Going to http://panopticlick.eff.org/ I can see that that Firefox and Chrome expose more about 'System Fonts' and 'Browser Plugin Details' than I prefer.

How can the permission of a web page to access these settings be disabled in Firefox and Chrome?

  • 1
    For System Fonts you have to disable Flash. Still looking for Plugins.
    – pkario
    Jun 5, 2011 at 5:35
  • 1
    Actually, disabling Flash doesn’t cut it; it can still enumerate them another way.
    – Synetech
    Mar 13, 2016 at 8:08
  • In case someone is here because they are worried about privacy... your IP address is enough to identify your household. How many users in your household have the same screen resolution, OS, and the browser? You are already unique :) so you can stop worrying about font-lists and plugins... Sep 5, 2016 at 21:31

10 Answers 10


There are two questions but I am answering the font list question:

It is possible to disable Flash font enumeration using mms.cfg system wide configuration file. This file should be located in /etc/adobe/ directory if you are using Linux. Basically you just need to put the following line in the file:

DisableDeviceFontEnumeration = 1

See the Adobe Flash Player Administration Guide for more details.

With this setting Panopticlick and other sites can not get your font list via Flash.

Note that the font list is still available through Java if you have it installed. It is a good idea to get rid of Java anyway. If you use a couple of sites that require Java, use a different browser instance with a different user profile with Java enabled just for those sites.

  • 2
    On my Windows 7 machine, the file is located at C:\Windows\SysWOW64\Macromed\Flash\mms.cfg
    – MikeFHay
    Mar 27, 2013 at 20:17
  • You could simply disable Java and Flash in your browser extensions. This worked for me.
    – q9f
    May 9, 2013 at 10:55
  • 1
    Thank you so much! This works on my PC (Windows XP). Panopiclick still recognises me as a unique visitor, though. through my list of plug-ins...
    – Cerberus
    Sep 11, 2013 at 0:28
  • Works for me on XP, too. FWIW, the file location was C:\WINDOWS\system32\Macromed\Flash\mms.cfg.
    – martineau
    Sep 25, 2013 at 8:59
  • 2
    Did not work for Chrome on OS X. Turns out, Chrome uses its own Flash plugin, which has a separate configuration file. Its path is ~/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/System/mms.cfg (create System/mms.cfg if it doesn't exist.)
    – Dan
    Dec 29, 2013 at 19:19

The free Chrome extension RubberGlove blocks plugin and mime-type enumeration by cloaking the array entries in roughly the same way Firefox and Internet Explorer can/do natively.

You still need to set chrome to "Click to play" plugins and disable 3rd-party cookies in Chrome's privacy settings yourself. Also, as was mentioned in the study, you'll still probably show up as unique until enough people start using plugins like this.

Full disclosure: I'm the author.

This functionality may (or may not) be integrated into the Electronic Frontier Foundation's Privacy Badger extension in future. They seemed interested, anyway.

  • Jason, is there any chance you can add whitelisting feature to RubberGlove? It's amazing but breaks several sites. Enabling and disabling the extension all day long is a bit annoying. There is request for this both on google chrome addon site and the github development page. Dec 6, 2016 at 11:19

Font fingerprinting is just a small part of browser fingerprinting. Blocking it totally is almost impossible to do if the purpose is to leave the browser still functional. The best general fingerprint protection is said to be found in the Tor Browser.

In practical tests it was found that trying to block font fingerprinting actually increases the uniqueness of the computer fingerprint, since most users don't do that. The best way to avoid fingerprinting is to do nothing special and blend-in with thousands of other users.

First step against font fingerprinting is to have a test for the effectiveness of any defensive measure that you will take. A good tool here is https://browserleaks.com/fonts. A good tool for the uniqueness of the general fingerprinting is https://panopticlick.eff.org/ (my own browser came up as unique among the 199,984 tested in the past 45 days) or Am I Unique.

For protection in Chrome, measures you may take are:

  • Install instead a hardened Chromium build
  • Use an extension (I have not tested their effectiveness):

For protection in Firefox

Mozilla is currently working on the Tor Uplift project, whose goal is to build up in Firefox the same level of fingerprinting resistance as in the Tor Browser. This project is in progress and described in the article Security/Fingerprinting.

You could try the Firefox-hardening script in Github ghacks-user.js, although by all reports it may be too much and actually harm browsing.

As far as add-ons go, there is a list of useful add-ons and other advice maintained in the page firefox-tweaks.

For the moment, the measures I know of specifically for Font Fingerprinting are in about:config settings:

  • Right-click and select New > String, creating the new parameter font.system.whitelist, which will list the fonts that JavaScript will see. An example valid value is Helvetica, Courier, Verdana. The change takes effect immediately.
    In my case, this has reduced my own Font Fingerprinting from 266 fonts and 238 unique metrics found in a list of 512 fonts, to "only" 28 fonts and 9 unique metrics. (I have no idea how this would impact browsing.)

  • privacy.resistFingerprinting=true is a general switch to enable privacy measures from the Tor Uplift project as they are implemented. It enables a uniform font list to be distributed. Mozilla does not recommend enabling it since it will break some websites.

  • Disabling the options of "Allow websites to use their own fonts" and the CSS Font Loading API by changing these values:

    browser.display.use_document_fonts = 0
    layout.css.font-loading-api.enabled = false
    font.blacklist.underline_offset = (empty string)
    gfx.downloadable_fonts.enabled = true
    gfx.font_rendering.opentype_svg.enabled = false
    gfx.font_rendering.graphite.enabled = false

    (This will most likely degrade browsing.)

Just to remark that I have seen methods discussed for sophisticated Font Fingerprinting and drawing that could even identify the display card and the graphical driver.

