Show HN: GlassBox – what the browser reveals, and how identifiable you are
glassbox.codecanary.org
Show HN: GlassBox – what the browser reveals, and how identifiable you are
1–10 of 73 posts
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#2I built this after a thread here about Alibaba using an audio-context trick to
fingerprint visitors. I knew a fair number of fingerprinting methods but not that
one, and I wanted to see all of them in one place, running against my own browser.
GlassBox runs ~31 probes (canvas, WebGL/WebGPU, audio, fonts, the WASM feature set, math/engine quirks, WebRTC IP, timezone/locale, the permission and API matrices, an incognito heuristic, cross-site login-state, and so on) and shows the raw values plus an estimate of how identifiable you are.
A few deliberate choices:
- One static HTML file, no dependencies, no build step. Everything runs client-side and nothing is sent, with one opt-out exception: IP geolocation, which calls a public API. I didn't want a privacy tool that phones home.
- The "identifiability" number is an honest model, not a measurement. It sums published per-signal entropy (Panopticlick / AmIUnique / Cover Your Tracks), discounts signals your browser masks, and caps at the ~33 bits needed to single out one person on Earth. A no-server tool can't compute true rarity against a live population, so I label it an estimate instead of pretending. For real population numbers, Cover Your Tracks and AmIUnique have the datasets.
- There's a companion guide on lowering your fingerprint, with the caveat that uniqueness isn't privacy: blending into a big crowd (Tor at its default size) beats a bespoke hardened setup that makes you the only one who looks like that.
Source (MIT): https://github.com/HotStartLabs/glassbox
I'd genuinely like to know which vectors I'm missing, especially from the anti-fraud / detection side.
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#3This doesn’t seem right. 1 in 6.2 billion for Firefox on an iphone, not including ip/network uniqueness?
Seems more plausible that anti-fingerprinting is throwing it off?
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#4This doesn’t seem right. 1 in 6.2 billion for Firefox on an iphone, not including ip/network uniqueness? Seems more plausible that anti-fingerprinting is throwing it off?
Yeah seems like it doesn't account for anti-fingerprinting at all.
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#5It's horrifying to see that our browsers give up anything at all. I feel like we need a new model where we just get served the content, and we don't serve up anything to the content provider. I feel ill.
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#6If your ISP issues an IPv6 address, isn't that pretty much game over for anonymity/uniqueness?
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#7This doesn’t seem right. 1 in 6.2 billion for Firefox on an iphone, not including ip/network uniqueness? Seems more plausible that anti-fingerprinting is throwing it off?
Some of the data seems straight-up wrong.
I know this computer has more RAM than reported and it's definitely not on a 4G network either.
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#8It's horrifying to see that our browsers give up anything at all. I feel like we need a new model where we just get served the content, and we don't serve up anything to the content provider. I feel ill.
How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nails.
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#9This doesn’t seem right. 1 in 6.2 billion for Firefox on an iphone, not including ip/network uniqueness? Seems more plausible that anti-fingerprinting is throwing it off?
Some of the data seems straight-up wrong. I know this computer has more RAM than reported and it's definitely not on a 4G network either.
The APIs it's relying on to show you that information do implement some anti-fingerprinting mechanisms - things like available memory will be put into rough buckets rather than returning the exact amount you have.
Re: Show HN: GlassBox – what the browser reveals, and how identifiable you are
#10Fascinating visualization , as someone building productivity extensions, it is always sobering to see exactly how much surface area the browser exposes.