Even a VPN Can't Hide You From This (Browser Fingerprinting)
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: Even a VPN Can’t Hide You From This (Browser Fingerprinting) · Channel: Better Stack · 04:43 · Watch on YouTube
Topics: AI developer tools, Privacy and data protection, RAG, search and information retrieval
Summary
Section titled “Summary”Browser fingerprinting lets websites recognize a browser without cookies, even when the user is in incognito mode or using a VPN. Trackers combine browser details such as screen size, time zone, and processor cores with readings from canvas and audio APIs to create a distinctive fingerprint. The video demonstrates how to test a browser with the EFF’s Cover Your Tracks and explains that fingerprints can change over time. It recommends using browsers with built-in fingerprinting protections rather than relying on privacy add-ons.
Key points
Section titled “Key points”- Incognito mode clears stored browsing data, and a VPN changes the apparent IP address, but neither necessarily prevents fingerprinting.
- Browser APIs can expose details such as screen size, time zone, language, and processor core count.
- Combining many ordinary browser details can narrow down which browser is being observed.
- Canvas and audio rendering can reveal small differences related to hardware, browser settings, and installed fonts.
- Fingerprinting techniques are also used by bot detection tools.
- Cover Your Tracks, a free site from the EFF, tests a browser’s fingerprint and shows which answers may make it stand out.
- Fingerprints can drift as fonts and browser versions change.
- The video recommends built-in protections in browsers such as Tor Browser, Mullvad Browser, Brave, Firefox, and Safari over extra privacy add-ons.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | Fingerprinting beyond cookies and VPNs | A browser can remain identifiable in incognito mode and with a VPN, as the video’s cookie-free demonstration shows. |
| 01:02 | How browser fingerprints are built | Trackers combine information from browser APIs and use canvas and audio rendering differences to distinguish browsers. |
| 02:36 | Audio fingerprinting and bot detection | The video describes fingerprinting libraries and a case where background bot-detection scripts affected Bluetooth audio. |
| 03:40 | Testing your browser | Cover Your Tracks reports whether a browser has a unique fingerprint and shows which collected answers contribute to it. |
| 04:10 | Built-in browser protections | The video outlines approaches used by privacy-focused browsers and recommends built-in protections over extra add-ons. |
Quotes
Section titled “Quotes”a website can still tell it’s you. — 00:00
new trackers wanted a way to recognize you that doesn’t store anything on your computer at all. — 01:02
different machines get slightly different numbers back. — 02:36
my browser has a unique fingerprint. — 03:40
skip the extra add-ons and use the browsers that have those protections built in. — 04:43
Concepts and entities
Section titled “Concepts and entities”browser fingerprinting, FingerprintJS, Cover Your Tracks, Electronic Frontier Foundation (EFF), Tor Browser, Mullvad Browser, Brave, Firefox, Safari
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 You can disable cookies, open incognito, even use a VPN, and a website can still tell it’s you. This is through a technique called fingerprinting, and your browser, just like mine, is likely to be uniquely identifiable. In this video, I’ll show you exactly how fingerprinting works, how you can test your own browser, and how you can avoid being tracked in the first place. So, I built this little page that fingerprints whoever opens it, and it doesn’t set a single cookie. Here, it’s
00:31 running on my laptop, and this long string at the bottom is my ID. Now, I’ll open the same page in Chrome’s incognito window, which starts with no cookies and no history, and I get exactly the same ID. Then, I can switch on my VPN, so my IP address changes, and the ID stays the same. Incognito clears what the sites have stored, and the VPN hides where I’m connecting from, but the page doesn’t look at any of those things. The whole page is under 100 lines of JavaScript, and I’ll leave a link to the project below, so you can try it yourself. So,
01:02 let me explain how all of this works. Normally, a website remembers you with a cookie. It stores a small note in your browser, and your browser hands that note back on every visit, but you can delete those notes, and a private window starts with none at all, anyway. So, new trackers wanted a way to recognize you that doesn’t store anything on your computer at all. That means they don’t need to show things like a cookie banners, and it turns out that is pretty easy. You see, through browser APIs, you can find a treasure trove of information about your browser. How big the screen
01:33 is, what time zone you’re in, what language you have set, even how many processor cores you have. On their own, none of these say much, but if you remember that game, 20 questions, where you ask 20 different questions, and you can pretty much whittle down to any idea on the planet, it works in the same way. So, let’s start with every computer on the planet. First, we take your time zone. That alone eliminates 90% of people. Then, we take your screen size, another 20% gone, got processor cores, another 20% gone. You get the point. Half a million people 20 times and
02:05 you’re down to one person. And 33 halvings is enough to pick out one person out of everyone on the entire planet. So, you might think, “Fine, I’ll just disable all of those APIs.” Not only would that be annoying and inconvenient, but there are other tricks to even get around that as well. A script could render a hidden canvas in a browser. Inside that canvas, it can render some text, draw some shapes, a couple of emojis. Now, depending on your graphics card, browser settings, or installed fonts, there are tiny differences to how pixels are rendered
02:36 and smoothed. By reading the raw pixel data back, again you start to get a unique data point. Sound works the same way as well. A page creates a tone, runs it through an audio effect, and reads back the raw numbers. And different machines get slightly different numbers back. There are open-source libraries like FingerprintJS, which implement a number of these techniques to uniquely identify any browser. And even bot detection tools that use the same tricks as well. A user reported that when using AliExpress, their Bluetooth headphones oddly just wouldn’t play audio at all.
03:08 So, they dug into the page and found two pieces of audio code running in the background setting the volume to zero. They came from scripts for spotting bots, and those scripts also read the canvas and the graphics card name. Blocking the two of those scripts magically fixed the headphones. So, how does your browser look? The easiest way to check is Cover Your Tracks, a free site from the EFF, the digital rights group. You open it, click Test Your Browser, and it runs the same kind of checks that my page from earlier does. Here, I’m just testing normal Chrome. It says I’m not protected against tracking
03:40 on the web, and that my browser has a unique fingerprint. Further down, it lists every answer it collected and how many other browsers share each one. So, you can see exactly which answers are singling your browser out. Now, a fingerprint isn’t perfect. Fonts and browser versions change, so it does drift over time. So, how can you avoid this? Well, your first thought might be to add a privacy add-on, but those often make you stand out even more. Oddly, the protections that do work are built into the browsers themselves, and there are a few ways that you can do it. The first
04:10 is just to make everyone look the same. This is what Tor Browser and Mullvad Browser do. They give all users the same fonts, use the same time zone, and they round the window size to steps of 200 by 100 pixels, so everyone just blends into the same crowd. The second is to give every browser a slightly different random answer, and that’s exactly what Brave does. Firefox and Safari have started adding their own protections, too. Firefox said one update just last November cut the number of users who look unique almost in half in private windows, and Safari now stops
04:43 known fingerprint scripts from reading things like the canvas. So, if you want to avoid being tracked this way, skip the extra add-ons and use the browsers that have those protections built in. Then you can go back to the Cover Your Tracks website to see if your browser is still unique. And if you enjoy tech content like this, then subscribe for more. And if you want to see more right now, then check out this next video.