Your Anonymity is a Myth.

[Fixxx]

The idea sounds very appealing. You connect to a VPN, see the nice confirmation that your IP is hidden and relax. It seems that now you can browse websites peacefully and no one will know who you are or where you come from. In practice, it's much less romantic. A VPN indeed hides your real IP, but this is just one layer of identification. You continue to leave a browser fingerprint and sometimes even the IP itself can reveal your identity through separate technologies like WebRTC. If we strip away the illusions and look at the situation as it is, it becomes clear: a VPN is helpful, but it doesn't turn you into an anonymous user on its own. To understand where the line is drawn between real protection and complacency, one must delve into how websites and advertising systems recognize users. And remember: everything you read below primarily applies to desktop browsers. The picture is different on mobile devices, where tracking has its own peculiarities.

How the Internet Determines It's You​

The classic picture looks simple: you have an IP, the website has access logs, and based on that, actions can be matched. But the IP has long ceased to be the only or even the primary identifier. Modern tracking is built around combinations of features. You are not viewed as an abstract IP, but rather as a collection of stable characteristics of the browser, device and network. As a result, multiple levels of identification are formed. At the network level, it’s possible to identify the software you are connecting with. At the browser level, a detailed fingerprint of its environment is gathered. At the behavioral level, how you interact with the interface is analyzed. Together, this forms a profile that lives much longer than just one changed IP.

The Main Flaw of VPNs: Leaks Through WebRTC​

The most painful and often ignored element is real-time technologies in the browser, primarily WebRTC. This technology was developed for voice communication, video calls and direct data transfer between users. For it to work, the browser needs to know the real addresses of network interfaces and exchange auxiliary information. The problem is that the real user's IP can leak directly to the website bypassing the VPN tunnel. The website may see both the IP of the VPN server and your real IP or at least an address from the local network. Formally, the VPN is connected, but in reality, your address has already appeared in the logs on the website's side.

How a WebRTC Leak Looks and What to Do About It​

Practically, it looks straightforward. You visit a page where a WebRTC checking script operates. In the background, the browser contacts auxiliary servers, collects a list of interfaces and provides them to the script. The script sends the data back to the server and the question of "who you are and where you’re from" is partly solved, even if all other traffic goes through a VPN. Minimum protective measures are:

• Disable or restrict WebRTC in browser settings where possible.
• Use extensions that block WebRTC leaks and check yourself on specialized services.
• For sensitive tasks, use browsers where leak protection is enabled by default, such as Tor Browser.

As long as WebRTC is not under control, it is pointless to speak of any anonymity through VPN. This is one of the first holes to close.

Browser Fingerprinting: From Canvas to Battery​

Browser fingerprinting is not a single magical characteristic but rather a set of dozens of parameters collected by scripts on the page. Each parameter by itself may seem harmless, but together they provide a high level of uniqueness. The more entropy there is in a profile, the easier it's to distinguish it from others. Some parameters have been used for a long time, while others have emerged relatively recently, as web platforms have developed. Currently, several groups of data, particularly common in tracking, can be highlighted.

Key Components of Fingerprinting​

• Graphics: The results from Canvas and WebGL. Different devices and drivers render the same image slightly differently.
• Fonts and Interface: The set of installed fonts, scaling settings, pixel density and anti-aliasing characteristics reveal the operating system and environment.
• Audio System: The fingerprint of the audio codec and sound subsystem can also be used for identification.
• Extension and Plugin List: Even if the list itself is not directly visible, indirect signs can indicate the presence of popular extensions.
• Battery Status and Media Device: Data about charge level, battery presence, connected cameras and microphones adds uniqueness to the profile.
• Time Zone, Language, Time Settings: The combination of these parameters often reveals real geography, even when using a VPN.

All this data is collected together and reduced to a compact set of numbers. The rarer and more unusual the combination, the easier it's to use it as a stable identifier specifically for you.

