[gruez]

I just tested. With standard settings for "Content Blocking" (under "Privacy and Security") and "Only when Firefox is set to block known trackers" selected, Firefox does not send the DNT header in regular windows. It only sends it in private windows. Therefore if you don't want to stand out, you should not enable DNT.

[floatingatoll]

Indeed. If you don’t want to stand out, you should use the defaults. Anything non-default will stick out as a 1%-or-less marker. Three or more non-default might well uniquely fingerprint you.

[kbenson]

By that reasoning, what would be best would be to identify a few items of information exposed that are commonly used for tracking but that have little or no effect on browsing, and randomly alternate them between the default value and 1 or more other (or random) values.

If the data can't be relied on to contain any specific useful information (even whether it's default or not), then it's effectively useless for tracking, and you've not just hidden yourself in the largest category for those bits of tracking data, you've effectively made them entirely useless for tracking you (which is more effective than hiding in the biggest group).

[gruez]

That only works if you're synchronizing those changes with your other identifiers (cookies, local storage, ip, etc.) Otherwise you're going to be "that guy" that constantly changes his values with every page load.

[kbenson]

Just based on a random seed set when the browser loads and the domain name being loaded (that is, external resource requests get the values for the sourcing page domain, which is already tracked in browsers for security purposes). You'll get persistent per-domain values per browser run. If they can already track you definitively beyond that (bookie, session, etc), you're not hurting yourself at all by doing it, but it will possibly help with all the other cases.

[floatingatoll]

IIRC you should look into the Tor Browser’s work along these lines. It includes fun things like “provide a default untraceable screen size ignoring your own”, so that web pages render at the wrong resolution for your browser window in exchange for one less effective vector. I don’t know if Firefox has it under a config option or not.

[kbenson]

I think you're talking about letterboxing, which Mozilla stole as a good idea from Tor a while back, and is gated behind the "privacy.resistFingerprinting" config option. It was covered here at the time.[1]

1: https://news.ycombinator.com/item?id=19323032

[floatingatoll]

"stole" is an unusual phrasing of "uplifted into Firefox": https://blog.torproject.org/tor-heart-firefox

[kbenson]

I figured someone might interpret that the wrong way. In my mind it was sort of a "Imitation is the sincerest form of flattery" mixed with "Good artists copy; great artists steal." I tried to allude to this with the "as a good idea" bit, so maybe it would come across as "that's a good idea, I'm stealing it!"

To summarize and clarify, I applaud their actions wholeheartedly. :)