6 ms·
Browser Fingerprint Detector
- AmazingTurtle 1y agoBrave Browser is not detected, lol
- ranger_danger 1y agoStill nowhere near as good as creepjs: https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/ Doesn't even detect common browser extensions.
- croemer 1y agoWow, this blows it completely out of the water. Even detects battery level, free storage, fonts etc
- Bilal_io 1y agoIt depends on the browser you're using, Brave is obfuscating a lot of this info, for me using Brave on Android it shows 100% battery while my actual battery is 62%.
- malfist 1y agoOn Firefox on android almost everything except the basics you expect are "unsupported" It has file system free space, but it's wrong.
- jszymborski 1y agoSure, but is the fingerprint at the top stable? It is for me despite most of the tests being blocked, spoofed, or randomized.
- jszymborski 1y agoOne thing I find odd is that, on LibreWolf, a lot of these fingerprint tests are disabled or even worse, randomized. How is it able to generate a stable fingerprint?
- kitsun3 1y agoIs there any library I could use for HW finger printing? I'd like to detect and ban evasions.
- majorchord 1y agohttps://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs https://github.com/abrahamjuliot/creepjs https://github.com/abrahamjuliot/creepjs https://github.com/thumbmarkjs/thumbmarkjs https://github.com/thumbmarkjs/thumbmarkjs
- maelito 1y agoThis is why privacy must be enforced by states, their laws and a powerful public enforcement agency. You cannot expect people to technically protect themselves from tracking. (you can invite them to not use abusing services though)
- dylan604 1y ago> (you can invite them to not use abusing services though) First, you'd have to define how one can determine what an abusive service is. Is Facebook an abusive service? Is some random website that happens to use FB's SDK an abusive service? How does a normie internet user find out the site they are using has abusive code? Some plugin/extension that has a moderated list that prevents a page from loading and instead loads a page dedicated to explain how that specific site is abusive?
- chipsrafferty 1y ago> Is Facebook an abusive service? Yes > Is some random website that happens to use FB's SDK an abusive service? Yes
- ranger_danger 1y agoNow write it down and get a majority of the population to agree with you.
- NoboruWataya 1y agoPerhaps I'm missing it but does it explain what aspects of your setup contribute the most to your score or suggest remedial actions? I wasn't that surprised to find that my standard setup is highly fingerprintable (for one, I use Firefox which alone is enough to single me out in a crowd) but I also tried using a vanilla Chromium install via a popular commercial VPN and still got a rating of 100%.
- seanw444 1y agoI'm curious as well. Ran a stock Vanadium config with Mullvad enabled, and got 100%. Maybe Vanadium isn't as focused on fingerprinting as I'd thought.
- zargon 1y agoRunning Chrome will make you highly fingerprint-able since it has so many APIs that can identify your hardware and software configurations directly or indirectly. It doesn’t help you “blend in” at all.
- abhaynayar 1y agoLooking at the JS, in the `calculateUniqueScore` function - it is just checking how many features it was able to detect (it gives a weight to each summing up to 100). It is not checking how unique you are based off of some data-set it has. This site also has plenty other such "issues"/"bugs" feels like it was quickly vibe-coded without much care.
- dktalks 1y agoWhy does this have a domain of .ai, what exactly it is doing AI related?
- kergonath 1y ago.ai is a ccTLD. Being AI related is not a factor to get one.
- latexr 1y agoBut they are considerably more expensive than more common TLDs, so if you’re getting one you presumably want it specifically and understand the association users will make.
- dylan604 1y agoOr it could be that the .com domain was already registered and unavailable, so they started browsing the other TLDs to see where they could find something and felt like .ai is new/hip/trendy
- latexr 1y agoWhich we know is not the case here, if you just visit the domain (instead of the submitted subdomain). https://goldenowl.ai https://goldenowl.ai This is very much an AI-centric website.
- kergonath 1y agoMaybe, but there are still many reasons to get one and it does not make anybody less legitimate than AI startups (which was the parent’s point). Besides, they do sell AI-related services.
- latexr 1y ago> and it does not make anybody less legitimate than AI startups (which was the parent’s point) Was it? I’m interested in what exactly in their post makes you say that. I see confusion, not any accusation regarding legitimacy. > Besides, they do sell AI-related services. I know, I checked the main domain. My point was simply that if you spend extra money on a domain which has a strong association with something, it would be expected that whatever you put on it is associated with it (which indeed is the case). Otherwise you’d be wasting money and confusing potential users, which isn’t generally good business practice.
- basilikum 1y ago> Fingerprint Collection Failed > This can happen due to several reasons: > [...] JavaScript Errors: When any of the 24+ fingerprint collection methods throws an error [...] So when any of the browser APIs it exploits aren't available, it just fails instead of using that as a datapoint in itself. I'm unimpressed.
- AbraKdabra 1y agoSo, what's the solution to all of this? Are there any settings I need to modify to Chrome to not allow certain info to be queried?
- elenchev 1y agoyes but then you become a "suspicious user" and you have to fill 100 CPATCHAs every day at this point browser fingerprinting is a feature, not a bug
- jay-barronville 1y agoTo be frank, in my book, relative to inadvertently being fingerprinted and tracked wherever I go, I consider being consistently faced with “let’s confirm you’re not a robot” popups and pages to be a minor inconvenience.
- foresto 1y agoConsider that all those CAPTCHAs are fingerprinting your browser anyway, and probably also your biometrics (through your inputs while solving each CAPTCHA).
- malshe 1y agoI second this. I tried to use Tor browser for a day in place of my regular browser. Many websites wouldn't open and the ones that dud asked me to fill in thousand captchas.
- chipsrafferty 1y agoEven the unmodified Firefox browser with a few of the privacy settings turned on break a lot of sites.
