Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A web page that shows you everything the browser told it without asking

sinceyouarrived.world

Post reply on HN
Print view View original

61–70 of 309 posts

Re: A web page that shows you everything the browser told it without asking

#61

Post by mwheelz »

nathanmills wrote: post #40

You can't gaurentee any of this is fingerprintable without checking twice (i.e. give the user a unique url, then ask them to restart the browser and visit it). In privacy browsers like LibreWolf or Mullvad Browser this is almost all spoofed, save for things like the IP which needs to be hidden/changed independently of the browser.

Correct on rigor. Proving a fingerprint requires the two-visit protocol you describe. The page doesn't actually compute a stable fingerprint or attempt to track returning visitors, it shows you the signals that go into one. The barcode at the bottom is deterministic from the data shown but isn't compared against anything stored. Sloppier than a real fingerprinting tool, by design.

Re: A web page that shows you everything the browser told it without asking

#62

Post by mwheelz »

IdiotSavage wrote: post #47

> Where you were before > news.ycombinator.com This has always bothered me the most. I disabled the 'Referer' header once, but it breaks many websites.

The Referer header is the one that's hardest to opt out of cleanly, strip it at the network level and too many things break. Referrer-Policy lets the origin set the rule, but the visitor doesn't get to choose. There's a quiet move toward Referrer-Policy: strict-origin-when-cross-origin as a sane default in modern browsers but it's still origin-dictated, not visitor-dictated.

Re: A web page that shows you everything the browser told it without asking

#63

Post by mwheelz »

BugsJustFindMe wrote: post #53
card_zero wrote: post #22

* I'm not in that city. * It's running a kind of Chrome on a kind of Linux, at a stretch. * Nobody can infer when I work and when I sleep. That includes me. * The recent, high-end display is the screen of a low-end tablet I bought in a supermarket five years ago. * But yes, browser fingerprinting is annoying. * Since you can detect light mode, would it kill you to honor it?

* That's the wrong battery percentage and the wrong charging status. > Since you can detect light mode, would it kill you to honor it? It would probably still be low contrast garbage even if it did. :/

The 100% charging readout is the desktop-with-no-battery phantom. I pushed a stricter filter for that earlier, you may be on a cached copy (try a hard refresh). On the light-mode call: the page detects your preference but doesn't honor it, intentionally. The irony being that the demo ignores the same signal it points out. I take the cost of the annoyance.

Re: A web page that shows you everything the browser told it without asking

#64

Post by mwheelz »

Retr0id wrote: post #32

> Your screen is 1512 by 982 pixels, rendered at 2x density — which means it is almost certainly a recent, high-end display. Your device volunteered all of this in the first milliseconds of the connection. No it didn't. It was queried by the JS running on the page. It's a fun demo but it could really do without the slop prose.

Pedantic but right. The JS queries them; the browser returns them without prompting the user. "Volunteered" is the editorial verb for that round-trip but it does paper over a layer.

Re: A web page that shows you everything the browser told it without asking

#65

Post by culi »

Most of this is pretty standard stuff but one thing I did learn is some of the fingerprinting techniques I wouldn't've thought of. Like Mozilla/Apple not sharing GPU or battery information being used to confirm which browser I use even if I fake the User Agent String.

Re: A web page that shows you everything the browser told it without asking

#66

Post by mwheelz »

ramon156 wrote: post #23

Its mixing confidential info. For example, you know I'm connected from a location, but you do not know my precise location. I connected from a tower that is from Odido, but I am not paying Odido for a subscription.

Right, IP-to-geo is approximate and gets a lot of cases wrong (yours among them). Most ad networks use it as a region/DMA hint, and not precise positioning. The point of including it isn't precision. It's that any location is more than nothing, and the visitor never opted in.

Re: A web page that shows you everything the browser told it without asking

#67

Post by mwheelz »

stusmall wrote: post #19
dylan604 wrote: post #17

Earlier quoted context omitted.

"Your graphics processor identified itself as or similar" guess mine isn't such a specific model as yours. so I don't have a real GPU, i have something similar to a GPU??? did I get a knock off Alibaba version?

I got "or similar" from Firefox and exact make and model from chrome. Probably a browser issue and not a hardware issue.

Confirmed. Firefox's privacy hardening returns "Mozilla, or similar" or just "Mozilla" as the renderer string. Chrome doesn't (yet). My parser was treating the Firefox string as if it were ANGLE format and grabbing the wrong half. Fixed.

Re: A web page that shows you everything the browser told it without asking

#68

Post by mwheelz »

2ndorderthought wrote: post #45
mwheelz wrote: post #29

Earlier quoted context omitted.

The GPU string really is the spicy one combined with screen + fonts it's enough to single you out across most of the open web. The card itself is a tank.

Yea that is a strong fingerprint. Especially if any of the other things were correct or someone has a way to model your behaviors. How long you scroll vs how often you type etc. and somehow that's still not enough for big tech and they need biometrics, photo IDs, etc.

Yeah, the bottom counter on the page is meant to make exactly that point. Mouse movements, scroll velocity, tab switches, reading pauses are all features in modern fraud / "trust" scoring systems alongside the static fingerprint. Biometrics is the next layer, and it's already happening on the back of "passive" liveness detection most people never see.
Post reply on HN