Hi HN,
I’ve been experimenting with ways to reduce my browser fingerprint and exploring techniques to anonymize fingerprint data.
So I built this.
This is kind of like a lighter, more thorough version of CreepJS but entirely client side. I don’t maintain massive lists of time zones or do server-side comparisons to calculate uniqueness. Instead, it automatically surfaces everything a browser exposes, explaining each item in detail.
I'm really frustrated with these types of websites because they tell me nothing.
What I'd love for these sites to do is help me understand where I am distributionally. How unique am I? On what? Help me understand what needs to be fixed and what my threat vector is.
The problem with these is that I'm always unique. Doesn't matter what browser I'm on or what. If I am unique on a clean Apple laptop in either Safari or Chrome then it is essentially meaningless. I got controlled hardware and vanilla software, how else do you blend into the crowd?
But in the wild sites aren't always implementing all these features. So I want to see if I'm unique to standard site or even one that is a bit more heavy. Importantly HOW unique am I? What things am I not unique, how unique am I, and what are the most unique things about me?
Having that information gives me the ability to do something about it. Without that information then this is just like any other website where essentially the message is "be scared! People can track you on the internet and there's nothing you can do about it!"
> What I'd love for these sites to do is help me understand where I am distributionally. How unique am I? On what? Help me understand what needs to be fixed and what my threat vector is.
This EFF tool does this https://coveryourtracks.eff.org/
Thanks, I forgot about that one.
To critique that (and maybe suggest what OP can do to make theirs better) is that there's poor visualization. What's great is that it tells me there right in center
But give me some visualization. Sentences like> Our tests indicate *that you have **strong protection against Web tracking***. > Blocking tracking ads? Yes Blocking invisible trackers? Yes Protecting you from fingerprinting? Your browser has a nearly-unique fingerprint
Are not super helpful, though they should exist. Showing a density plot[0] is very useful[1]. It gives the user more information, telling them where they need to go. Even a simple replacement toBits of identifying information: 6.76 One in x browsers have this value: 108.61
Makes things easier to read.One in *108.61* browsers have this valueIn an ideal setting I think the site should suggest to users what they should change and show them where they could be with the new settings. Letting them play around and adjust a some settings.
I know I'm being nitpicky here and to be honest I think the EFF version is "good enough" but I still think adding such visualizations and letting users "see" the results makes things easier to understand and can help them know what to do.
[0] https://seaborn.pydata.org/generated/seaborn.kdeplot.html
[1] In this case it isn't going to be continuous since I pulled from the User agent so this will have more discrete bins. Helping inform the user would be seeing the proportion of those other bins. That way they know what to change their user agent to!
It would be nice if they (or someone) could list ways to mitigate against each of these information leakages. Or even nicer if someone made a plugin that make us unidentifiable. Even nicer would be a way to e.g. disable sharing which fonts, extensions, etc. I have installed. Why do webpages even need to know such details? What if our browsers just sent Firefox vN instead of this huge string? Why does a webpage need to know how many CPU cores I have, or, let's say I have > 4, that should be sufficient to run any webpage and anything > 4 could just be reported as 4. If they don't know these things, I assume webpages/frameworks will still work fine.
You're 100% right. The raw fingerprint dumps alone are not actually useful unless you can compare them to a population.
And creating that comparison is far harder than people think. To answer "How unique am I?" I need a large, representative dataset of fingerprints collected over time and ideally weighted by how often real websites use each feature. That would require running an backend and database.
It’s something I’d like to build eventually, but only in a privacy-preserving, opt-in way that aligns with the spirit of the project.
I know I'm criticizing, but I do also want to make sure to say good job. I don't want to make it seem like I'm unhappy, if that makes sense.
For privacy prevention, maybe you can help me understand something better then. I was under the impression that for the most part, each fingerprinting technique itself was not enough to identify someone, but it is the collection of them. So in that setting, would not showing the distribution of the individual metrics likely preserve privacy? I can certainly see some subtle naive trap existing here that I'm not aware of but do you know of one? I at least would think things such as agent, dark mode, and some other things shouldn't risk deanonymization. Though clearly things like coordinates, unique fingerprints, and probably even the canvas fingerprinting shouldn't be shared. As long as each data point isn't associated with others and you have a decent sample size. But also I'd love to learn if I'm missing something important.
amiunique.org shows percentages of values
Hi, thank you for going through the trouble of putting this together. This sort of service is invaluable as it allows us clueless people to be mindful about something that negatively impacts our life.
Here's a suggestion: it's important to show us that our browser footprint allows us to be positively identified and tracked, but it only alerts us to a problem. It would be very useful if the site also provided some tips to improve anonymity, particularly if it's low-effort changes such as tweaking a couple of config changes.
There's a mis-understanding of at least the Graphics part. For example WebGPU features. It looks like lots of info
But, they are bucketed
https://www.w3.org/TR/webgpu/#privacy-considerations
It's not zero pieces of info but it's also not close to as bad as it looks. Effectively, everyone who has, say an NVidia GPU, will likely have the same list of features and limits.
As a more general example: The number is just a flat out wrong
> Unique to 1 in 2,147,483,648+ devices.
No, I have an iPhone Pro and am in the PST time zone, set to English. It has the exact same finger print as millions of other devices among the 40 million people in the PST time zone. In general, The only things different between 2 iPhones of the same model are time-zone, laguange setting, and font size.
Please STOP EXAGGERATING!
Beyond the obvious IP address difference, there are other way to fingerprint you, see https://coveryourtracks.eff.org/ which will actually provide details about how you're a special snowflake, tracked by advertisers.
that site is just as bad at giving probably false numbers that are several orders of magnitude off
> No, I have an iPhone Pro and am in the PST time zone, set to English. It has the exact same finger print as millions of other devices among the 40 million people in the PST time zone.
Your IP address, ASN, and location make this not true.
Those have nothing to do with "what the browser exposes". They are exposed regardless of what you use to connect.
But the browser knows them too and the site can get you to reveal it, even behind a vpn.
You’re quite welcome to not believe what everyone is telling you.
> This is kind of like a lighter, more thorough version of CreepJS
you walked right by the chance to call it WeirdoJS