A web page that shows you everything the browser told it without asking

sinceyouarrived.world

258 points by mwheelz 5 hours ago


card_zero - 3 hours ago

* I'm not in that city.

* It's running a kind of Chrome on a kind of Linux, at a stretch.

* Nobody can infer when I work and when I sleep. That includes me.

* The recent, high-end display is the screen of a low-end tablet I bought in a supermarket five years ago.

* But yes, browser fingerprinting is annoying.

* Since you can detect light mode, would it kill you to honor it?

karmakaze - 2 hours ago

Whether or not the information is accurate isn't really the point. It's that it serves as a way to identify you even without cookies. I looked for better websites, the EFF one[0] is informative.

My browser fingerprint was unique among the visitors in the past 45 days.

[0] https://coveryourtracks.eff.org/

lucideer - 2 hours ago

The website is pretty & the overdramatic copy is fun, but there's much better fingerprinting demos out there.

The number of data points shown here is low - there's plenty more it could be checking - & a good number of them seem to be wrong (it's only detecting one as explicitly "withheld" but I believe a few of them actually are, leading to garbled output).

Needs some QA.

ebolyen - 3 hours ago

There's really a lot more you can look at here. Lot's a prior art on super-cookies and fingerprinting:

https://coveryourtracks.eff.org/

https://amiunique.org/

pona-a - 3 hours ago

A vibe-coded EFF Cover Your Tracks. The fact this made it to front-page is spookier than its contents

noelsusman - 11 minutes ago

I am once again asking privacy advocates to try sounding normal for once. Trying to make a browser accessing your timezone sound nefarious isn't going to convince anyone of anything.

praveen4463 - 3 minutes ago

good stuff but useful for non tech ppl. We already knew those things are exposed by the browser. probably worth putting in x/reddit

simonbw - 28 minutes ago

It seems like they know I have an iPhone with dark mode enabled, that I speak English, and that I'm in the USA (but wrong city wrong state). I am kinda unimpressed, I'm pretty sure they can get a lot more info than that.

RHSeeger - 2 hours ago

> We did not ask for your location. Your address arrived before you did.

Bunk. You asked a geolocation api/service to map my ip address back to a location. You _did_ ask for my location, using my IP as a key. And my IP is pretty much required in order for communication on the internet to work (outside of using services to hide it, but then _they_ have your info instead).

troyvit - 3 hours ago

> Your graphics processor identified itself as or similar.

That checks out. I think what I have is similar to a graphics card but isn't quite.

skerit - an hour ago

> We know this because your IP address was the first thing your device sent us.

First paragraph, and I don't like this wording already. It's as if "my device" has any choice in the matter.

And actually, it's the reverse! Often enough your own device does not know your _actual_ public IP address without asking some kind of public service to snitch on your internet connection.

Aardwolf - 24 minutes ago

> You came here from news.ycombinator.com. Your browser told us the address of the page you were reading before this one. Every link you follow tells the destination where you were. The page you just left knows you left. This page knows where you came from. Neither was asked.

I thought this didn't work anymore and browsers left out the referer in the case of https, is that not so then?

jameshart - 44 minutes ago

> Your device carries these typefaces, of the seventeen commonly probed by fingerprinting checks. The specific combination of fonts on your device is nearly unique

The set of fonts available in stock iOS is hardly going to be unique now is it?

That it is even possible to install fonts onto iOS would be news to most users.

- 20 minutes ago
[deleted]
pugworthy - 24 minutes ago

Trying this in Lynx I'm surprised it didn't at least get some information from me in the request headers. You don't need JavaScript to pull things out of them.

donatj - 19 minutes ago

The text legibility of the gray on black is a serious problem. My eyes aren't that bad but I can barely read this.

chrisweekly - 3 hours ago

I appreciate the intent here, so this is constructive feedback:

  - Some of the numbers are off, eg 
"Your browser allocated 39322 MB of storage to this page alone"

  - low contrast in dark mode makes text hard to read
mrpopo - 3 hours ago

Happy to say that my browser didn't tell anything that I didn't expect it to. It even identified my IP from a location 1000km away from me.

Firefox on Android with ublock

nottorp - an hour ago

An instant loading page without animations and more contrast would have been more fun.

The fact that it begins with my IP address reminds me of those dubious VPN ads.

City is wrong, I may speak English but it's not my native language.

As other people said, there are much better pages showing you your browser fingerprint.

IdiotSavage - 2 hours ago

> Where you were before

> news.ycombinator.com

This has always bothered me the most. I disabled the 'Referer' header once, but it breaks many websites.

freedomben - 3 hours ago

I guess I shouldn't be surprised that it gives my exact GPU, but that was surprising to me. Just so everyone knows, its an AMD Radeon RX 6900 XT and I paid way too much for it during the covid/crypto price explosion when they were sold out everywhere. Still a bit raw about that, but it is an excellent card on Linux (fedora)

wincy - 3 hours ago

My battery is at NaN%, the site is cool but it should probably change the text if I’m not actually exposing that information.

