What your browser reveals, in plain sight

Anti-fingerprinting is not about hiding your attributes — it is about being identical to a large crowd of users. The Tor Project's goal is to 'reduce the number of distinguishable buckets per metric.' Anything that makes you different from the default install of the same browser — a resized window, an added extension, a flipped setting, a spoofed value — removes you from the crowd and makes you MORE unique. This is the most-misunderstood point, and it governs every recommendation below. Corollary: a spoofed-but-inconsistent profile (Windows UA + curl TLS stack, or Tokyo timezone + New York IP) is more memorable than the truth, because detectors cross-check signals to spot exactly those contradictions.

Tor Browser is engineered so every user presents the same fingerprint: UA and OS forced into a few buckets, canvas extraction blocked/prompted, WebGL hardened, fonts limited to a bundled set, timers coarsened, timezone forced to UTC. Settings: (1) Security Level to Safer or Safest — Safest disables JavaScript everywhere, neutralizing all active fingerprinting (canvas, WebGL, AudioContext, font enumeration, timing). (2) Do NOT maximize or resize the window — letterboxing (grey bars, rounding to a multiple of 200×100 px) is the protection working. (3) Never install extensions — the bundled NoScript is part of the standard fingerprint; do not add uBlock. (4) Never touch about:config or preferences: the defaults ARE the anonymity set. (5) Keep Tor Browser updated — the crowd is defined per browser version.

Mullvad Browser (co-developed by Mullvad VPN and the Tor Project) ships the same hardening as Tor Browser (letterboxing, 'all users look alike', masked fonts/canvas/hardware APIs, no telemetry) but does NOT route over Tor — it is meant to run behind a trustworthy VPN. Use it when Tor's latency is impractical but you still want a uniform fingerprint. Same discipline as Tor: default window size, no extensions, no settings changes. Honest limitation: it gives Tor-grade anti-fingerprinting but NOT Tor's network anonymity (your VPN sees one hop, not three) — a speed trade against a weaker network guarantee.

Mullvad issues a random 16-digit account number with no email, username, password or name, an explicit no-KYC policy, and accepts Monero. Generate the account number and settle the XMR invoice from within Tor Browser. Tor breaks the network link at purchase, Monero breaks the financial link; Monero's on-chain privacy (hidden amounts, sender and recipient) is far stronger than Bitcoin's transparent ledger for this purpose. Ordering matters: buying non-anonymously (card, home IP) links the account to you regardless of how cleanly you use it afterward.

GrapheneOS (Pixel) reduces device-side entropy vs stock Android: strips system Google services, per-app Sensors permission (cut accelerometer/gyroscope/barometer — motion-based fingerprinting vectors), per-app Network and Storage scopes. Pixels are required because GrapheneOS depends on their hardware roots of trust (verified boot, attestation). Combine with the crowd-blending browsers: the OS reduces device entropy, the browser web entropy. Tails (amnesic) on a hardened ThinkPad boots from USB, routes everything over Tor and leaves no trace — each session restarts identical to every other Tails user's. Qubes + Whonix adds compartmentalization: isolating personas in distinct qubes prevents linking one activity to another, and a compromise stays contained.

On cellular, the IMEI (device), IMSI (SIM) and the router's MAC are persistent hardware identifiers that fingerprint you at the carrier/Wi-Fi layer, independent of the browser. The blue-merle package randomizes the IMEI and does vendor-OUI-aware MAC mimicry rather than a fully random MAC. Why OUI matters — it is the same principle as the browser advice: a MAC with a random/invalid vendor prefix is itself anomalous and stands out; mimicking a plausible OUI keeps you in the crowd of legitimate devices instead of flagging you as 'a device trying to hide.' Pair IMEI randomization with a SIM swap: do not rotate the IMEI while keeping the same IMSI on the same cell, because that pairing is itself trackable.

(1) Spoofing that creates internal inconsistencies: a 'Windows' UA on a 'Linux' platform, a WebGL renderer that doesn't match the OS, fonts inconsistent with the platform are dead giveaways. A coherent profile blends in; an incoherent one screams 'spoofer.' (2) Stable lies = stable tracking: always spoofing the same way turns that combination into a durable fingerprint; per-load randomization is the mirror problem (a detectable red flag). (3) Language/timezone/IP mismatches: exiting via a German node while advertising en-US and a New York timezone is a classic tell; Tor deliberately standardizes locale and timezone (UTC) — leave them alone. (4) Unique window sizes: maximizing or fitting an ultrawide pushes you out of the letterboxing buckets. (5) Mixing identities on one session links the accounts — use 'New Identity' or separate personas. (6) Adding 'privacy' extensions (uBlock/Canvas-blocker) to Tor/Mullvad Browser makes you unique vs the stock crowd. (7) Buying the anonymity tool non-anonymously links the account to you.