TLS Fingerprints: Recognized Before Headers​

Even when we divert from the browser and focus solely on the network, there are plenty of ways to recognize clients. One of the most important tools in recent years is TLS connection fingerprints. At the stage of establishing a secure connection, the client sends a greeting with a set of supported ciphers, extensions and some additional parameters. From this structure, a compact fingerprint is formed. In practice, techniques like JA3 and newer analogues are used. The concept is straightforward: different browsers, libraries and automated clients have different sets of parameters in the TLS greeting. The server can determine that it has received not a typical user browser (for example, a script based on a non-standard library), even if the traffic is going through a VPN.

​

What This Means for the Average User​

At this level, the VPN is hardly involved. It encrypts your traffic only after the browser has formed the structure of the TLS greeting. As a result, the server sees the client’s fingerprint and matches it with known profiles. If you use an exotic combination of "anti-detect browser + unusual library + non-standard system settings", your profile might appear suspicious. In addition to TLS, classic TCP and IP packet analysis exists, where parameters like initial TTL value and window size attempt to identify the operating system and stack features. This is used less frequently on mass sites but is actively employed in specialized monitoring and security systems.

The Paradox of Uniqueness and the Issue of Entropy​

The intuitive desire of users often sounds like this: to install as many protective extensions as possible, block everything that can be blocked, activate a dozen anti-fingerprinting scripts and be happy. Unfortunately, this is a direct path to the very bright group that trackers see most clearly. From an information theory perspective, the system doesn't care whether your fingerprint is "correct" or "incorrect"; it looks at how rare it is. If 99% of users obediently provide a genuine Canvas fingerprint, use a standard browser setup and avoid exotic extensions, they form a crowd. You (with your unusual combination of protective plugins, disabled APIs and strange profile) become an easy target for session correlation.

Randomization Instead of a Complete Block of Canvas​

The earlier approach in the mid-2010s was straightforward and rigid: completely block access to Canvas and WebGL, return an empty response and consider the problem solved. This often broke websites, ruined interfaces and made the browser profile extremely unusual. The modern approach is different: don't block Canvas itself but add a little noise to the results. Firefox, Brave, Tor Browser and some extensions follow this path. The website still receives the image and continues to function, but the hash of this image slightly wobbles from request to request. For the tracker, this is no longer a stable identifier but a more diluted signal. This doesn't completely eliminate the problem but alleviates the notion that you either enable everything or block everything. The key is to remember that a brute-force block of Canvas is now rather exotic; the norm is careful randomization.

Why Aggressive Protection Can Be Harmful​

• Blindly blocking Canvas and WebGL indeed breaks some websites and creates a deliberately strange profile.
• A collection of niche extensions forms a rare combination, which in itself serves as a great identifier.
• Excessive intervention in the workings of APIs (battery, media devices, sensors) easily reveals the fact that you are actively fighting against tracking.

An optimal strategy looks different. The goal is not to ban everything, but to blend in as much as possible with the mass profile while limiting excessive data collection. This principle underlies solutions like the Tor Browser and techniques such as letterboxing - artificially adding fields around the window to bring dimensions to a small number of standard variations.

Extensions as a Source of Uniqueness​

Privacy protection extensions are indeed useful, but only if used with an understanding of the consequences. Any extension alters the behavior of the browser: it adds headers, blocks requests, injects its scripts and modifies API operations. All this can serve as a distinguishing feature of the profile. The more rare and exotic the set of extensions you have collected, the higher the likelihood that this combination, in its pure form, is found almost nowhere else. For the tracker, this is a gift. They simply note the combination "such a browser, such a system, such a set of extensions" and recognize you on your next visit, even if you changed your IP and VPN.

How to Approach Choosing Extensions​

• Limit yourself to the minimally necessary set, without five similar blockers in a row.
• Use the most popular solutions, such as uBlock Origin, rather than niche experiments.
• If possible, conduct radical experiments in a separate profile or separate environment.

The idea of “installing maximum protection” sounds pleasant, but without considering the issue of uniqueness, it easily turns into the opposite effect. You become easier to distinguish from others, making it simpler to link different sessions.

