YHK - yet another hacker news clone

A comprehensive study of how fingerprintable users are

61 points tomrittervg 5 hours ago 28 comments

_factor 4 hours ago | parent

I wonder if this took into account GPU render-time fingerprinting? The minute timing differences in how you render an image are still used to identify you.

magicalhippo 3 hours ago | parent

Recently did a WebGPU project and noticed Firefox polls GPU status on a 100ms timer, so you can't really use it for such as far as I can tell.

That said, Claude figured out that while Canvas copying of a loaded JPEG was out due to fingerprint resistance, it could copy it via WebGPU, so yeah...

LoganDark 39 minutes ago | parent

This reminds me of some fucking bullshit about how browsers silently store canvas pixel data as premultiplied and try to transparently convert everything you put in and everything you take out, but silently corrupt color values in the process.

https://github.com/nagadomi/nunif/issues/32#issuecomment-153...

raphlinus 2 hours ago | parent

If you can run compute shader code, the fingerprinting and side channel possibilities become very rich. [1] is one paper among many on this topic.

[1]: https://dl.acm.org/doi/10.1145/3634737.3656283

ape4 4 hours ago | parent

I read they're not releasing the details - that seems good (for the public). Hopefully they're releasing it to privacy-friendly browser makers.

NooneAtAll5 3 hours ago | parent

funny how enabling letterboxing causes me to be in "under 100 samples" category

btw, is pixelRatio controllable somehow? how do I set it to 1, most common value?

NooneAtAll5 3 hours ago | parent

wtf is "Maximum touch points" ?

> The digitiser's touch-point count, uncollapsed.

my laptop does not have touch screen, why am I not at 0?

NooneAtAll5 3 hours ago | parent

interesting how Windows and Mac are almost at 100% of DRM enabled, meanwhile linux is only at 33%

anyone knows why is that?

NooneAtAll5 3 hours ago | parent

I wish I could select what OS to sort values for

see f.e. "Highlight" (Resolved value of the Highlight system colour keyword, as RRGGBB), which has bajillion different values for android - and I can't find the most common ones for linux

Karliss 1 hour ago | parent

Users of open source operating system want to be in control of their computer, DRM vendors want the same -> to be control of user's computer, which is a problem. Nearly every DRM system involve heavily obfuscated closed source binary blobs, that's something neither the users nor distro maintainers want to touch if possible.

SiempreViernes 2 hours ago | parent

Maybe it reports the resolution of the touchpad instead?

vova_hn2 3 hours ago | parent

I understand that the HN crowd is composed of many different people with radically different interests and opinions, so an "average HN opinion" would be mostly meaningless, but still...

I find it mildly amusing that HN both loudly complains about bots scraping their websites AND is very interested in user privacy.

The conflicting part is that user privacy automatically means that you cede any control over how exactly does the user accesses your resource. Whether they use a web browser or an automated scraper. Any attempt to analyze requests to tie different requests made by the same actor together automatically means privacy violation.

I don't have a good answer to this dilemma yet, I just thought that this is a curious observation and wanted to share.

octoberfranklin 2 hours ago | parent

Um, no.

Scrapers and bots put a ton of effort into anti-fingerprinting. Ordinary users? Zero.

Users care mainly about cross-site fingerprinting. Bot-fighting is concerned with single-site fingerprinting.

The good answer to your dilemma is x402: https://x402.org/ Nothing in life is free; you've been paying with your attention via ads, which is where the urge to fingerprint comes from (targeting). Agentic AI is rapidly killing web ads as a revenue source. It's time to stop kicking the can on micropayments.

Also, this article commits the common mistake of assuming that privacy means hiding in the largest possible cohort. That's bogus. You can also get privacy by belonging to many one-member cohorts -- i.e. fingerprint uniquely but differently to each site you visit and differently to a single site over longer timespans (like weeks). This is precisely what Brave's "farbling" does; farbled users have very unique fingerprints and yet they can't be tracked.

bena 2 hours ago | parent

On the face, yes, that is true. And it's what confused me about your post at first. Because I didn't see the connect between scraping and user privacy.

