Nightly doesn't randomize fingerprint

[ghost]

Description

Fingerprint ID does not change after each reset (tried incognito and manual clearing) when tested in fingerprintjs.com/demo. Testing the fingerprint on panopticlick shows that Hash of canvas fingerprint and AudioContext fingerprint results are “randomized by first party domain”, while for Hash of WebGL fingerprint I get a constant/unchanging hash number (Might be related).

Steps to Reproduce

1. Install fresh brave nightly.
2. Change shield fingerprint protection to block all.
3. Open private tab
4. Go to fingerprintjs.com/demo
5. Close and repeat (minus step 1).

Actual result:

Expected result:

Fingerprint ID to be different on every test in fingerprintjs.com/demo.

Reproduces how often:

Every time.

Brave version (brave://version info)

Brave 1.8.52 Chromium: 81.0.4044.83 (Official Build) unknown (64-bit)
Revision 5718ca617723806b9aacfb41108a0d911d1bde74-refs/branch-heads/4044@{#853}
OS Linux

Version/Channel Information:

No.

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields?
  No.
• Does the issue resolve itself when disabling Brave Rewards?
  No.
• Is the issue reproducible on the latest version of Chrome?
  No.

Miscellaneous Information:

Randomization used to work but it stopped after a few updates. This issue is also reproducible in Windows 10.

[bsclifton]

cc: @pes10k

[pes10k]

Thanks, looking into this now

[pes10k]

@774z thank you for reporting this! From poking at this a lot, it turns out that they now ignore canvas and audio fingerprints, and try to fingerprint based on other characteristics. The most important is IP. So, Brave will give you better protections against this kind fingerprinting than other browsers, where the canvas and audio fields are used for the fingerprint. And there are more protection-through-randomization endpoints rolling out in Brave too, so things are getting better.

Also, we just started blocking this company in EasyPrivacy too, so, double protection :)