Expand the section on randomness and update it.

[tomrittervg]

I don't have a high opinion of randomness. I give a lot of props to Brave for really bringing the technique forward, and Tor Browser pretty shameless copied the idea implementing a simpler version because of its unique situation. (Although this bug is on the Mozilla bugtracker, it was implemented by Tor Browser volunteers and not on Mozilla time, as well as not being used in any supported Firefox mode.)

Eventually, Firefox copied Brave more closely and implemented the 'randomize a few pixels' technique. It's not been great - Tor Browser, Brave, and we have gotten lots of confused bug reports about this weird behavior, we've had performance issues (randomizing Google maps on an older computer), we've had gaps in our implementation (e.g. Service Workers weren't randomizing), we've experienced straight website breakage (if Google Meet didn't get a specific value from a canvas, it completely blocked you), and we know that FingerprintJS detects the randomness and ignores it when its present.

It's kind of useful against naive fingerprinters I suppose, but it's been 5+ years since it came on the scene and I think most fingerprinters are either not naive anymore, or are well aware of it and for whatever reason haven't bothered to (visibly) do anything about it.

I know Brave randomizes a few things; we have focused mostly on canvas. My more recent focus has been simply making canvas deterministic. Software rendering, adjusting OS settings if necessary to collapse different rendering buckets, etc. I don't have concrete results to show yet, but regardless if whether that endeavor is fruitful my opinion has soured on randomness. As salt in the wound, if you use randomness, any user who decides to test two browsers side by side comes away thinking "Wow if I use X I'm unique, but if I use Y, I'm not!"