(C) BoingBoing
This story was originally published by BoingBoing and is unaltered.
 . . . . . . . . . .



Tor Browser's "New Identity" button didn't actually reset your fingerprint [1]

['Ellsworth Toohey']

Date: 2026-04-28  

Tor Browser has a "New Identity" button that's supposed to give you a completely fresh start — like opening a brand-new browser with no memory of what you were doing before. But it turns out it didn't fully do that.

Researchers discovered that a built-in browser feature (called IndexedDB, which websites use to store data on your device) could leave behind a kind of hidden "fingerprint." This fingerprint wasn't erased when you clicked "New Identity."

The problem came from how the browser listed stored data. Instead of using a consistent order (like alphabetical), it returned the list in a quirky but repeatable order. That order acted like a unique signature.

This meant different websites could quietly compare notes. Even without cookies or trackers, they could recognize that the same person had visited both sites, simply by looking at this hidden pattern.

Worse, this fingerprint stuck around longer than it should have. In Tor Browser, even hitting "New Identity" didn't clear it.

The good news: the bug has been fixed. The solution was simple — just sort the data alphabetically before sharing it. That removes the unique pattern, and with it, the ability to track users this way.

[END]
---
[1] Url: https://boingboing.net/2026/04/28/tor-browsers-new-identity-button-didnt-actually-reset-your-fingerprint.html

Published and (C) by BoingBoing
Content appears here under this condition or license: Creative Commons BY-NC-SA 3.0.

via Magical.Fish Gopher News Feeds:
gopher://magical.fish/1/feeds/news/boingboing/