- jay-barronville 1y agoUse a different browser altogether. Chrome is never ideal for anyone who cares even a little bit about privacy. Use [Brave][0]. [0]: https://brave.com https://brave.com
- avastel 1y agoI recently wrote about the limits of these kinds of fingerprinting tests. They tend to overly focus on uniqueness without taking into account stability. Moreover sample size is often really small which tends to artificially make a lot of users unique https://blog.castle.io/what-browser-fingerprinting-tests-like-amiunique-and-browserleaks-really-show-and-what-they-miss/ https://blog.castle.io/what-browser-fingerprinting-tests-lik...
- everdrive 1y agoThis is great, and exactly the kind of nuance I almost never see when this topics come up. Thanks for posting this. Far too often, the pro-privacy crowd is much more _upset_ than they are precise, and to the point of your article are spending extra effort without really accomplishing much.
- everdrive 1y agoI'm deeply confused by a lot of the privacy discourse here. There seems to be opposing goals between preventing the fingerprinting mechanisms and just preventing uniqueness. Under the "preventing uniqueness" model, my Linux computer with custom Firefox and no fonts, and no js, etc. is the "most fingerprint-able" because it's the most unique. Whereas grandma on Windows and Chrome is "less unique," and therefore in some sense less fingerprint-able. I think there are a few potential problems with this view that I never see discussed: - Firefox sends some dummy data when making use of privacy.resistFingerprinting, and so you should get a unique fingerprint _every time_ you visit a site, so the fact alone that you're unique might potentially not matter if you're _differently_ unique every time you visit the site. Is there a flaw in this line of thinking? - My understanding is that the primary utility of browser fingerprinting is for advertising / tracking. In other words, the bulk of the population an advertiser would actually care about would be the huge middle of the bell curve on Chrome using Windows, not the privacy nuts on Linux with a custom browser config. In other words, if "blending in with the crowd" really worked I would think that tracking companies would fail against the most important and largest part of the user pool. If anything, it's more important to target grandma as she will actually click on ads and buy stuff online compulsively. Can anyone speak to these points? I often feel like the pro-privacy people are just crawling in the dark and not really aware of that real-world tracking is actually occurring vs. what might be possible in a research paper. Maybe I'm just the one that's confused?
- rsync 1y ago"... so the fact alone that you're unique might potentially not matter if you're _differently_ unique every time you visit the site. Is there a flaw in this line of thinking?" No, you're thinking correctly and the odd discourse that you (and I) see is based on two implicit assumptions: 1) Your threat model is a global observer that notices - and tracks and exploits - your supposed perfect per-request uniqueness. 2) Our browsers do not give us fine grained control over every observable value so if only one variable is randomized per request, that can be discarded and you are still identifiable by (insert collection of resolution and fan speed or mouse jiggle or whatever). Item (1) I don't care about. I'd prefer per-hit uniqueness to what I have now. Item (2) is a valid concern and speaks to the blunt and user-hostile tools available to us (browsers, that is) which barely rise to the level of any definition of "user agent" we might imagine. I repeat: I would much prefer fully randomized per-request variables and I don't care how unique they are relative to other traffic. I care about how unique they are relative to my other requests. Unfortunately, I am wary of browser plug-ins and have no good way to build a trust model with the 12 different plug-ins this behavior would require. This is the fault of firefox and the bad decisions they continue to make.
- dmitrygr 1y agoThe original is panopticlick from EFF: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ I do not see how this is better
- willhschmid 1y agoFingerprint Collection Failed Yay, I am safe. I use Brave. Everyone should use Brave.
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- SubiculumCode 1y agoAh... I was here wondering why browsers don't just run sites in a built-in virtual containers..allowing the same reports of the same hardware for everyone. especially for WebGL and canvas fingerprinting. I suppose someone might say it is about performance of going through a virtual layer? I understandit might break specialized 3D web-apps...but for common web-browsing? idk. Do people regularly use web-based app that need direct access to a GPU to be fast and functional? But surely, an exceptions list could work. I am sure I am missing something, but what?
- socalgal2 1y agopeople regularly use Google Maps and video conferencing apps (Zoom, Meet, FB Messenger, ...) all of which use the GPU. Maps to be able to customize the map based on what your point of interest is. VC apps to do background blur, addons, etc...
- SubiculumCode 1y agoBUt can the gpu not be virtualized?
- Yeul 1y agoMy browser is in a constant battle with Cloudflare but HN loves them...
- just_human 1y agoInteresting, even with a VPN on mobile safari on an iPhone over a carrier connection I get a uniqueness score of 100%. This is a neat tool, but I'm skeptical of its accuracy. I've run similar tests of uniqueness in the past and this just isn't accurate.
- vachina 1y agoYes, they claim 100% but the hash changes.
- jjangkke 1y agokinda wish I didn't visit this website as I don't know what goldenowl privacy policy is
- Beijinger 1y agoOn my privacy hardened Firefox, this website does not work. NoScript deactivated, Adblock deactivated, still does not work.
- thekoma 1y agoI figured it out! I disabled scripts so the code of the website never ran. Now am not highly unique! (Neither am I “not highly unique” though.)
- hilbert42 1y agoWell, perhaps my system is better than I thought. The site could not resolve anything until I turned JavaScript on (JS off is my normal default state)—it continued to poll and displayed nothing indefinitely (had to be terminated). When I turned JS on it could not determine my machine type, got screen reso wrong and it provided incorrect location info (map and coordinates were wrong). Moreover the browser type was incorrect (but then I automatically randomize the browser type on each launch).
- keninorlando 1y agoI never realized my battery charge state could be read.. The json data file is pretty impressive. }, "battery": { "charging": true, "chargingTime": 0, "dischargingTime": null, "level": 1 },