> I'm finding this statement to be problematic:
> Changing your language setting to English will make you more difficult
> to identify and enhance your privacy. Do you want to request English
> language versions of web pages?
> Comment Spoof Accept-Language prompt
> I'm not sure if I believe this is true. Do we have any facts to
> support this statement?
On 20/12/17 07:51, Francesco Lodolo [:flod] wrote:
> Il 20/12/17 11.33, Rhoslyn Prys ha scritto:
>> I'm finding this statement to be problematic:
>> Changing your language setting to English will make you more difficult
>> to identify and enhance your privacy. Do you want to request English
>> language versions of web pages?
>> Comment Spoof Accept-Language prompt
>> I'm not sure if I believe this is true. Do we have any facts to
>> support this statement?
> Not really, and it's been pointed out in the bug, e.g.
The bug title is:
"Warn the user that customizing the preferred language list
(Accept-Language) can be used for fingerprinting"
and that's ok. The problem is that it then turned into:
"Tell the user that en-US is a better choice to avoid fingerprinting"
Warn the user is ok, and then let him/her choose. But and educated
choice would not be to use en-US, but the same language of the region
the user is in. That will "dilute" the fingerprinting value of the
It's like trying to hide yourself. Choosing en-US in a zh-TW region, I
don't know how that would help avoid fingerprinting.
I would go back to the title, letting the user decide which locale is
more appropriate. And no, it's not always en-US, unless you are actually
in the US or you're using Tor or a VPN with the exit node in the US.
> It might be true if you speak a minority language and live in US, not
> really if you live in a remote village of a non English speaking country.
I disagree. If you live in a remote village in Uruguay, your IP will say
so, and using en-US will instantly make you a minority (es-* being the
That change only makes sense for the Tor browser, where the IP does not
tell about the origin. Or for users using a VPN.
> Note that this is not a feature exposed by default, it's behind a
> preference in about:config and ported as part of TOR browser.