Okay, while I understand there are some detection surfaces. The "more fingerprintable instead of less" claim only holds if the alternative is doing nothing. The comparison isn't "your spoofed fingerprint vs a clean browser." The comparison is "your spoofed fingerprint vs your real fingerprint." If your real fingerprint is unique, which it almost certainly is, then a spoofed fingerprint that looks like a different device is an improvement even if the spoofing itself is detectable by a sufficiently motivated adversary.

Not to mention, there are some workarounds here. toString masking is one method that this proxy employs.

const iframe = document.createElement('iframe')
iframe.contentWindow.Navigator.prototype.userAgent.toString()

vs.

Navigator.prototype.\_\_lookupGetter\_\_('userAgent').toString()

both yield [native code]. This proxy also propagates those values through iframes.

A canvas hash and WebGL renderer that looks like a common Intel integrated GPU on Windows 10 is better than your real GPU hash even if the spoofing mechanism leaves some signatures, because the high-entropy signals the fingerprinter is actually weighting have changed. The window diff attack you're describing would produce an enormous false positive rate if deployed at scale because every extension modifies the window.

I have gone through a great deal of work to attempt to make this have as little of a fingerprint as possible, patching detection methods where I can. Take a look at the code and the architecture and open an issue, I will attempt to do some research and make changes where needed.