OPSEC: Browser Fingerprinting Protection — How to Block Tracking

A user on Dread posted a screenshot of their Tor Browser configuration last month, asking why every site kept showing them the same “unique visitor” banner. They had installed three privacy extensions, enabled a custom user agent, and set their timezone to UTC — but their canvas hash, WebGL renderer string, and audio context fingerprint were all leaking exactly as if they had done nothing. The browser looked hardened on paper, but the fingerprint was a neon sign. This is the gap most people miss: Tor Browser does most of the fingerprinting work for you, and every “improvement” you layer on top usually makes you more identifiable, not less.

Browser fingerprinting is the practice of combining dozens of small, seemingly harmless data points — screen resolution, installed fonts, GPU model, audio sample rate, keyboard layout — into a stable identifier that persists across sessions, even when cookies are wiped. On darknet markets like Nexus or Torzon, this matters because a single fingerprint link between your clearnet research and your market login is enough to collapse your anonymity set. The goal here is not to make yourself invisible — that is impossible — but to look identical to thousands of other users at the exact same moment.

What We’re Setting Up and Why It Matters

Tor Browser already ships with a fingerprinting protection system called letterboxing (the rounded gray border that resizes the viewport to standard dimensions) and privacy.resistFingerprinting enabled by default. It deliberately spoofs your timezone to UTC, blocks WebGL, and standardizes your user agent to match the current Tor Browser version. This is intentional: the developers want every user running version 14.5.2 to look exactly like every other user running 14.5.2. The moment you install a custom theme, change your window size to something unusual, or enable a feature most users do not have, you exit that anonymity set.

The threat model is straightforward. An adversary — a market admin logging your fingerprint, a researcher running a correlation attack, or law enforcement serving a subpoena to a hosting provider — can cross-reference your browser signature across multiple .onion sessions. If your fingerprint appears on a market login and then on a forum post six hours later, you have a behavioral link. Fingerprinting does not need to identify you by name; it only needs to confirm that two activities came from the same device.

Prerequisites Before You Start

Download Tor Browser only from torproject.org. Verify the signature using the Tails signing key or the Tor Project’s own GPG key before running the installer. Phishing sites like tor-browser[.]org or torproject[.]org (note the hyphen) have been live for years and ship modified binaries that leak your real IP through a malicious update channel. If you are on Tails OS, the browser is already preconfigured and isolated — do not install a second copy.

You will also need a clean working environment. Close every other browser, kill your email client, and disconnect from any account-syncing services. Fingerprinting scripts can read from your GPU, your audio stack, and your connected USB devices, so the fewer processes running, the smaller the attack surface.

Step-by-Step Configuration

Verify the Default Settings First

Open Tor Browser and navigate to about:config. Confirm that privacy.resistFingerprinting is set to true and media.peerconnection.enabled is set to false. These two preferences are the backbone of WebRTC and canvas protection. If either has been changed, right-click and select “Reset” to restore the default. Do not toggle them manually — the defaults are calibrated to match what every other Tor Browser user has.

Next, check privacy.resistFingerprinting.autoRoundWindow and ensure it is true. This is the setting that triggers the letterboxing resize animation. If you have disabled it because the animation annoyed you, you have also disabled one of the most effective anti-fingerprinting measures Tor ships with.

Resist the Urge to Customize

Do not install custom fonts, dark mode extensions, or theme packages. Tor Browser intentionally ships with a limited font set because font enumeration is one of the oldest fingerprinting vectors. Every user running Tor Browser 14.5.2 on Windows has the same five fonts available; the moment you add Comic Sans, you are alone in the crowd.

Do not change the default search engine from DuckDuckGo, do not pin tabs, and do not enable the bookmark toolbar if you can avoid it. Each UI change alters the browser’s window dimensions and chrome geometry, which feeds into the fingerprint hash.

Disable JavaScript on High-Risk Sites

For markets like DarkMatter or Nexus where you only need to read listings, use the NoScript toolbar icon and set the security level to Safest. This disables JavaScript entirely and blocks the most aggressive fingerprinting scripts. For markets that require JS to render the cart or escrow system, use the Safer level and whitelist only the specific .onion domain — never the clearnet CDN it tries to load.

A common mistake is setting the security level to Safest globally and then wondering why the login form does not submit. The fix is per-site granularity, not lowering the global setting.

Verification: Confirm Your Fingerprint Is Generic

Visit https://coveryourtracks.eff.org (clearnet) or the .onion mirror to run a fingerprint audit. You should see a readout saying your browser is “partially fingerprintable” but that your configuration matches the Tor Browser baseline. Pay attention to the “bits of identifying information” counter — anything above 10 means you have deviated from the default in a detectable way.

Then visit check.torproject.org to confirm your connection is actually routing through Tor. If the page loads but shows your real IP, your fingerprint protection is irrelevant because your network layer is already compromised.

Common Issues and Troubleshooting

If sites keep showing you CAPTCHAs, your fingerprint is rotating too aggressively — usually because you have multiple Tor Browser windows open at different zoom levels. Close everything and reopen a single window at 100% zoom. If a market refuses to load, check that you have not accidentally enabled WebRTC by installing a WebRTC-enabled extension; Tor Browser blocks WebRTC at the source code level, and any extension that claims to “fix” WebRTC is either redundant or malicious.

If your canvas hash changes between sessions, you may have hardware acceleration enabled. Go to Preferences → General → Performance and uncheck “Use hardware acceleration when available.” This forces the browser to use software rendering, which produces a stable, standardized canvas output across all Tor Browser users on the same platform.

Additional Security Recommendations

Never reuse a Tor Browser profile between a market session and a personal research session. The fingerprint will link them. Use Tails for high-sensitivity work and route everything through Tor Browser for everything else. Combine fingerprinting protection with Monero for payments and PGP for communications — each layer reduces the chance that any single leak collapses your identity.

Finally, accept that fingerprinting protection is a moving target. The Tor Browser team updates the spoofing baseline every few months; running an outdated version is itself a fingerprint. Update regularly, and resist every urge to customize.