My opinion : It is impossible to avoid fingerprinting - fonts are not everything. Even if you:

  • Use a VPN
  • Do the browsing from a vanilla Windows virtual machine
  • Install no fonts or other software
  • Install the most widely-used browser - Chrome, with no extensions
  • Do browsing in Incognito mode that disables all cookies and extensions

then most likely these unique protection methods, together with hardware elements still detectable in the virtual machine, will still make for a unique or almost-unique fingerprint. Not to mention that this environment will be quite hard to use.

For discussions of some known fingerprinting methods, see the following articles:


In Firefox 28:

Type about:config the location bar

Find plugins.enumerable_names

Set the entry to nothing.

Visit https://panopticlick.eff.org/ to verify plugins are no longer listed.

  • 1
    To white list use this format plugins.enumerable_names: Java,QuickTime,Shockwave
    – Tilo
    Oct 21, 2014 at 16:42
  • To revert this method, change the entry back to *
    – matt.
    Mar 28, 2015 at 18:13
  • 3
    I don't see this setting in FireFox 41. Anyone know where it is now? Oct 18, 2015 at 10:13
  • It seems to be gone for now. Found this: bugzilla.mozilla.org/show_bug.cgi?id=757726 Oct 19, 2016 at 1:16

Javascript has ability to check what plugins are installed, this is generally used to give a "install missing plugin" message if needed. If you want, you could disable plugins in the settings, and disable Javascript using an addon like Javascript Blacklist for Chrome, or Quick Java statusbar for Firefox.

  • Where can you disable plugins in the settings?
    – martineau
    Sep 27, 2013 at 22:34
  • from tools-addons menu.
    – NoBugs
    Sep 28, 2013 at 5:21

Absolutely possible with Proxomitron.

Prox is like NoScript, HTTP LiveHeaders, RequestPolicy, CookieSafeguard, BetterPrivacy, and whatnot, all put into one program. It's not developed further, but still guarantees me privacy no other tool can do.

The Proxomitron is a universal web filter. Info from their site:

The Program

For those who have not yet been introduced, meet the Proxomitron: a free, highly flexible, user-configurable, small but very powerful, local HTTP web-filtering proxy. To become better acquainted, please see our online version of the Proxomitron Help files for a more comprehensive overview.

The current (and last) version of Proxomitron is Naoko 4.5, of which there were two releases, one in May of 2003 followed by one in June. Although very similar, there are distinct differences between the two which are not mentioned in either program's documentation. Both releases are available in the Files section. P.I's focus will be on the latest version -- the June release.

The Author

Scott R. Lemmon originally developed the Proxomitron for his own use. He then decided to release it to the public and made himself available to users via email and in several Proxomitron user-discussion groups. His support, like his program, was always free.

With the release of Naoko 4.5, Scott discontinued all further development and support of his program and pulled the official home of Proxomitron off the Web. We respected his decision to move on and wished him all the best -- which is, after all, what he consistently gave to us.

Sadly, one year later, Scott died -- but his brilliance of mind and spirit lives on. Simply put, Proxomitron is a reflection of its creator: To know Scott's program . . . is to know Scott Lemmon.

Check it out! There's a (somewhat) active community.

  • Wow, people are still using Proxomitron, even with Windows 7, Chrome, etc.‽ ಠ_๏ I guess Scott really did a great job with it. I haven’t used it in a long time; I guess I should get it out.
    – Synetech
    Jan 29, 2013 at 2:54

As of Firefox 17 you can enable 'click to play' which stops Java and Flash loading automatically. This in turn stops a lot (not all) info being discovered. For example, stopping Flash plugin prevents most fonts being discovered.

To enable 'click_to_play' in Firefox:

  • got to 'about:config' in your address bar
  • search for 'click_to_play'
  • double click on the entry to toggle the value from 'false' to 'true'
  • close the tab
  • next time the plugin is required, you will get a prompt giving you the option to enable it
  • Isn't this essentially what the Flashblock add-on accomplishes in many other versions of Firefox?
    – martineau
    Sep 25, 2013 at 9:23
  • This did not work for me.
    – mlibby
    Apr 17, 2014 at 17:08

Solution for latest firefox browsers is to:

  • Use Random Agent Spoofer. It recently added options to turn off plugin enumeration: https://github.com/dillbyrne/random-agent-spoofer/issues/283

  • Or use a user script as shown in Mechazawa's comment in the above link. You can use his Greasemonkey or Tampermonkey script (both firefox and chrome) to take care of this without any extension.

I can confirm that this shows plugins as "undefined" in the panopticlick test.


Even though this is an older question, as of 2017 we are still very concerned about all the information leaked by the browser as they are used for fingerprinting. I find that Random Agent Spoofer (https://github.com/dillbyrne/random-agent-spoofer) mentionned by Spectraljump hits the nail right on the head.

As requested, it will protect against:

  • plugin enumeration
  • will not expose the fonts installed on your machines (which is a more efficient alternative to font-changing tools, like FluxFonts)

Also, it will provide options to protect you from:

  • most other fingerprinting tools
  • will let you disable webRTC, webGL, local cache, and more.

If you throw in a canvas fingerprinting randomizer (such as Canvas Defender), you will find yourself protected against pretty much everything detectable on browserleaks.com and Panopticlick.

Finally, make sure to use a VPN with DNS leak protection, to close the loop.

An alternative solution, although less convenient, is to use a generic vanilla (most common OS, with nothing custom installed) VM for all browsing activities and reset it after each session.


You can use gologinapp for this, for example

  • Welcome to Super User! Please read How do I recommend software for some tips as to how you should go about recommending software. You should provide at least a link, some additional information about the software itself, and how it can be used to solve the problem in the question.
    – DavidPostill
    Dec 30, 2019 at 22:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .