I'd be interested in a viable example of this being used to identify users.
I think he is saying that users can't be tracked between page-loads using this method, or your risk sending multiple users the same token. (which is true, at least with this implementation)
The time they spend on the website, latency, etc can all be used to add to a fingerprint, but there isn't something magic that makes this accurate, especially without JavaScript.
Edit: please don't mind me ghostposting kthx
> It is ideal for getting basic usage statistics on the Tor network, where JavaScript is not an option for most users.
NoScript can block iframes; will that disable this tracker?
Also, does the Tor Browser, which includes NoScript, default to blocking iframes?
No. Tor Browser defaults to the lowest security level, allowing all scripts, media, iframes, etc.
Just turned that option on, myself. I might have had it on years ago--can't remember for sure--but now that I know it's being abused, I'll definitely leave it on. IFRAMEs are generally poor practice, anyway.
accessibility.blockautorefresh
noscript.forbidBGRefresh
noscript.forbidMetaRefresh
Additionally, you can cherry-pick options (or just use it all) from this repository at https://github.com/pyllyukko/user.js for more privacy.
With Google Analytics you have the option to actually do all the tracking server-side so AdBlockers shouldn't be an issue tracking-wise.
The "virtually invisible frame loading in the background" trick is going to be around for a long-term and seems destined to be re-learned many times over.