Watilin Author

Whoops, I'm wrong and I can't edit my previous post. It looks like you were indeed looking at the live DOM.

Anyway, I didn't explored the Linx Amender script's source code in detail but it seems that the onmousedown links are added by Google at some time between the DOMContentLoaded and load events. Maybe the script doesn't look for them at the right time.

Hi there,

I recently grew concerned about fingerprinting. What is that? It's sort of a uniquely-identified hash of a set of stable informations about your browser (and possibly your OS) that websites can access and store for tracking purposes. See Panopticlick, BrowserSpy and also the Mozilla wiki.

Given that fingerprinting methods often require browser plugins such as Flash or Java, a first step is to configure your browser to enable plugins on-demand and per-site. With plugins disabled, the second most important source of intel is JavaScript. NoScript helps a lot, but for third-party trackers only. I cannot always afford to disable JS on a site's main domain. Also, I know Tor is able to replace some of the browser's exposed values.
Actually I'm more interested with what we can do with Greasemonkey only. For science.

I'm currently focusing on two sources:

  • navigator.plugins
  • navigator.mimeTypes

Here is what I tried for now:

// @include   *
// @grant     none
// @run-at    document-start

Object.defineProperties(navigator, {
   'plugins': {
      configurable: false,
      enumerable: true,
      get: function() { return {}; },
      set: function() {}
   'mimeTypes': {
      configurable: false,
      enumerable: true,
      get: function() { return {}; },
      set: function() {}

I quickly noticed that it broke many of the sites I visit on a daily basis.
This is because maaany sites (including Youtube and most of gaming sites) use either one or both of these objects to check the presence and version of a required plugin. So I added @exclude rules, but this doesn't seem like a convenient solution. Implementing a (black|white)list feature would certainly do better, unless it becomes too cumbersome for the user. The ideal would be to be able to decide out, at runtime, between a real need for a given plugin and a retrieval for tracking purposes. But I doubt this is possible :P

I feel like cloaking JS-exposed browser values is something complicated, and requires fine tuning. So I'm opening this topic mainly as a zone for idea proposal and discussion. Maybe we'll eventually find out that Greasemonkey isn't suited to solve this problem, but I repeat, this is for science!

ATM I'm experimenting with Firefox' proxies. I keep you in tune with my results wery soon :)

Also note that 2nd argument of MouseEvent constructor is optional at least under FF33 (I just tested right now):

var evt = new MouseEvent('click');