If you’re ESL, that’s not an excuse. You can write something in your own language and use a translator or even an LLM to translate it.
But using an LLM to write is delegating your cognition to a machine. At that point, you’re acknowledging that your own cognition has no value, so why are you trying to inflict a faked version of it on the rest of us?
That panel reconstructs what a pixel would send from your own browser values, locally, and never makes the request. NextDNS seeing nothing is the tool working exactly as designed.
It's horrifying to see that our browsers give up anything at all. I feel like we need a new model where we just get served the content, and we don't serve up anything to the content provider. I feel ill.
How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nails.
Sure, but that doesn't really apply to fingerprintable info like viewport size (should all sites render at the same imagined size and make you resize the window so they fit?), I/O device availability, GPU features, etc. These are things you can't just make assumptions about. Not comparable to a missing plugin. (And for what it's worth, sites did plenty of plugin sniffing!)
Right, but the client side did a query to see what was available and gracefully displayed a message. People are now sending the truthy response of the feature's availability back. You could be doing that as a legit bit of logging, or you could be doing that to be an asshat and deanonymize the user. The browser doesn't know the intent of being asked about a feature. And yes, it has been figured out just fine as a way for making someone money by selling information about you
And what about SWE from outside whatever jurisdiction that body issues those licenses? You cannot regulate your way out of tech problem if everyone is not subject to said regulations. Why people keep making comments like this is beyond me.
Another one is "draw text, read back pixels" which is simultaneously a really effective fingerprint, and also cuts to the core of what we want a web browser to do. We can't refuse to draw text.
Not usually, if you're comparing it to IPv4. Many ISPs give each customer a persistent IPv4 address that doesn't tend to change over time. Because most people use NAT (internal IP address != external IP address), a server you connect to can't identify the specific computer or device.
With IPv6, it's true that in many cases servers will see you as connecting from the specific IPv6 address of your computer/device. However, IPv6 addresses contain many parts, like:
2001:db8:1234:5600 : abcd:1234:5678:9abc
where the left part is basically the equivalent of the unchanging IPv4 address you got from the ISP, and the right part identifies your specific device. But in most OSes the right part is randomly generated and changes on some cadence (e.g. daily).
So in many cases, the ability for a server to individually fingerprint your device solely based on the IP address is roughly equivalent between IPv4 and IPv6. (This isn't the case if the ISP does CGNAT on IPv4, where you're sharing your IPv4 address with many customers - this would be similar in magnitude to a VPN in terms of the ability for a server to fingerprint you based on IP.)
>But in most OSes the right part is randomly generated and changes on some cadence (e.g. daily).
>So in many cases, the ability for a server to individually fingerprint your device solely based on the IP address is roughly equivalent between IPv4 and IPv6.
That still makes ipv6 strictly worse, if you consider that a device is always uniquely identifiable at any given time, whereas with ipv4 NAT they can't be individually identified.
Fascinating visualization , as someone building productivity extensions, it is always sobering to see exactly how much surface area the browser exposes.
It's worth noting that you need both uniqueness and some form of stability. If you consistently show up as a diffent fingerprint every time you visit or for every different site, then that is a form of privacy as well.
I just downloaded a fresh install of LibreWolf to test this and it did indeed have a stable UUID for me at 1/62E6. Better than the 1/680E6 from regular Firefox, but still upsetting. Fonts and Audio fingerprinting seems to be where a lot of the entropy is coming from... Even after I enabled some of the flags to resist font enumeration it still is stable and high entropy. I'm not sure what to do to be honest about this, it is very discouraging.
Cool tool, but the language is painfully characteristic of AI. Maybe we are collectively getting over caring about that, but if not, it's worth a pass of "make this sound a little less like AI."
I was >60% sure it would be AI given the combination of calendar year and the wording "what the browser reveals" that I saw on the HN front page - and only when I clicked did I realise how wrong I was, because the actual probability is 100%.
(Not to suggest that browser fingerprinting isn't a useful issue to highlight.)
It's using all the Claude fonts, it's got the Claude pulsing indicators, it's got the Claude cards, and none of the writing is useful. This has gotta be up there with one of the most Claudey Claude sites I've ever seen
Fun fact: some malware won't execute if it sees a Russian/Ukrainian keyboard layout, because the authors avoid hitting victims in their own jurisdiction.
“ Your browser fingerprint appears to be unique among the 311,902 tested in the past 45 days.” yet every cloudflare protected website blocks me, random human checks and also my bank and government is blocked. Mmmmm grain of salt?
I think you have it backwards - Cloudflare et al would want to allow the typical user and block the oddballs.
That said, it's a further misunderstanding with utilizing such tools in general. Unique is neither good nor bad on its own. The next question is "always the same unique because that's all you share or always unique because certain fingerprintable attributes are randomized over time/visits/sessions". I.e. it's a war between trying to fake an average enough fingerprint and trying to track someone through partial matches, not just a matter of "is the fingerprint unique".
uniqueness, on one way or another, does not imply you're a real person.
those systems probably don't even rely on fingerprinting for those decisions - you just can't deny someone acceess to a service because "they're unique", you're opening a can of worms.
entities that do deny access based on fingerprinting actually do it based on same fingerprints corresponding to a marked visitor (like checking behaviour and marking all subsequent visitors with that fp as bad) - but it's a headache.
what you describe usually has more to do with your IP (range, usage type, country), your useragent or added/modified headers (check any extensions that do this)
i had exactly this happen some years ago when i added a `'` in the UserAgent to test a site for SQL injection and forgot to remove it.