And yes, on the face, being able to determine whether a bot or a person is looking at your site is essentially trying to confirm some private information about the consumer.

But I think the dichotomy can be settled through the habits of consumption. Bots are impartial, greedy, and fast. They can consume resources faster than a human can. This could be a problem when trying to provide those same resources to humans.

Not to mention, the bots doing the scraping are doing so to put your content in their regurgitation machine. Which has been ruled as "not a copyright violation" due to "reasons". Whereas, a person who attempts to use your content without permission is liable for violating your copyright.

Now, if the position is "human users" have privacy, then we would need that critical piece of information before we decide whether to grant privacy to an entity. Also, the user is free to not use the resource if the rule is that we're allowed to determine whether they are human and the user doesn't want to share that information. As long as we don't pursue that information beyond what we've stated we're going to use it for, we can be said to be respecting the users' privacy. Also, if we don't disclose that information to other users or companies, we could still be said to be respecting the users' privacy, because information shared in confidence with us remains that way.

solarmist 2 hours ago | parent

Oh, damn. I thought this was about the uniqueness of human fingerprints or similar.

sampli 57 minutes ago | parent

This is HN…

gausswho 2 hours ago | parent

Ran their fingerprinting test.

CSS Colours SelectedItem and SelectedItemText was the only problematic one, and uniquely identified me to less than 0.0054 of Linux users.

Why?

willis936 32 minutes ago | parent

Ah, yes, less than 0.0049% of users use checks notes 24-bit color.

dt3ft 2 hours ago | parent

> Your browser is not comparable to the dataset, so we have avoided showing you inaccurate results.

Yup. Because I use my own browser. Built from scratch with exception of V8, Stylo html5ever, and a few other bits and bobs. A fresh new rendering engine in Rust and all. Not a fork of any existing engine. Native support for uBlock Origin filter lists and custom filters. It scores above ~20 in speedometer as of today and covers WPT about 89%. Will be publishing it soon as permissive open source.

octoberfranklin 2 hours ago | parent

And cloudflare, akamai, and hcaptcha lock you out of 80% of the Web.

dt3ft 2 hours ago | parent

Nope. YouTube, for example, works like a charm. Settings allow users to select a user agent (chrome, edge, firefox, safari) or set a custom one.

aleksejs 2 hours ago | parent

Given TFA, I have to assume you are bragging about being the most fingerprintable user on the Web.

dt3ft 1 hour ago | parent

Correct, sticking out is not the best approach. The only protection users of any modern browser have (while still having usable APIs) is whitelisting which sites can request information like enumerating system fonts and serving every other site fake/random information, likely through addons. Say a fingerprinting mechanism wants to enumerate your system fonts, you look up your whitelist, and if it is not on it, browser serves it the most generic list (can be gathered from fingerprinting datasets like EFFs) or finetuning it until your score is as generic as possible. Essentially, blending in with the crowd. Having such whitelists would make browsing a bad visual experience, but hey, why not do what we can to make fingerprinting as difficult as it can be. I don't mind having this as a native feature which prompts the user as they browse, sample prompt: "this site would like to access the following information about your browser, will you allow it or serve it generic, the least fingerprintable set?".

eszed 1 hour ago | parent

Are there add-ons which do this?

herpdyderp 1 hour ago | parent

I'm getting this too on main release Safari... because the test only handles Firefox.

M95D 1 hour ago | parent

> Protections that ship have to keep the web working

I don't agree. I activated most of the protections. If a site breaks, then I don't get to see it. That's OK. No big loss. Users should fight their FOMO.

frenchsalmon 49 minutes ago | parent

Same, if a website requires less protection and I really want to see that content, I just make the effort to lower my config, with high suspicion tho.

usern20260720 1 hour ago | parent

why can't my browser curl download an .html package, as a word processor would download a .doc file, instead of betraying my privacy by publishing even my underwear size?