Try refreshing the page. Clear the cookies. Connect to a VPN.
You’re motionless the ….
Now open it on your phone or several another equipment and your nickname volition be distinct and fair as consistent.
Is it distinct in incognito? Good. But it’s continually the same? Bad news.
Imagine this:
Most websites you sojourn get paid to display ads and indirectly run my manuscript that lets me cognize you’re the …. I can use it to decide what ads you’ll see. But additional importantly, if you’ve made an document on that website, I can recommendation to buy your data - any they can portion under their privacy policy: your name, activity, conversations alongside AI…
Pretty shortly I’d cognize additional concerning you than your allies do - perchance additional than you cognize yourself.
“So what?” - you say.
“I have nothing to hide. And I favor my ads to be relevant… sometimes they display me exactly what I need! And the data is anonymised anyway…”
See, the item is, it’s not concerning you at all. It’s not really concerning the ads anymore either. Nobody cares concerning you. And if the constabulary or your authorities happen to care, I’ll gladly obtain their prosperity too.
I appearance at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal province of the economy, community and individual psyche. The gemstone domain of the 21st hundred years and it’s made of silicon! That’s the product.
And to the highest bidder it goes!
What does that create you then? A gear? An ox? A volunteer?
Remember the big bother concerning third-party cookies? It was so big that the EU had already rolled out one of its top inventions - consent banners.
If EU ships faster than tech companies, that can lone average the tech companies are sitting on their hands. And one of those tech companies happens to clasp two-thirds of the browser market.
What was the play?
Let’s provision it up for Google - the biggest ad business on Earth!
ACT I. PRESSURE - “PRIVACY IS PARAMOUNT TO US, IN EVERYTHING WE DO.”
It’s 2019 and the cookies are motionless hot. It’s rotate into bad PR and Safari and Firefox already obstacle them.
A twelvemonth afterward Google pledges: we volition demolish cookies!! And established a new, privacy-first reign.
ACT II. DISTRACTION - “INSTEAD OF DEPRECATING THIRD-PARTY COOKIES, WE WOULD INTRODUCE A NEW EXPERIENCE”
5 years later: group are now preoccupied alongside far greater worries than cookies, and the solutions Google has developed (Privacy Sandbox) kinda suck and have raised antitrust concerns so nobody uses them.
“You cognize what, let’s fair keep the cookies. We’ll disguise your IP address* though!” (* but lone whenever incognito during authenticated) (** in the end they didn’t equal provision on that)
ACT III. ACCELERATION - YOU CAN NOW USE DEVICE FINGERPRINTING IN OUR AD PRODUCTS
Now there’s a improved way to cognize who’s who!
Nice, let’s nerd out properly.
You sojourn a website. Your browser sends a petition to the server and the server returns code for the browser to run.
The petition already reveals data concerning you; what browser you use, the tongue it’s in, the OS that runs it and your IP address, which the server needs to dispatch you the response. That frequently reveals your location.
Then the code runs.
See, we’ve made a lot of civilizational advancement in making browsing safe. Long gone are the days whenever getting a microorganism fair by visiting a website was a regular concern. The item is, the definition of safety varies depending on who you ask. The broad agreement ends at isolation: a website’s code can’t see the data stored by another websites, and it can’t see your records or another applications without permission. Chrome and Edge halt here. Then you have Safari (especially on iOS/macOS 26+) and Firefox extending that definition to privacy, but they motionless don’t completely defend you from fingerprinting. Brave and Tor are the foremost privacy-first browsers, alongside up and coming Mullvad Browser (Mullvad being, in my opinion, among the finest VPN providers out there).
The code runs on your hardware, which can be measured in ways that create accordant and distinctive readings. There’s not much that can be done concerning this really, so there’s lone two established solutions:
- feed a small bit of noise current and there. It’s called farbling and that’s what Brave does to create your fingerprint inconsistent.
- make everything appearance the same, always, so there’s no telling browser users apart. Tor and Mullvad clasp this approach.
Ok, let’s create a fingerprint
So there are two sources for data that can create up your fingerprint; the network petition and the code environment.
When you appearance at network, the data is mostly either susceptible or generic:
- the IP address; in a ‘happy path’ anywhere one individual continually uses the identical IP address, it power be the lone data you need. But commonly group do a lot of browsing on mobile networks, they portion the WiFi alongside others, they use VPNs or their residence network’s IP location is rotated by the ISP. It’s susceptible as such.
- headers akin User-Agent or Accept-Language; disclose your browser, OS, versions and the tongue set.
When you can execute code on the device, you have ways to measure its hardware qualities (without any approval prompts!) and these are amazingly stable:
- GPU; behaviour, vendor, driver
- CPU; behaviour, vendor, figure of threads
- memory size
- display data; resolution, pixel ratio, refresh rate
- audio processing
- device model
And on the application level; installed fonts, extensions, scheme info…
Millions of devices use the latest Chrome, there are millions of Macs alongside the M4 part and there are millions of browsers in French.
But whenever you appearance at devices that run the latest Chrome in French on an M4, that figure now drops significantly. Add to it hardware measurements and it gets so low it becomes practically unique.
The fingerprint doesn’t need to be truly, globally distinctive - it fair needs to be distinctive adequate to inform group distinct in your example size.
A ZIP code (inferred from IP), a birth date (you’ve stated distant on several platform) and sex (you inhabit it in everywhere) together are adequate to uniquely acknowledge complete 60% of Americans.
You can continually add another changeable to decrease the possible pond of candidates.
Information Entropy
Have you always played Akinator? You think of a character, a soul asks you several twenty questions, and somehow it knows. That’s fingerprinting in a nutshell, apart from your browser answers the questions for you. Once you comprehend data entropy, Akinator’s magic turns into a uncomplicated trick.
