Wondering about screen.js and the CSS check

[Aperico-com]

I am writing a Chrome extension that spoofs screen width/height. It is not detected on the main page but on screen.js in the docs/test/ the CSS test detects it as false for @media search and @media device. To me it seam impossible to fool that test since you have to manipulate how the @media get the device screen width/height under the hood (at least for an extension). Maybe there is some way??

Looking at the code in screen.js it seems to be pretty expensive to test it this way, do you think it is used in production by any site? I am debating with myself if I should just skip spoofing the screen or leave it in and hope this test is not used on sites.

[abrahamjuliot]

The test page is indeed less responsive and would not provide a great experience. The screen resolution is not incredible for desktops and may not be worth it, but it can be fun to annoy some trackers. Just don't expect anything to fool more advanced systems. It's not possible to be completely stealth.

[Aperico-com]

Thanks for getting back to me, and for this great resource! "Just don't expect anything to fool more advanced systems" - I have seen a couple other people say the same thing. I am very curious of these advanced systems, and who are using them? Do you have any example?

And, when you say fool, do you mean that they can detect tampering or that they can actually see my actual fingerprint (with regards to device, browser, locale etc)

Should I expect that the various paid antidetect browsers cannot do this either? (Incognition, multilogin, gologin etc)

[abrahamjuliot]

advanced system

No examples, but I recommend checking out Cloudflare's illustrations here.

detect tampering vs recovering actual fingerprint

It's possible to infer or predict the real screen, region, hardware, etc., but that's not required. It's more important to control and normalize the entropy to ensure consistent tracing. Circumventing this tracing is not possible.

antidetect browsers

Changing values at the engine level is going to face similar challenges as changing values via JavaScript. I believe most of those provide some warnings when changing too much info about the fingerprint.