Behavioral Identification: Where the Real Threat Lies​

A separate direction in tracking development is behavioral biometrics. Systems analyze typing speed, pauses between keystrokes, mouse movement trajectories and scrolling behavior. From this data, a stable profile can be constructed, even if the user changes devices and networks. However, it’s essential not to turn this into a source of panic. Major advertising networks rarely employ full-fledged behavioral biometrics at the level of each website. It's expensive, requires significant infrastructure and is usually applied in high-stakes scenarios. These primarily include banking ant fraud, secure accounts and systems checking "whether it's a person or a bot".

Where Behavior Is Indeed More Important Than IP​

• Online banks and financial services, where behavior distinguishes a live user from a trojan or bot.
• Large platforms with high account value, where they need to detect attempts at automation and theft.
• Next-generation invisible CAPTCHAs that assess behavior before presenting tasks.

In the context of mass advertising tracking, the main burden still lies on browser fingerprints and network signs. Behavior complements the picture but doesn't serve as a ubiquitous eye following you across every website.

Mobile Devices: A Different World of Fingerprints​

It's worth mentioning smartphones and tablets separately. Currently, over half of all web traffic comes from mobile devices and the rules of play differ significantly. There are no mice and windows in the traditional sense; instead, gyroscopes, accelerometers, gestures and system identifiers come into play. On mobile platforms, especially in standard Chrome on Android, users are deprived of many desktop tools such as extensions and complex privacy settings. However, other sources of uniqueness emerge: advertising identifiers, association with Google or Apple accounts and ties to the device and applications, not just the browser.

​

What Is Especially Important on Mobile​

• Advertising ID: A special identifier for advertising, which analytics systems and advertising networks use as a key.
• App Association: Tracking occurs not only through browsers but also through integrated browser components within applications.
• Sensors and Gestures: Taps, swipes, device tilts are analyzed and, in some scenarios, used as additional markers.

Advice about extensions, complex manual settings and separate browser profiles has limited applicability on smartphones. It's more crucial to manage app permissions, disable personalized advertising at the system level and be careful about where you log in and which programs you install. A VPN on mobile is still useful, but it doesn't make you anonymous, especially if half of your activity occurs through applications that communicate with servers directly.

Anti-Detect Browsers: Camouflage, Not Privacy​

A separate discussion is warranted for so-called anti-detect browsers. At the marketing level, they are often pitched as tools for privacy protection, but they were created for other purposes. The primary users of such solutions are traffic arbitrageurs, mass multi-accounting schemes and gray methods for bypassing anti-fraud systems. An anti-detect browser doesn't make you invisible. It mimics one of the pre-prepared profiles. Essentially, you are wearing the mask of another user, with someone else's set of fonts, screen resolution and system parameters. This can be useful in specific scenarios, but for the average person, it often brings unnecessary risks.

What Makes Anti-Detect Dangerous for the Average User​

• If you access a bank or major social network through such a profile, the protection system will see an unusual device and may block your account due to suspected fraud.
• Errors in profile settings create an unnatural fingerprint, which automatically raises the level of suspicion.
• Using anti-detect solutions often contradicts user agreements and can be considered circumventing security measures.

It’s important to distinguish between two tasks. Privacy is about protecting personal data and reducing the amount of information collected. Camouflaging oneself as other users is an attempt to deceive anti-fraud and anti-bot systems. For everyday life, the first approach is necessary, not a game of spies with non-standard profiles.

The "Blend with the Crowd" Strategy​

When everything is considered, a simple idea emerges. The goal is not to become an invisible ninja who breaks websites, disables half of the APIs and installs rare extensions. The objective is to make your profile as similar as possible to many others while not giving away excessive data and closing obvious leaks. Therefore, privacy-focused browsers often employ a unification strategy. They reduce the number of distinctive features and condense users into a relatively small set of standard profiles. This also includes the technique of letterboxing, where the window sizes are fitted to a few standard values to hide unique combinations of height and width.

Examples of Unification Approaches​

• Tor Browser creates one big standard profile from millions of users with a maximally identical fingerprint.
• Specialized privacy browsers enhance tracking protection and standardize parameters to more uniform values.
• Using separate profiles for different tasks helps avoid mixing work sessions and personal life, reducing the correlation between them.

