Comment by laken

Wow, that's quite the vulnerability.

Several years ago, the FBI used JS-based identification scripts on an entire hidden-service hosting service to identify visitors.

https://www.wired.com/2013/09/freedom-hosting-fbi/

I wonder if it's already being used in the wild by governmental agencies.