It got the city wrong but close to where I live. This stuff would be wildly wrong if I fired up my VPN. Although its annoying when I connected to a VPN to Steam it’ll often show my prices in Canadian dollars instead of USD.

carimura - 2 hours ago

Aren't LLMs smart enough to choose better color contrast by now?

wickerdan - 9 minutes ago

Its pretty scary when you see it like this

mikeocool - 2 hours ago

As far as this website reports, I'm undistinguishable from most other Mac users in Brooklyn, New York. Seems like it's not actually highlighting the frightening aspects of fingerprint.

corobo - 2 hours ago

Dunno what it is with the wording but my brain started reading it in a bit of a "Hello Clarice" Hannibal Lecter style lol

>The specific combination of fonts on your device is nearly unique — like a fingerprint made of letters

Is this one true? I've not made any changes to fonts on my phone that I know of, wouldn't it just be bog standard iPhone fonts?

Curiosity not challenge

Would be cool if you actually did track just to prove the point like "you've opened this page 6 times now, 2 of those were via VPN and one time was using the Firefox Focus browser. Have you found any flaws in the data yet?"

1vuio0pswjnm7 - 2 hours ago

Perhaps this illustrates the ridiculous level to which website operators make assumptions about website visitors

This phenonemon is much older than "browser fingerprinting"

Gualdrapo - 3 hours ago

Text is so dim is really hard to read.

Multicomp - 3 hours ago

Mine told me my graphics card was "or similar" so my stock Firefox is doing at least okay.

While I still follow the general privacy first tenets, I have ended up backing off on some tools (noscript and librewolf) at the extremes of privacy because if every site is going to track everything by my IP or by my ASN or browser fingerprint, I do have a happy medium of being private enough while not being utterly broken in my browsing.

Roughly that looks like email aliases on demand via sieve rules, ublock origin with liberal use of filter lists, different handles and a password manager, frozen credit ratings, and Tailscale exit nodes or Mozilla(Mullvad) VPN for uncontrolled WiFi access points for my jnrootabke android device and mostly signal for comms.

I'm getting to old to be a privacy extreme enthusiast when all of my family side channels everything straight to Facebook, so this is the impure level of privacy I can sustain.

deferredgrant - an hour ago

Browsers are stuck between compatibility and privacy. Every bit of environment detail has some site that claims to need it, and every extra bit makes users easier to distinguish.

aziaziazi - 3 hours ago

> Your screen is 320 by 568 pixels, rendered at 2x density — which means it is almost certainly a recent, high-end display.

It’s been a long time my 2016’ iPhone as been called recent or high-end but I’ll take the compliment, thank-you.

aidanbeck - 3 hours ago

Aside from the fingerprinting methods, the graphics processor string seems to be the most immediately personal data given up (other than location, which was incorrect for me). I could see sites tailoring ads around an assumed class, income, and level of digital literacy based on this data point alone.

internet2000 - an hour ago

Yes, I'm on a MacBook Air in Eastern Time and I speak English. I'd have told the website that myself if they had asked it.

GMoromisato - an hour ago

Someone should do a demo where they take all the info from the browser and feed it to an LLM to describe the person as accurately as possible. I bet it would be 10x better than any horoscope.

culi - 2 hours ago

Most of this is pretty standard stuff but one thing I did learn is some of the fingerprinting techniques I wouldn't've thought of. Like Mozilla/Apple not sharing GPU or battery information being used to confirm which browser I use even if I fake the User Agent String.

reenorap - an hour ago

How do we get our browser to stop sending all this information? It's really maddening.

nathanmills - 2 hours ago

You can't gaurentee any of this is fingerprintable without checking twice (i.e. give the user a unique url, then ask them to restart the browser and visit it). In privacy browsers like LibreWolf or Mullvad Browser this is almost all spoofed, save for things like the IP which needs to be hidden/changed independently of the browser.

Cider9986 - 2 hours ago

I prefer https://fingerprint.com/demo

Terrible company-at least you know you are testing what is being used.

ramon156 - 3 hours ago

Its mixing confidential info. For example, you know I'm connected from a location, but you do not know my precise location. I connected from a tower that is from Odido, but I am not paying Odido for a subscription.

amarcheschi - an hour ago

You could have used show hn since you made it

yakkomajuri - 3 hours ago

DuckDuckGo browser helped mask some stuff, but definitely a fair amount still goes through.

Annoyingly the web is becoming a bit more annoying to browse as a DuckDuckGo (mobile) and Brave (desktop) user. With a VPN on top it gets even worse.

mwheelz - 2 hours ago

Update: I pushed two rounds of fixes for things people caught.

1. GPU "or similar" stranded prose. Firefox returns "Mozilla, or similar" as the masked renderer string and my parser was grabbing the second half. Masked-GPU case now gets its own observation.

2. Desktop battery showing NaN/100%. Chromium reports a phantom 100%-charging battery on machines without one; my filter was too narrow. Stricter check, falls through to "kept back."

3. Storage quota of 39+ GB reading as implausible. Now expressed in GB, and the prose was reworded ("would let this page write up to" rather than "allocated to").

4. Screen size matching window size (Firefox letterboxing / Brave farbling). Page now names it: "your browser appears to be returning the viewport in place of the real screen — anti-fingerprinting at work."

