My browser is apparently unique among all those tested so far (around 3 million) and gives you, with all the odd setup options, a little bit under 22 bits of in

My browser is apparently unique among all those tested so far (around 3 million) and gives you, with all the odd setup options, a little bit under 22 bits of information. Okay... so what does that actually mean to you? Perhaps the best way to proceed here is by comparison: To pick out one person uniquely among the 7 billion people on Earth requires ~33 bits of information. Each bit of information divides the search space in two, (just like with computers =p ) Which is why you can just go: log2(searchspace) = required bits You can also work the idea backwards. (i.e. 2^(available bits of info)) to find out what size of search space you can be found in. It so happens I give up about 22 bits so... I can be found in a population of about 4 million. Put another way, there are, best case scenario assuming that the distribution is random (which in practice it almost certainly isn't), around search space / uniquely identifiable pool people with a similar fingerprint to myself. In this case we're dividing seven billion by 4 million which should give you around 1,750 similar people to myself. So... that's pretty darned accurate - but not that worrying yet perhaps. At least if you needed to uniquely identify me. But I'd bet a heck of a lot they do have other info. Every bit of information under that needed to identify you uniquely in the search space doubles the potential group size you have to hide within. Every bit of extra information they have, halves it. Not everyone in the world is online. Only 39% were predicted to be so this year, I believe. Suddenly you're looking at only having 683 people like you on earth. And it gets worse. The really relevant search pool is going to be how many people connect to the sites they know about - which are probably going to be multiple sites since they can store and trade your IP address which probably isn't going to change that often. I bet most of the sites I connect to don't get anywhere near 39% of the world's population connecting to them. How unique am I for the sites I visit? The sites I visit, if they're niche like HN, probably gives a HECK of a lot of info on me. To the point where I suspect I can be absolutely uniquely identified here by my browser fingerprint. You'll notice that of the 3 odd million people on the EFF site I provide more than enough info to be uniquely identified. And even if they don't, the cumulative probability is the product of the sum of the individual probabilities. If someone goes on two niche sites, or three... The search space gets cut up again. Snipety snip. So, yeah, in connection with other databases and the usual attack vectors people use when they start getting info on you - targeted adds, security profiling etc, that's pretty worrying. It's especially worrying for applications where people aren't going to have a high cost from hitting the wrong target.