Cue them saying something along the lines of “our goal is to prevent tracing, not fingerprinting”. But I hope they’re hard at work on a fix regardless.
Torbrowser includes patches to Firefox that make it more difficult to fingerprint individual machines, however this is at the expense of making it trivial to identify as Torbrowser when javascript is enabled. It doesn't appear possible to fix.
Also, the requests seem to come from a node exit IP, which are public, so identifying a Tor user is easy.
Tor provides anonymity by giving all its users the same fingerprint. The fact that you're using Tor isn't a secret.
About the Tor version number in window.navigator, I guess they can't easily block it since the browser itself leaks some information via the features added in each release (e.g. a new JS API introduced in Firefox XX).
Strangley, the tor site at one point mentions having javascript enabled by default. As far as I know, that is a no no for anonymous browsing using tor. But it also breaks most sites so there are not many times I actually use it. Even with javascript enabled, I'm sure you can still do a fair bit of anonymous browsing but I just don't trust java or the internet.
