Fingerprint Blog

The more egregious and frankly disgusting one is https://fingerprint.com IMO this service should straight up be made illegal. I love the tagline they have of supposedly "stopping fraud" or "bots", when it's obvious it's just privacy invasive BS that straight up shouldn't exist, least of all as an actual company with customers.

Cookies are not the meta for tracking anymore. Fingerprinting [1] is highly effective across IPs and across incognito/browser profiles. Content blockers like Brave shields or uBlock Origin do not stop fingerprinting. The only browsers I've found that defeat it on desktop are Mullvad and Tor Browser as well as all the antidetect browsers I've tried. Disturbingly, fingerprint.com is not defeated by Tor browser on Android. We know fingerprinting is more effective on Mobile, and the recommendations say to use desktop for the most anonymity, so this isn't surprising. Mullvad [2] and Tor browser are blocked from using or signing up for most websites because of IP reputation and the browser fingerprinting protections which make them look like VMs and bots. Unlike the antidetect browsers, they don't spend extensive resources on site compatibility and avoiding detection, which leaves most sites shaking you down for suspect fraud. Annoying, when the real fraudsters are passing through easily with anti detect browsers and residential IPs. Antidetect browsers are used by marketers, web scrapers, social media account managers, ecom, among other low lifes. These use different browser profiles to avoid fingerprinting by isolating and randomizimg identifiers while constantly patching(use a few week old version and you'll see it gets detected as something to be blocked, not detected as in correlated cross profile, just blocked) to avoid detection. I'd like to see a privacy focused…

The Tor Browser won’t effectively stop fingerprinting, if anything it makes you more unique due to the low amount of people worldwide using it, and then you add points of data by using different DNS providers, extensions etc. The Tor Browser as a privacy measure is likely no better than a normal browser with uBlock if you’re also using it like a “normal” browser, signing into the same accounts you always use etc. My opinion obviously but I dislike people recommending the Tor Browser as a lot of it’s primary benefits are lost if you’re just using it as a daily driver browser. I always point people to https://fingerprint.com/ to see if their browser can defeat it. Most of the time you can’t without clearing cookies, changing device resolution, change VPN location etc. something the average person can’t/won’t do. Even JS aside there are a ton of different ways to track people based off even just getting server side data when a site’s stylesheet is fetched.

> Try to beat this: https://fingerprint.com I don’t know, but it seems like it’s overselling its capabilities. I tried with Firefox Focus and it said I’m using incognito (private mode) and assigned a unique visitor ID. Immediately tried with a private tab in Safari on iOS and it said I’m not using incognito (private mode) and assigned a new unique visitor ID. Then I switched networks and tried. One more unique visitor ID. I’m not claiming that fingerprinting is not possible, but this website is not good at it. Seems like it uses plain cookies.

> Try to beat this: https://fingerprint.com I beat it, I think... nothing much there. I use a VPN and NextDNS.io.

What differentiates this from http://fingerprint.com/? Visited for the first time and it said I already visited 800+ times with a 99.5% accurancy - not very promising. From the code this also looks like very simple client-side fingerprinting + IP information?

Notice, if you have all these settings enabled, you can still be fingerprinted. Test here: https://fingerprint.com/ In my tests only Tor was able to prevent that, but using Tor will give you bad rankings on payment sites like PayPal, you may even get banned there. I learned this from here: https://news.ycombinator.com/item?id=35243355 That site is now black, surely a coincidence. Here the archive.org link: https://web.archive.org/web/20250801173508/https://www.bitestring.com/… Have a local copy.

Yeah, you get the exact same results in two separate incognito sessions in stock Chrome. They don't immediately add your fingerprint to their database. (And that site isn't using the state of the art in fingerprinting - check https://fingerprint.com/ for a slightly better indicator.)

Fingerprint - https://fingerprint.com/ | Bot Detection Researcher (TS, JS), Senior TPM (Mobile Device Intelligence) | Full Time | Remote Fingerprint empowers developers to stop online fraud at the source. We work on turning radical new ideas in the fraud detection space into reality. Our products are developer-focused and our clients range from solo developers to publicly traded companies. 100% Remote, Global (GMT-8 to GMT+3), flexible schedule, competitive salary We are looking for: Bot Detection Researcher (TS, JS), https://grnh.se/31ab73694us - Sr. TPM (Mobile Device Intelligence), https://grnh.se/a3deb22b4us

https://fingerprint.com/ seems to provide a very resilient way to identify repeat visitors

I suggest you try here also, it's a commercial product used in real world. https://fingerprint.com/ I tried safari, firefox and brave on it. Only brave failed this, every time. Went to look on Google and found several thread about people complaining brave anti fingerprinting doesn't work very well. For instance https://community.brave.com/t/fingerprinting-protection-no-longer-as-g…

a) Techniques like this can identify a unique user to 99.5% accuracy e.g. https://fingerprint.com b) It can identify the user personally because many web sites use pixels where we link the fingerprinted user to an email address and then send both to Meta, Google, Reddit etc. And since browsers like Chrome allow long lived first party cookies this works because users remain signed in for over a year.

i can't wait to see what kind of tracking will be possible with these new technologies :) /s i know these guys https://fingerprint.com use so many of these when fingerprinting.