This approach requires a bit more discipline than simply installing a VPN application, but the result is better. You do not become invisible, but you reduce the likelihood of persistent and accurate identification.

Practical Checklist: Three Levels of Protection​

Instead of the abstract notion of needing a comprehensive strategy, it's more convenient to have a clear plan. Below are three levels of protection that can be viewed as steps. It’s not necessary to immediately jump into the maximum mode. It’s sufficient to choose the level that matches your tasks and your tolerance for inconvenience.

​

Basic Level: Minimum Effort, Noticeable Effect​

This level suits most users who do not want every online store to know too much about them but still want websites to function without constant failures. It’s a reasonable balance between comfort and privacy.

• Use a browser with good tracking protection, such as Firefox in strict privacy mode.
• Install one quality ad and tracker blocker, such as uBlock Origin, without a collection of similar extensions.
• Set up auto-deletion of cookies and website data upon closing tabs or the browser, instead of relying on manual cleanup.
  This can be done in Firefox settings or through extensions like Cookie AutoDelete.
• Separate at least work and personal accounts into different profiles or even different browsers.

​

Advanced Level: Control Over IP and Fingerprint​

This level is for those who are willing to delve a bit deeper into settings. Here, a VPN comes into play, along with disabling or limiting WebRTC and isolating websites from one another. This doesn’t make you completely anonymous, but it significantly complicates tracking.

• Use a reliable VPN, keeping in mind that it is not a means of absolute anonymity, but one element of protection.
• Disable or limit WebRTC and check yourself on specialized services for IP leaks.
• Enable site isolation modes and containers, so different domains do not share unnecessary data with each other.
• Minimize the number of extensions and carefully monitor the permissions they request.
• Use separate profiles or different browsers for accessing sensitive services, keeping them separate from everyday surfing.

​

Paranoid Level: When the Stakes Are Really High​

This mode is reasonable where the cost of error is high: journalism, investigations, politically sensitive topics, working with confidential sources. Here, comfort takes a back seat and risk reduction comes to the forefront.

• Use Tor Browser, which is designed as a tool for anonymous access and fingerprint unification.
• Consider specialized operating systems focused on privacy that run from external media and leave no traces on the disk.
• Rigorously separate roles and tasks into distinct environments and never mix them in one browser.
• Avoid logging into personal accounts and familiar services from the "paranoid" environment to avoid compromising the threat model.

Transitioning to this level makes sense only when you clearly understand why you need it. Living in such a mode for ordinary news reading is hardly reasonable.

Summary: VPN is Useful but Not a Magic Wand​

A VPN addresses an important but narrow task. It hides your real IP from websites and providers, encrypts traffic and removes some issues regarding geo-blocking and price discrimination. Beyond that, its capabilities end. Your browser continues to leave a fingerprint, WebRTC can leak your address, TLS and network parameters reveal client types and the set of extensions makes the profile more unique. If you view a VPN as part of a toolkit, everything falls into place. Close WebRTC leaks, carefully select extensions, don't turn your profile into an exotic one, separate different roles into distinct environments and keep in mind that the rules of the game are different on mobile devices. No solution will provide complete invisibility, but a sensible approach to privacy can significantly reduce the number of unnecessary eyes following you online.

Level	For Whom	Tools and Actions	Cons
Basic	For 90% of people. To reduce tracking while keeping sites functional.	- Firefox in strict protection mode - One ad/tracker blocker (uBlock Origin) - Auto-delete cookies when exiting the browser.	Doesn't protect against special services or targeted tracking.
Advanced	For those who want to control their digital footprint.	- Block or limit WebRTC - Site isolation containers (Facebook separately, bank separately).	Some websites may not function correctly. Requires manual setup.
Paranoid	Where the cost of error is freedom or security.	- Tor Browser as the main access tool - Specialized operating systems (Tails, Whonix) - Total avoidance of personal accounts in work environments.	Slow internet, frequent CAPTCHAs, inconvenient for everyday use.

 

[Fixxx]

For a deeper dive into the topic, check out the webinar by @Vektor T13:
> Why VPN Don't Hide You — How Websites Really Track Your Location