Chapter 4 of The Privacy Diet tells you to test your fingerprint at Cover Your Tracks, and warns the results may be sobering. They’re also easy to misread: a browser doing exactly what it should can still come back “unique”. This page runs three checks, says what a good result looks like for each browser the book recommends, and what to change when one fails.
Before you start
Test the browser you actually use, the way you use it — your normal window, your extensions on. A private window can turn extensions off and give you a better result than you really have. And if you use a VPN, do the first two checks with it off, then the third with it on.
Check 1: is it blocking trackers?
Open coveryourtracks.eff.org and run the test. The first answers are about blocking: whether a simulated tracking ad and an invisible tracker — a hidden “beacon” — got through.
- Good: both blocked. With uBlock Origin from Quick Win 1, or Brave’s built-in blocking, this is what you should see.
- “Partial protection”: EFF’s term for when the trackers loaded but their cookies were blocked. Better than nothing, but your blocker isn’t stopping them. Check that uBlock Origin is installed, switched on, and not paused for that site.
- Not blocked: no blocker is running. Go back to Quick Win 1, and the extension list from Chapter 4.
Check 2: your fingerprint
Lower down, Cover Your Tracks lists everything your browser gives away — screen size, time zone, fonts, graphics card — and how identifying that combination is. This is the result people misread. Chapter 4 describes two strategies against fingerprinting; what counts as a good result depends on which one your browser uses.
| Your browser | Strategy | A good result |
|---|---|---|
| Brave | Randomisation | Cover Your Tracks reports a randomised fingerprint. Run the test twice: values like the canvas and audio fingerprints should change. Being “unique” doesn’t matter if you’re unique differently every time. |
Firefox, with Chapter 4’s privacy.resistFingerprinting | Uniformity: common, spoofed values | Your time zone shows as UTC and your language as en-US, whatever yours really are. That’s the setting working. |
| Mullvad Browser (or Tor Browser) | Uniformity | Values match every other copy of the same browser — window sizes included, which it keeps to a few standard sizes. It can still be called unique overall; what matters is that you haven’t changed anything that sets your copy apart — see below. |
| Chrome, Edge, or Safari as it comes | None | Probably unique, and the same every time. That’s Chapter 4’s point, and the reason to switch. |
Two things make any of these worse:
- Extra extensions. Each one can add to what a site can see. EFF makes the same point: your own privacy add-ons can become part of your fingerprint. Keep to Chapter 4’s short list.
- Changing single settings to look “normal” — a different user agent, say. EFF warns that a browser claiming to be one thing while behaving like another stands out more, not less.
Check 3: leaks around your VPN
This one only matters if you use a VPN (Chapter 6). Turn it on, then:
- browserleaks.com/ip — the address shown should be your VPN’s, not your own. Your own is the one you saw with the VPN off.
- browserleaks.com/webrtc — the WebRTC check. WebRTC is how browsers make video and voice calls, and it can reveal your real address even through a VPN. No address of yours should appear: neither your home address, nor anything starting
192.168.. - dnsleaktest.com, the extended test, which Chapter 8 also uses. Every server listed should belong to your VPN or the resolver it uses — not your internet provider.
If the WebRTC check shows your real address:
- Firefox: Chapter 4’s
media.peerconnection.enabledset tofalseturns WebRTC off. As the book notes, that also breaks video and voice calls in the browser. - Brave: Settings → Privacy and security → WebRTC IP handling policy. Brave already uses Disable non-proxied UDP, the strictest choice, while its fingerprinting protection is on; if the check shows your address, set it there. It can stop calls in the browser working — Default public interface only is the next step down. If the setting is greyed out, an extension is controlling it: uBlock Origin’s Prevent WebRTC from leaking local IP address option, for one.
Living with resistFingerprinting
Once Chapter 4’s privacy.resistFingerprinting is on, Firefox changes a few things on purpose, according to Mozilla’s own documentation. None of them is a fault:
- Times on websites can be off by your time zone, because Firefox reports UTC.
- Sites may offer you English, because Firefox reports
en-US. - Some pages only use your computer’s own fonts, and images drawn by the page can show faint noise.
- Some animations and games can feel slower.
If the setting keeps switching itself back on after you turn it off, an extension is controlling it. Mozilla’s Resist Fingerprinting page explains how to find which.
When to test again
Run the three checks again after a browser or operating-system update, after you add an extension, and after you change VPN. The Privacy Diet’s list of sources for staying current suggests the same for Cover Your Tracks. It takes five minutes.
Official documentation
- Cover Your Tracks, with EFF’s explanation of the results
- Mozilla: Resist Fingerprinting
- Brave: WebRTC settings and Mullvad Browser: hard facts
- BrowserLeaks and DNS leak test
Stuck on a step? Get in touch.