What it got right,

• My OS. It's in the user agent header, which I hate.
• I read the page methodically at a human reading pace.
• I am using a VPN.

What it got wrong,

• Location.
• Screen res.
• Num of CPU cores.

It's good for ppl to think about fingeprinting. So demo pages like this are good. But I'm sure the identity resolution industry is MUCH better at it. They have capabilities like TLS fingerprinting, outside the browser. For most ppl, not the privacy crowd so mcuh but normal ppl, they fingerprint resource fetches to diff geographic servers. They can run 100's of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.

I'm pretty careful. More than 99.999% will ever do. Can commercial fingerprinters still ID me? IDK. But like Skywalker, I have a bad feeling about it.

Needed to enable JS.

I loaded the site and went through the stuff and it worked fine. Then I turned on my VPN, and it gave me a new ID.

Changing my VPN endpoint and refreshing the page didn’t work, it still knew who I was, but closing the window and quitting the browser before changing the VPN again gave me a third ID.

They seem to know quite a bit about my phone, but it doesn’t seem like there is much that it could differentiate it from another person with the same model of phone.

This was a fun exercise.

Interesting. The only thing that really surprised me was the time zone thing. Can I hide that somehow?

A small point but it assumes that your browser's self-declared timezone is "true" to where you live. My timezone is spoofed to UTC+0; my VPN server is in a different country; and my browser language is set to en-us. I feel like if you see a user whose settings are all of the above then you can assume that none of those three data points actually describe the user, unless they coincidentally are a US English speaker or live in UTC+0, but that'd just be them coincidentally living where anti-fingerprinting browsers report you as.

Ironfox seems to do its job. Me fingerprint every time. Vanadium as well (though it does disclose more in-depth device data).

I mean "1 in 122.7 million browsers look like" mine meaning it got me down to one out of about 2% of all internet users globally. I'd say it's still pretty difficult to target anything at that many people and have it be relevant. Just knowing my location and that it's a weekend basically gets down to that many or maybe fewer people on it's own since fewer than that live in my city permanently, and adding tourists/visitors and people who work on weekends, that might be about right for how many devices are online in my city right now. And that was browsing with my less locked down browser on my phone.

Actually, looking with ironfox, though, actually reduced that to about 112m. I think part of that is that ironfox apparently still seems to enable the "do not track flag" even though it was removed from Firefox because it actually made people more easy to track and no sites who track are ethical so they are not going to obey something like that. So now it's rare and makes for a really good tracking point. Need to figure out how to remove it from ironfox I guess.

So I tried this in *Privacy Browser, mojeek search engine, with and without .js. Thing is, most websites are designed not to work, without it. I could use some help with settings, if anyone is inclined.

Also, that made my fingerprint much more unique. It almost seems worse.

This is quite revealing and impressive. But it’s also annoying when people don’t offer any preventative measures.

On my Android, Brave gave a different fingerprint both times I visited.

The site thinks both times was my first visit.

The site believes I have either a 4 core or 2 core cpu. I have an Octa-core.

Also, it shows a different display size both times.

Nearly all sites like this can do nothing without javascript turned on.

I'm curious to see how Librewolf is, but that will wait until after work.

Edit: Librewolf does indeed produce a different fingerprint each time. It also didn't give up my location like Brave did on my GrapheneOS phone.

I have since changed the timezone on my phone to a country to the South within the same timezone so the clock remains accurate.

Today all websites that have anti bot protection using pow (proof of work) already use cookies. Which is before they "ask you if you want to agree with cookies" haha. Dammit eu rules.

"Remember me on this device"

Cool site, but breaks when you disable JavaScript. I wonder if you could trick it into thinking you're a bot.

Amazing and terrifying. Thanks for the link. I am not very technical when it comes to the web so this was eye opening.

I used to have a small Firefox extension that would stagger my key presses to muddy the waters, but it made typing impractical, so I eventually removed it.

I wonder what else I can do on my end. And most importantly, what browsers can do for all their users, technical and not, by default.