5. "Recent, high-end display" being claimed on old retina devices (iPhone 5-class). Tightened the heuristic.

6. No-JS hangs at "reading." <noscript> block added.

Worth saying directly since it came up. The prose is hand-written. Each observation has a small set of templated registers and the code selects among them based on what the data returns. There is no LLM in the runtime path. AI helped me iterate on the spec like it does for most projects now. The sentences on the page are mine. If that's not the kind of work you're in the mood for, fair, but the slop charge is wrong.

sgarrity - 2 hours ago

I'm not worried about my privacy. No one can read the dark text on that page anyhow.

superkuh - 3 hours ago

With javascript off it just stalls at "reading" forever. There are certainly some viewport properties and other things it does know even without JS execution, but the mitigation is significant. And the page itself (the JS application) cannot act on that data or communicate it. Instead it has to be processed by some other application on the backend or wherever. Not in my browser by my computer.

tempodox - 2 hours ago

If the color scheme weren’t so atrocious, it would almost be possible to read what it says.

joshstrange - 3 hours ago

It's somewhat interesting but over half of what it talked about is just silly.

- Reverse IP/geocode (while be cute about "we won't show your IP", oh no, not my IP!)

- Timezone - Ok, yeah, lots of websites need/make use of that for completely legit tasks

- Browser/OS/Screen size - boring, again mostly needed or historical

- GPU - Again, not super interesting IMHO

- Battery - Ok, this is the first one I think should be behind a permission dialog

- Language - Come off it, that's just table stakes

- Fonts - Again, not sure how else this should work in a "perfect" world

- Cookies/dark mode/DnT/etc - Ehh, again aside from fingerprinting (which ruins everything) these are all QoL improvements IMHO

- Referrer - Again, this is just how the web works

I think the websites that take all of that and show you a fingerprint or show the data in a more data-oriented way are way more compelling.

This, almost certainly vibe-coded, website doesn't do anything novel and hits on a huge pet peeve of mine: using low-quality arguments for a legit issue (fingerprinting). By mixing in stuff like your IP/Language on the same level as Battery/GPU/other-fingerprinty-things it makes the whole argument less compelling.

josefritzishere - 43 minutes ago

This is a great exercise, it's generally accurate on location but it's hard to express how granular they can be Identifying users through browser information. fonts? display size? processor? how unique is that really in laymans terms?

crazygringo - 3 hours ago

This is just... silly. Everything it told me, while browsing on my iPhone, seems entirely reasonable.

> Every page you have ever visited knows at least this much. Most of them know more. None of them told you.

So? Why would I want the news site I'm visiting to "tell me" it knows my preferred language, that I'm using light mode, or the estimated location of my IP address...?

It's not surprising that a browser which renders text can be used to identify which fonts are available. It's not surprising that a browser which allows calculation with your GPU will identify your type of GPU.

The "without asking" framing is just silly. I expect to be asked for consent to use my webcam or microphone or exact precise location. But the last thing I want is to be asked for permission around detecting my local time zone or preferred language or my screen resolution or 20 other totally reasonable things for a website to be able to know.

basilikum - an hour ago

> This volume requires JavaScript. That is part of the point — your browser is what is being read.

> With JavaScript off, the page cannot tell you what your browser disclosed. The data is still there. The disclosure still happened. Only the telling of it stops.

What? When I enable JS it shows me a lot of stuff that is only queriable with JS.

Retr0id - 3 hours ago

> Your screen is 1512 by 982 pixels, rendered at 2x density — which means it is almost certainly a recent, high-end display. Your device volunteered all of this in the first milliseconds of the connection.

No it didn't. It was queried by the JS running on the page. It's a fun demo but it could really do without the slop prose.

pdntspa - an hour ago

Your browser discloses a lot more fingerprinting data than this

pimlottc - an hour ago

I can’t even read this on my phone, the text is too small and the contrast is terrible

pixel_popping - 2 hours ago

It's really bad, it's not using proper fingerprinting techniques, no network stack fingerprinting, no browser history via DNS poisoning, no narrowing down exact country with timing and so on. I mean this is even inferior from basic tools like amiunique, what's the point?

thatguy0900 - 3 hours ago

Man what a awful looking site. I shouldn't have to crank my brightness to max to kind of read the words

- 2 hours ago
[deleted]
flux3125 - an hour ago

At least it doesn't know my age

Oh wait

camillomiller - an hour ago

Another unreadable piece of slop with Claude fonts and style that this user has already spammed three times here with an account created 21 days ago.

This is out of control, and y'all just comment these threads as if they're made by humans.

rappatic - 2 hours ago

Vibecoded slop with LLM-written copy. When will it stop

efilife - 2 hours ago

We've seen tens of pages like this, all done better. Now the vibe coders got into it and completely fuck up the idea.

romanows - 2 hours ago

Lol, the description text is so dramatic.

htx80nerd - 2 hours ago

>OH MY GOD WE KNOW STUFF ABOUT YOU

peoples obsession with 100% privacy while operating in a public space is immature. if you're that risk averse dont connect to the internet.