Let’s simplify alongside that equivalent anywhere you have to conjecture the character on a commission through questions akin “Is my character a man?”. If I say “yes”, and fractional of the characters on your commission are men, you’re now considering lone fractional of the total candidates. Now we can say that my answer gave you log₂(100 / 50) = log₂(2) = 1 bit of information, since it cut the pond of candidates in half.
The bits you get from one answer are called its surprisal: the rarer the answer, the additional it tells you.
- a trait shared by 1 in 2 group is value 1 bit (is a man),
- 1 in 8 is value 3 bits (has a mustache),
- and 1 in 128 is value 7 bits (has one eye).
Surprisal quantifies the value of the answer, and entropy quantifies the value of the question. If 1 individual in 128 is one-eyed, afterward asking concerning it volition output ‘no’ 127 times in 128.
| Answer | Probability | Surprisal | Entropy contribution |
|---|---|---|---|
| Yes | 1/128 | log₂(128 / 1) = 7 bits | 1/128 x 7 = ~0.055 |
| No | 127/128 | log₂(128 / 127) = ~0.0113 bits | 127/128 x 0.0113 = ~0.011 |
Summing up the contribution of all imaginable answer, the inquiry itself is value ~0.066 bits of entropy - that’s the average amount of bits you acquire from an answer.
When we merge traits that are independent we merely add up their bits or multiply the ratios, so a man alongside a mustache and one eye would average 11 bits, or 1 in 2048. Alas, as Thomas Bayes would have you know, nothing is always so uncomplicated in practice. A mustache is already a powerful indicator of a man, and a man is likely additional apt to have one eye. The traits are not autonomous so the bits don’t really add up.
Some engaging applications of this category of reasoning:
- In medical diagnostics: A affirmative outcome from a 99% exact test for a sickness known to power 0.01% of the community is concerning 100 times additional apt to be incorrect than you are to have the disease. You need additional evidence!
- In cryptography: A password made out of four random words is as powerful as eight random keyboard characters (but much easier to remember!)
- In forensic science: singling out one individual in a city of a myriad takes concerning 20 bits. A observer clarification that matches 1 individual in 1,000 provides lone 10 bits, which motionless leaves a thousand imaginable suspects.
Test your browser:
- coveryourtracks.eff.org shows you how distinctive your fingerprint is, alongside entropy for all measured data point.
If you’re using Chrome you’re basically strolling about alongside an ID on your forehead.
Safari and Firefox recommendation several flat of protection, but you’re motionless identifiable by advanced trackers.
Brave, Tor and Mullvad Browser are the lone important browsers at the instant that execute advanced protections against fingerprinting.
If you don’t awareness akin switching browsers, I get it. I am a big Arc fan myself and unfortunately it’s discontinued and volition never have any privacy features. There are extensions akin JShelter - they disrupt fingerprinting scripts by intercepting browser API calls. But they additionally interrupt several websites. Same issue applies to Firefox’s Resist Fingerprinting feature.
The ironic fact is, privacy extensions create you additional unique, since small group have them. So a astute tracker could detect that, disregard the signals disrupted by the expansion and concentration on the ones that are not.
No expansion can be as productive as engine-level protection built into the browser. So if you don’t desire to be tracked, you have to commit.
methods used on this page
I’m merely creating a hash out of a few measurements of your device. Any of these alter and the hash is now different. Professional applications are much additional complex than this and are capable to keep acknowledgment row whenever sole variables change.
-
OfflineAudioContext
Renders a abbreviated spirit through a compressor without playing it; small drift differences in the outcome depend on your browser’s audio motor and your CPU.
const off = new OfflineAudioContext(1, 5000, 44100); const data = (await Promise.race([off.startRendering(), timeout])).getChannelData(0); let sum = 0; for (let i = 4500; i < 5000; i++) sum += Math.abs(data[i]); return sum.toFixed(3);
-
WebGL
Reads your GPU’s vendor and example (without type numbers), what the GPU and its controller support, and the pixels of a small rendered triangle.
const gl = document.createElement('canvas').getContext('webgl'); const dbg = gl.getExtension('WEBGL_debug_renderer_info'); return gpuName(gl.getParameter(dbg ? dbg.UNMASKED_RENDERER_WEBGL : gl.RENDERER) || ''); return fnv1a(new TextEncoder().encode([...(gl.getSupportedExtensions() || []).sort(), ...limits, ...precision].join('|'))); gl.drawArrays(gl.TRIANGLES, 0, 3); gl.readPixels(0, 0, canvas.width, canvas.height, gl.RGBA, gl.UNSIGNED_BYTE, px);
-
canvas
Draws content in a few fonts, emoji and a gradient, afterward says the pixels back; anti-aliasing and font rendering depend on your OS, GPU and fonts.
ctx.font = '15px "Times New Roman", serif'; ctx.fillText('Sphinx of dreary quartz 🦊', 4, 22); const data = ctx.getImageData(0, 0, 240, 60).data;
-
Intl
Your period area and your date and figure settings; a VPN changes your IP location, but not your period zone.
const date = Intl.DateTimeFormat().resolvedOptions(); return [date.timeZone, date.locale, date.calendar, date.numberingSystem, hourCycle, (1234567.891).toLocaleString()].join('/');
-
navigator
Your figure of CPU cores, your recollection size (Chrome only) and your browser’s language.
return [navigator.hardwareConcurrency, navigator.deviceMemory, navigator.language].join('/');
-
crypto.subtle
Hashes all the values alongside SHA-256, and the hash picks a trait and an animal for your nickname.
const digest = await crypto.subtle.digest('SHA-256', bytes); nickname: alien || `${pick(TRAITS, hex, 0)} ${pick(ANIMALS, hex, 8)}`,
