Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A web page that shows you everything the browser told it without asking

sinceyouarrived.world

Post reply on HN
Print view View original

31–40 of 309 posts

Re: A web page that shows you everything the browser told it without asking

#31

Post by crazygringo »

This is just... silly. Everything it told me, while browsing on my iPhone, seems entirely reasonable.

> Every page you have ever visited knows at least this much. Most of them know more. None of them told you.

So? Why would I want the news site I'm visiting to "tell me" it knows my preferred language, that I'm using light mode, or the estimated location of my IP address...?

It's not surprising that a browser which renders text can be used to identify which fonts are available. It's not surprising that a browser which allows calculation with your GPU will identify your type of GPU.

The "without asking" framing is just silly. I expect to be asked for consent to use my webcam or microphone or exact precise location. But the last thing I want is to be asked for permission around detecting my local time zone or preferred language or my screen resolution or 20 other totally reasonable things for a website to be able to know.

Re: A web page that shows you everything the browser told it without asking

#32

Post by Retr0id »

> Your screen is 1512 by 982 pixels, rendered at 2x density — which means it is almost certainly a recent, high-end display. Your device volunteered all of this in the first milliseconds of the connection.

No it didn't. It was queried by the JS running on the page. It's a fun demo but it could really do without the slop prose.

Re: A web page that shows you everything the browser told it without asking

#35

Post by mwheelz »

ebolyen wrote: post #12

There's really a lot more you can look at here. Lot's a prior art on super-cookies and fingerprinting: https://coveryourtracks.eff.org/ https://amiunique.org/

Both linked in the Sources & Confessions modal at the bottom. Cover Your Tracks is the spiritual ancestor of this whole piece. amiunique is more rigorous; this is the editorial cousin.

Re: A web page that shows you everything the browser told it without asking

#36

Post by dylan604 »

Steve16384 wrote: post #13
superkuh wrote: post #2

With javascript off it just stalls at "reading" forever. There are certainly some viewport properties and other things it does know even without JS execution, but the mitigation is significant. And the page itself (the JS application) cannot act on that data or communicate it. Instead it has to be processed by some other application on the backend or wherever. Not in my browser by my computer.

I can't help feeling that if you're turning JS off, you might as well turn off your computer to protect your data.

As an experiment, I made a small retail shop (nice things for UX. It's just that we can't have nice things because people suck

Re: A web page that shows you everything the browser told it without asking

#37

Post by joshstrange »

It's somewhat interesting but over half of what it talked about is just silly.

- Reverse IP/geocode (while be cute about "we won't show your IP", oh no, not my IP!)

- Timezone - Ok, yeah, lots of websites need/make use of that for completely legit tasks

- Browser/OS/Screen size - boring, again mostly needed or historical

- GPU - Again, not super interesting IMHO

- Battery - Ok, this is the first one I think should be behind a permission dialog

- Language - Come off it, that's just table stakes

- Fonts - Again, not sure how else this should work in a "perfect" world

- Cookies/dark mode/DnT/etc - Ehh, again aside from fingerprinting (which ruins everything) these are all QoL improvements IMHO

- Referrer - Again, this is just how the web works

I think the websites that take all of that and show you a fingerprint or show the data in a more data-oriented way are way more compelling.

This, almost certainly vibe-coded, website doesn't do anything novel and hits on a huge pet peeve of mine: using low-quality arguments for a legit issue (fingerprinting). By mixing in stuff like your IP/Language on the same level as Battery/GPU/other-fingerprinty-things it makes the whole argument less compelling.

Re: A web page that shows you everything the browser told it without asking

#38

Post by mwheelz »

chrisweekly wrote: post #9

I appreciate the intent here, so this is constructive feedback: - Some of the numbers are off, eg "Your browser allocated 39322 MB of storage to this page alone" - low contrast in dark mode makes text hard to read

The 39 GB number is a bug. I was reading quota (browser allow-up-to ceiling) and calling it "allocated." Fixed; pushing now. Contrast is intentional but I hear you. not changing it but noted, and a cleaner reading mode is on the to-do later.

Re: A web page that shows you everything the browser told it without asking

#39

Post by tgv »

freedomben wrote: post #6

I guess I shouldn't be surprised that it gives my exact GPU, but that was surprising to me. Just so everyone knows, its an AMD Radeon RX 6900 XT and I paid way too much for it during the covid/crypto price explosion when they were sold out everywhere. Still a bit raw about that, but it is an excellent card on Linux (fedora)

It got mine quite wrong (Firefox).

The thing that bothered me is that browser are still sending the Referer info. I thought that was not supposed to work under https?

Re: A web page that shows you everything the browser told it without asking

#40

Post by nathanmills »

You can't gaurentee any of this is fingerprintable without checking twice (i.e. give the user a unique url, then ask them to restart the browser and visit it). In privacy browsers like LibreWolf or Mullvad Browser this is almost all spoofed, save for things like the IP which needs to be hidden/changed independently of the browser.
Post reply on HN