Fingerprinting is scarily accurate now, strangely. https://fingerprint.com/

Try visiting this from incognito and clearing cache/cookies: https://fingerprint.com. This can't be legal, right?

They already somewhat have. View the demo in normal mode at https://fingerprint.com/ and then open it again in Incognito

Using something like this, which I would personally make illegal: https://fingerprint.com/ I also tried setting privacy.resistFingerprinting = true in Firefox, but it's sad to see that most websites become unusable (most sites using canvas just render a green/purple mess), zooming in Google Maps is basically broken (skips several levels at a time), and like others have mentioned dark mode and time zones also stop working. What a mess the (somewhat private) web is nowadays. The more I think about it, the more I am convinced legislating privacy is the only way out of this arms race we seem to be losing. EDIT: Sorry, the parent post already included fingerprinting, missed that. Rant still stands though :)

Hmm, I just gave it a try with https://fingerprint.com/ and each time I restarted the browser it says it is my first visit. This is really a nice surprise, as fingerprint.com tends to always recognize your previous visits. Update: "In permanent private browsing mode, cookies and site data will always be cleared when Mullvad Browser is closed." It has this setting ON by default.

Strange, `privacy.resistFingerprinting = true` did not solve the issue for me, i'm still fingerprinted by https://fingerprint.com/. Even after clearing all cache and restarting Firefox. Adding the extensions `Canvasblocker` and `Temporariy Containers` did solve the issue though.

Had some good results with SEON (https://seon.io/) underneath they use fingerprint.js (https://fingerprint.com) to give you a confidence score.

For those who are unaware of how big of a problem fingerprinting is, there is an EFF website [1]. EU cookie policy is nothing compared to this. There are libraries like fingerprintjs [2] which can generate a pretty stable visitor ID. If you change or alter some browser APIs in order to make your browser less unique, some payment processors webs may stop working. And webs proxied through CloudFlare will constantly display "Checking if the site connection is secure" page, sometimes in an infinite loop where even solving their captchas won't help. [1] https://coveryourtracks.eff.org/ [2] https://fingerprint.com/

> Look at their customers - https://fingerprint.com/ . Welp that's scary, can detect me when I'm on VPN, off it, in private browsing mode, different country in private browsing mode...

> There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world. Fingerprinting using IP address, running scripts, canvas fingerprinting, using installed fonts, and checking what resources are cached/blocked are all things that are being widely used in many websites, and are not just "theoretically possible". They are even being sold as a product and are used by many companies. Look at their customers - https://fingerprint.com/ .

Your link 404s. I believe this is what you meant to include: https://github.com/fingerprintjs/fingerprintjs. There is also a premium verson: https://fingerprint.com/

Try the demo on this site: https://fingerprint.com/demo Both in incognito and normal modes. I bet you'll get the same fingerprinting ID in both. So yes, they can track you in incognito mode, too.

https://fingerprint.com/blog/disabling-javascript-wont-stop-fingerprin… https://github.com/jonasstrehle/supercookie

This is the Fingerprint demo page (the page itself is a demo): https://fingerprint.com/demo There's also https://demo.fingerprint.com for use case specific demos and more detail on the API response.

> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years. That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my examples, but just saying fingerprinting itself without explicit disclosure has been around for quite a long time. It happens on literally every CAPTCHA service. I hate it of course, but the ship sailed a long time ago. -- I like this demo for testing my browser's resilence against fingerprinting: https://fingerprint.com/demo/

What allows them to switch back is hidden in the accordion at the bottom: Why are you making FingerprintJS v5.0 available under an MIT license now? [...] We have made substantial improvements to Fingerprint Pro so that competitors relying on FingerprintJS for browser fingerprinting is no longer a concern. Comparison seems to be at https://fingerprint.com/github/, scroll to bottom for "Feature comparison" table.

https://fingerprint.com/demo/ Yes, fingerprint.com realizes that I am the same visitor. But ONLY IF I access it from the same IP address. This is impressive, but in the end not so much. They claim VPN does not matter for them. It does. Probably one of the last things that makes my browser identifiable.