Mullvad Browser and Tor Browser have unique-per-computer persistent IDs on fingerprint.com

2026-03-24 15:33 UTC

I have been testing Tor Browser and Mullvad Browser using fingerprint.com. I get unique persistent identifiers that are unique per machine and persist over rebooting sessions. Javascript was on during this test. This could be very dangerous to people using Tor Browser and Mullvad Browser. For example, if someone visits Rainbow Railroad, an organization for leaving repressive countries with hostile LGBT policies, and then watches a video about the organization on YouTube, and then also does something, like create a Discord Server, and use Tor Browser to get around geoblocking but link it to their personal phone number, then a hostile regime buying data from data brokers could possible determine that user is considering using rainbow railroad. Even if this exact example isn’t realistic or plausible (although governments do buy form data brokers), users should be aware that persistent identifiers in Tor Browser and Mullvad Browser allow for continuous tracking of a user using the same machine. I posted this information on privacyguides forum and they deleted my account after, leading me to wonder if the forum is a giant honeypot that curates acceptable privacy discussions and unacceptable private discussions. I honestly wonder if they are infiltrated by the government. They repeatedly delete the posts of other people as well and the whole thing is starting to not sit well with me.

Replies (17)

@Dust0741@lemmy.world 2026-03-24 16:01

Skepticism is good here. However, I was not able to replicate this. On Mullvad and Tor, with "Safer" settings, both gave me a new ID after a browser restart.

Open ##1579100
@TankieTanuki@hexbear.net 2026-03-24 21:53

Using JavaScript defeats the purpose of Tor

Open ##1579101
@quick_snail@feddit.nl 2026-03-25 16:39

You need to change the safety setting to "safest". This is why some onion sites constantly popup warnings in JS and annoy you until you make the change.

Open ##1579102
@Staff@piefed.world 2026-03-24 16:05

Wonder why privacyguides deleted the post

Open ##1579103
@nugnuts@lemmygrad.ml 2026-03-24 21:43

It's wild to post something like this, and say things like "This impacts at least some operating systems or distributions," without indicating at all which ones you're having the experience with.

Open ##1579109
@SteleTrovilo@beehaw.org 2026-03-24 16:25

"Javascript was on during this test."

Open ##1579110
@fatcat@discuss.tchncs.de 2026-03-24 19:05

I can actually replicated that. Tor Browser without extensions (only the default https anywhere and noscript) on Mac OS. Pretty scary? Wondering how this works.

Open ##1579111
@doomguin@piefed.zip 2026-03-25 13:20

I was able to partially replicate, on safest mode with the minimum js enabled for a result to come up Tor on mobile gets reliably identified (not a huge surprise, but annoying) regardless of extensions Tor on desktop did not get reliably identified, even with uBlock Tor on desktop in "safer" mode, with default noscript, and uBlock enabled, was not reliably identified Edit: Surprisingly, even on "standard" setting, desktop was not uniquely identified

Open ##1579113
@RoddyStiggs@lemmy.blahaj.zone 2026-03-25 11:15

Just chiming in to say I learned a lot from discussions and links in this thread. Thanks all.

Open ##1579114
@0xtero@beehaw.org 2026-03-24 15:53

Yes, it's by design. You should probably read this https://mullvad.net/en/browser/mullvad-browser

Open ##1579115
@technomage@lemmy.ca 2026-03-25 03:17

This could entirely be me being tired, and thus a little stupid right now, but how exactly are you rebooting the system? If it's by hitting the restart button, or powering off and back on, you may be having issues with something getting "stuck" in RAM, essentially. Try fully powering down the machine, disconnect the power cable (and battery if it's a laptop), press and hold the power button for 30+ seconds, then hook everything back up and test again. That should be enough to drain any little bits of electricity stored in the system, thus fully clearing anything that might've been hanging around from RAM. Also, make sure the browsers are fully updated and no outdated extensions/plugins/etc.

Open ##1579116
@hexagonwin@lemmy.today 2026-03-25 10:39

may i ask which os you're in? linux? i hate windows, but it seemed like tor's fingerprint randomization works best on commonly used oses. never worked properly on my freebsd or slackware... i use a win10 vm for tor because of this. (only allow tor to communicate, via proxy and block windows from talking to microsoft)

Open ##1579117
@quick_snail@feddit.nl 2026-03-25 16:38

Privacy Guides is definitely over moderated. They might be infiltrated.

Open ##1579118
@bad_news@lemmy.billiam.net 2026-03-24 15:48

Open ##1579119
@eleijeep@piefed.social 2026-03-24 16:01

If all users have the same fingerprint then nobody is getting fingerprinted.

Open ##1579120
@upstroke4448@lemmy.dbzer0.com 2026-03-24 20:30

It has no clue who you are using tor. Just switch the circuit your on.

Open ##1579121
@Ashrakal@lemmy.ml 2026-03-24 18:40

Isn’t Mullvad browser kind of deprecated? Vivaldi is quite good, despite its closed-source UI components.

Open ##1579122