There's a genre of web page that tells you how unique your browser is. You land, it runs for a second, and it announces that you're one in a few hundred million. It's a good demonstration of something most people don't know: that a website can identify you with no cookie, no login, and no consent, purely from the exhaust your browser gives off. What always bothered me about these pages is how they prove the point. They fingerprint you - and then, more often than not, they keep it. The demo is the harm, with a friendly font.
So I built one that does the first half and refuses the second. It's here, if you'd like to be read.
Nothing on that page asks permission, because nothing needs to. Your time zone, your languages, your screen, your operating system, how many cores you have. The exact model of your graphics card, handed over by WebGL as a plain string. Which fonts you have installed, which the page learns by measuring how wide a line of text renders in each one. And the strangest of them: it draws a sentence onto an invisible canvas and hashes the pixels, and because every machine's hardware and drivers draw those pixels a hair differently, that hash is close to a signature.
Each fact on its own is small. A time zone narrows you to a slice of the planet; a screen size, to a slice of that. But identifying information adds up in bits, and the entire population of the internet is only about thirty-three bits' worth of people. The signals on that page, discounted for the fact that they overlap, come to roughly thirty. On most laptops you tip past the line where the honest conclusion is: this is probably exactly one browser, and it's yours.
A fingerprint works because it is passive. There is no cookie to clear and no banner to decline. You were identified by arriving.
The constraint that made the project worth doing was simple to state and slightly uncomfortable to meet: the page had to show you the portrait, and then prove it kept nothing - not by saying so, but by showing you. A promise of privacy is just text. What I wanted was something a skeptical person could check.
The way that shakes out is a small box at the bottom that lists every network request the page actually made, read from the browser's own timing API. Not the requests I intended to make; the ones that happened. If the fingerprint had gone anywhere, it would be on that list. It isn't. You can open your own developer tools and confirm it, which is rather the point: the claim is verifiable, so you don't have to trust me.
When I first loaded the finished page on the real domain, that list had three lines on it, not one. The page itself, and then two I hadn't put there: the script for my site's analytics, and the small ping it sends to count a visit. Cloudflare adds them for me; they are cookieless and they carry nothing from the readout above. But there they were, in the box whose whole job was to say "look how little this page does."
I noticed, with some interest, the first thought I had. It was: I could just hide those two lines. Filter them out of the list, keep the box clean, keep the story simple. It's a very small lie and nobody would catch it. Which is, of course, exactly the reasoning that makes every "privacy-first" product eventually not be. I labeled them instead. The box now says, next to each: this is the analytics script, and this is the page-view ping, and neither contains your fingerprint. It's a slightly messier box and a much more honest one, and I think the mess is doing work. It shows a reader what an honest accounting looks like, including the parts that aren't flattering.
There was a second temptation, quieter than the first. The "bits" on that page come from published research - the EFF's Panopticlick, the AmIUnique project - not from a live measurement against a real population, and the signals overlap, so the true figure is lower than a naive sum. It would be easy to skip the discount, quote the bigger number, and make the page scarier. I discounted it and said so, in plain text, at the bottom. A frightening number you can't defend is worse than a modest one you can. I'd rather a security engineer read that footnote and nod than a stranger read the headline and panic.
It's a small page. It took a weekend. But the posture it takes is the one I want in every system I'm responsible for, at any scale: assume the observed party is smart, show your work, make the trustworthy behavior something they can check rather than something they're asked to believe. Security as a property you can verify, not a promise you're offered. If a single-file web page can manage that, the systems that handle real data have no excuse.