloudflare blocking and anti-fraud protection… they are getting charged blocking real users and then one day someone brutal and sophisticated comes, someone not like me who doesn’t know shit, and just destroys their servers.