There's 2 separate universes here.

Devs and tech companies care only for UX, convenience, and reduced friction to use any service. They would put their granny's home address and SSN in the headers if it made a page load 10ms faster. Their incentives are all short-sighted to hit the next goal to outcompete other devs/companies and ship their end of history killer app that will solve all problems - and that will still get bloated and enshittified within 18 months.

Then there's us, a subset of rational people educated about how much data gets transmitted, who are horrified by the general state of being online, and are hard to impress when it comes to more than just saying "privacy!" when promoting anything at all.

IMO, we have to DIY and cobble together so much of our own protection, we're closer to artists that live a strange life that few people understand, seems weird from the outside, but we love for the peace of mind. Which is not enough to be any appreciable segment of the market to move the needle on any product worth real money.

100% agree. Browsers don't need to, and shouldn't be reporting all Javascript attributes that make us unique, especially things like canvas.

You can test this out here, but nowadays its rare for any out of the box browser to be anonymous.

https://www.amiunique.org/fingerprint

This is why using a local web proxy is a good idea; it can standardize those responses (or randomize them) no matter what you’re actually using.

Personally, I keep JavaScript disabled by default specifically because of this, and turn on those features per-site. So if a website has a script that requires the accelerometer for what it does, that script gets to use it. Other sites keep asking for it? I suppress the requests on that site and if it fails to operate (throws one of those ad blocker or “you have JS disabled errors), I just stop going to the site.

I’ve found that with everything disabled by default, browsing the web is generally a pleasant experience… until it isn’t.

This of course requires using a JS management extension. What I’d really like to see is a browser that defaults to everything disabled, and if a site requests something, have the browser ask for permission to turn on the feature for that particular script, showing the URL for the script and describing what the code does that needs the permission. This seems like an obvious use for locally run AI models.

• Your operating system
• Your CPU architecture

Agree. No reason they should have this.

• Your JS interpreter's version and build ID

I can see a reasonable argument for this being allowed. Feature detection should make this unnecessary, but it doesn't seem to be fully supported yet.

• Plugins & Extensions

This is clearly a break of the browser sandbox and should require explicit permission at the very least (if not be blocked outright...I'm curious what the legitimate uses for these would be).

• Accelerometer and gyroscope & magnetic field sensor

Should probably be tied to location permission, for the sake of a simple UX.

• Proximity sensor

Definitely potential legitimate reasons for this, but it shouldn't be by default.

• Keyboard layout

As someone who uses a non-QWERTY (and non-QWERTY-based) layout, this is one I have quite a stake in. The bottom line is that even without directly being able to obtain this, a site can very easily indirectly obtain it anyway, thanks to the difference between event.code and event.key. And that difference is important, because there are some cases where it's better to use one or the other. A browser-based game, for example, probably wants to use event.code so the user can move around based on where WASD would be on a QWERTY keyboard, even though as a Dvorak user, for me that would be <AOE. But keyboard shortcuts like J and K for "next"/"previous" item should usually use event.key.

There could/should be a browser setting somewhere, or an extension, that can hide this from sites. But it is far too useful, relative to its fingerprinting value, to restrict for ordinary users.

how sensors are used to fingerprint you, I think it has to do with manufacturing imperfections that skew their readings in unique ways

It's also simple presence detection. "You have a proximity sensor" is a result not every browser will have, so it helps narrow down a specific browser.

Is this true for TOR?

Most of those crying about this are likely still stuck on the easy stuff, trapped in WhatsApp, Discord and iOS. Try start there.

That works for me, but how do the browser builders achieve that privacy AND retain at least reasonable useability for normal / majority users?

Basically, most of the internet won't work right, if you don't allow the browsers to track you. I have had a very strict Firefox setting and kept having to create exception to every site I visited just get in.

You can boycot the sites but in the end, you'll be missing out on everything really

That a page knows technical details of my system and in which I live country (if I do not use a VPN), I give a fuck, why this only serves to correctly show the content, eventually in my language and allow the download of possible compatible apps.

Fingerprints are a very broad issue and are not necessarily related to privacy, blocking or counterfeiting all is possible, but in many cases counterproductive, it must be done specifically only in those that involve private and personal data, everything else is to put a tin foil hat.

To protect the privacy there are needed way more measures, avoiding trackers, Pixel tracking (Meta), keyloggers (Towerdata, Imgur, M$ US and some others), avoiding search engines which logs the activity (Google, Bing...), recognize dark pattern, using encrypted mailservices, best with disposable alias, harden the SO with Portmaster, Pi-ole or similar.......apart of Common sense-

Browsers, which are not directly from Big Corporations which itself log user actividad (Chrome, EDGE, Opera...), are relative irrelevant in this game of user profiling, they are only depends on personal preferences and needs.

Privacy is a huge issue, but too often misunderstood with wrong measures, PEBCAK