Could be bad IP rep. Cloudflare isn't about uniqueness, it's about a reputation score. Presumably some overlap but not necessarily identical.
I started getting those more often when I moved 2 years ago and switched from Charter cable to AT&T fiber. The same hardware was transported 2 miles away...
So it tells me I’m unique and it can track me across different browsers. It also tells me that in a different browser with a different fingerprint. Even private browsing shows more unique fingerprints that are completely different. I don’t think this site is very useful except looking at fancy data.
Well I'll following basically every step of the provided guide (more or less bog standard Firefox on a Pixel with strict tracking protection) and then it says 91℅ identifiable. A lot of the information towards the bottom doesn't make sense and the Claude slop fails to clarify it. I wish this actually made it clear what it is here that's uniquely identifying, because surely every other pixel is reporting the same screen and gpu and whatnot.
69 comments
[ 1.2 ms ] story [ 44.4 ms ] threadIf you’re ESL, that’s not an excuse. You can write something in your own language and use a translator or even an LLM to translate it.
But using an LLM to write is delegating your cognition to a machine. At that point, you’re acknowledging that your own cognition has no value, so why are you trying to inflict a faked version of it on the rest of us?
Seems more plausible that anti-fingerprinting is throwing it off?
I know this computer has more RAM than reported and it's definitely not on a 4G network either.
(I'm not sure if that's true, but I hope so)
The population on Earth is ~8.3 billion. I find it hard to believe it's that unique. Nothing in the data looked particularly interesting.
Maybe slightly plausible if you take into account the currently assigned IPv6 although that's largely time bound.
With IPv6, it's true that in many cases servers will see you as connecting from the specific IPv6 address of your computer/device. However, IPv6 addresses contain many parts, like:
where the left part is basically the equivalent of the unchanging IPv4 address you got from the ISP, and the right part identifies your specific device. But in most OSes the right part is randomly generated and changes on some cadence (e.g. daily).So in many cases, the ability for a server to individually fingerprint your device solely based on the IP address is roughly equivalent between IPv4 and IPv6. (This isn't the case if the ISP does CGNAT on IPv4, where you're sharing your IPv4 address with many customers - this would be similar in magnitude to a VPN in terms of the ability for a server to fingerprint you based on IP.)
>So in many cases, the ability for a server to individually fingerprint your device solely based on the IP address is roughly equivalent between IPv4 and IPv6.
That still makes ipv6 strictly worse, if you consider that a device is always uniquely identifiable at any given time, whereas with ipv4 NAT they can't be individually identified.
In a private Safari window, it's not even stable across reloads.
E.g., the guide page ends with
> The honest bottom line. Perfect anonymity [...]
(Not to suggest that browser fingerprinting isn't a useful issue to highlight.)
https://news.ycombinator.com/item?id=48727059 [flagged] What any website can see about you
https://news.ycombinator.com/item?id=48062178 A web page that shows you everything the browser told it without asking
https://news.ycombinator.com/item?id=49182352 Show HN: Modern Browsers Don't Need the Cookie Anymore
https://news.ycombinator.com/item?id=46517654 [flagged] Show HN: DevicePrint – device fingerprinting without cookies
https://news.ycombinator.com/item?id=46037031 Show HN: Explore what the browser exposes about you
https://news.ycombinator.com/item?id=45169286 Browser Fingerprint Detector
https://news.ycombinator.com/item?id=49359153 A live browser fingerprinting and bot detection playground
https://news.ycombinator.com/item?id=46674460 Show HN: Anti-Detect.com – Browser Fingerprint Scanner
There are definitely more! Could this be HN's favourite prompt?
That said, it's a further misunderstanding with utilizing such tools in general. Unique is neither good nor bad on its own. The next question is "always the same unique because that's all you share or always unique because certain fingerprintable attributes are randomized over time/visits/sessions". I.e. it's a war between trying to fake an average enough fingerprint and trying to track someone through partial matches, not just a matter of "is the fingerprint unique".
those systems probably don't even rely on fingerprinting for those decisions - you just can't deny someone acceess to a service because "they're unique", you're opening a can of worms.
entities that do deny access based on fingerprinting actually do it based on same fingerprints corresponding to a marked visitor (like checking behaviour and marking all subsequent visitors with that fp as bad) - but it's a headache.
what you describe usually has more to do with your IP (range, usage type, country), your useragent or added/modified headers (check any extensions that do this)
i had exactly this happen some years ago when i added a `'` in the UserAgent to test a site for SQL injection and forgot to remove it.
I started getting those more often when I moved 2 years ago and switched from Charter cable to AT&T fiber. The same hardware was transported 2 miles away...
Idk how this vibe coded slopware made it to the front page of HN
I always knew I was so unique