It's horrifying to see that our browsers give up anything at all. I feel like we need a new model where we just get served the content, and we don't serve up anything to the content provider. I feel ill.
How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nails.
In the old days, we just sent the content and let the client figure out what to do with it. If you navigated to homestarrunner.com and you didn't have flash installed, you just got a message saying to install it, or worst case, a broken icon in a frame.
Cool tool, but the language is painfully characteristic of AI. Maybe we are collectively getting over caring about that, but if not, it's worth a pass of "make this sound a little less like AI."
It's worth noting that you need both uniqueness and some form of stability. If you consistently show up as a diffent fingerprint every time you visit or for every different site, then that is a form of privacy as well.
I just downloaded a fresh install of LibreWolf to test this and it did indeed have a stable UUID for me at 1/62E6. Better than the 1/680E6 from regular Firefox, but still upsetting. Fonts and Audio fingerprinting seems to be where a lot of the entropy is coming from... Even after I enabled some of the flags to resist font enumeration it still is stable and high entropy. I'm not sure what to do to be honest about this, it is very discouraging.
The APIs it's relying on to show you that information do implement some anti-fingerprinting mechanisms - things like available memory will be put into rough buckets rather than returning the exact amount you have.
Fascinating visualization , as someone building productivity extensions, it is always sobering to see exactly how much surface area the browser exposes.
I built this after a thread here about Alibaba using an audio-context trick to
fingerprint visitors. I knew a fair number of fingerprinting methods but not that
one, and I wanted to see all of them in one place, running against my own browser.
GlassBox runs ~31 probes (canvas, WebGL/WebGPU, audio, fonts, the WASM feature
set, math/engine quirks, WebRTC IP, timezone/locale, the permission and API
matrices, an incognito heuristic, cross-site login-state, and so on) and shows the
raw values plus an estimate of how identifiable you are.
A few deliberate choices:
- One static HTML file, no dependencies, no build step. Everything runs
client-side and nothing is sent, with one opt-out exception: IP geolocation,
which calls a public API. I didn't want a privacy tool that phones home.
- The "identifiability" number is an honest model, not a measurement. It sums
published per-signal entropy (Panopticlick / AmIUnique / Cover Your Tracks),
discounts signals your browser masks, and caps at the ~33 bits needed to single
out one person on Earth. A no-server tool can't compute true rarity against a
live population, so I label it an estimate instead of pretending. For real
population numbers, Cover Your Tracks and AmIUnique have the datasets.
- There's a companion guide on lowering your fingerprint, with the caveat that
uniqueness isn't privacy: blending into a big crowd (Tor at its default size)
beats a bespoke hardened setup that makes you the only one who looks like that.
It's horrifying to see that our browsers give up anything at all. I feel like we need a new model where we just get served the content, and we don't serve up anything to the content provider. I feel ill.
How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nails.
In the old days, we just sent the content and let the client figure out what to do with it. If you navigated to homestarrunner.com and you didn't have flash installed, you just got a message saying to install it, or worst case, a broken icon in a frame.
We figured it out just fine.
Cool tool, but the language is painfully characteristic of AI. Maybe we are collectively getting over caring about that, but if not, it's worth a pass of "make this sound a little less like AI."
E.g., the guide page ends with
> The honest bottom line. Perfect anonymity [...]
* You're absolutely right! ;-)
It's worth noting that you need both uniqueness and some form of stability. If you consistently show up as a diffent fingerprint every time you visit or for every different site, then that is a form of privacy as well.
I just downloaded a fresh install of LibreWolf to test this and it did indeed have a stable UUID for me at 1/62E6. Better than the 1/680E6 from regular Firefox, but still upsetting. Fonts and Audio fingerprinting seems to be where a lot of the entropy is coming from... Even after I enabled some of the flags to resist font enumeration it still is stable and high entropy. I'm not sure what to do to be honest about this, it is very discouraging.
Shocking, this site assigned me a UUID and I found it listed here! https://everyuuid.com/
This doesn’t seem right. 1 in 6.2 billion for Firefox on an iphone, not including ip/network uniqueness?
Seems more plausible that anti-fingerprinting is throwing it off?
Some of the data seems straight-up wrong.
I know this computer has more RAM than reported and it's definitely not on a 4G network either.
The APIs it's relying on to show you that information do implement some anti-fingerprinting mechanisms - things like available memory will be put into rough buckets rather than returning the exact amount you have.
Yeah seems like it doesn't account for anti-fingerprinting at all.
If your ISP issues an IPv6 address, isn't that pretty much game over for anonymity/uniqueness?
Fascinating visualization , as someone building productivity extensions, it is always sobering to see exactly how much surface area the browser exposes.
The "Hardware & Environment" part which supposedly links me across different browsers doesn't work — it differs between Safari, Firefox and Chromium.
In a private Safari window, it's not even stable across reloads.
I built this after a thread here about Alibaba using an audio-context trick to fingerprint visitors. I knew a fair number of fingerprinting methods but not that one, and I wanted to see all of them in one place, running against my own browser.
GlassBox runs ~31 probes (canvas, WebGL/WebGPU, audio, fonts, the WASM feature set, math/engine quirks, WebRTC IP, timezone/locale, the permission and API matrices, an incognito heuristic, cross-site login-state, and so on) and shows the raw values plus an estimate of how identifiable you are.
A few deliberate choices:
- One static HTML file, no dependencies, no build step. Everything runs client-side and nothing is sent, with one opt-out exception: IP geolocation, which calls a public API. I didn't want a privacy tool that phones home.
- The "identifiability" number is an honest model, not a measurement. It sums published per-signal entropy (Panopticlick / AmIUnique / Cover Your Tracks), discounts signals your browser masks, and caps at the ~33 bits needed to single out one person on Earth. A no-server tool can't compute true rarity against a live population, so I label it an estimate instead of pretending. For real population numbers, Cover Your Tracks and AmIUnique have the datasets.
- There's a companion guide on lowering your fingerprint, with the caveat that uniqueness isn't privacy: blending into a big crowd (Tor at its default size) beats a bespoke hardened setup that makes you the only one who looks like that.
Source (MIT): https://github.com/HotStartLabs/glassbox
I'd genuinely like to know which vectors I'm missing, especially from the anti-fraud / detection side.