This is a real version of the critique and I've been thinking about it. The page leans on an IP-to-geo lookup that's known to be approximate (city-level on a good day, region-level often, wrong-city sometimes); accuracy isn't the point, any location, given without asking, is the point. But you're right that leading with a wrong answer gives readers permission to dismiss the whole. Considering opening with timezone instead and demoting geo to later, where it lands as "we tried, here's how close we got." Open to better suggestions.
Fair point, and you're right. On iOS the stock font set is essentially uniform across devices in the same OS version, so the "nearly unique" claim doesn't hold there. Just pushed a hedge: prose now distinguishes between desktop (where fonts accumulate via apps and OS over time, and the bundle is genuinely identifying) and iOS/Android (where it isn't, on its own). Combined with screen + GPU + language + timezone the iOS version still narrows the field, but the prose shouldn't overclaim. Thanks.
Thanks for that. The page isn't trying to tell anyone something they don't already know, it's trying to put it in front of the people who haven't been told. The bug reports today have been gold and the volume is meaningfully better for them.
Yeah, the bottom counter on the page is meant to make exactly that point. Mouse movements, scroll velocity, tab switches, reading pauses are all features in modern fraud / "trust" scoring systems alongside the static fingerprint. Biometrics is the next layer, and it's already happening on the back of "passive" liveness detection most people never see.
Confirmed. Firefox's privacy hardening returns "Mozilla, or similar" or just "Mozilla" as the renderer string. Chrome doesn't (yet). My parser was treating the Firefox string as if it were ANGLE format and grabbing the wrong half. Fixed.
Right, IP-to-geo is approximate and gets a lot of cases wrong (yours among them). Most ad networks use it as a region/DMA hint, and not precise positioning. The point of including it isn't precision. It's that any location is more than nothing, and the visitor never opted in.
Pedantic but right. The JS queries them; the browser returns them without prompting the user. "Volunteered" is the editorial verb for that round-trip but it does paper over a layer.
The 100% charging readout is the desktop-with-no-battery phantom. I pushed a stricter filter for that earlier, you may be on a cached copy (try a hard refresh). On the light-mode call: the page detects your preference but doesn't honor it, intentionally. The irony being that the demo ignores the same signal it points out. I take the cost of the annoyance.
The Referer header is the one that's hardest to opt out of cleanly, strip it at the network level and too many things break. Referrer-Policy lets the origin set the rule, but the visitor doesn't get to choose. There's a quiet move toward Referrer-Policy: strict-origin-when-cross-origin as a sane default in modern browsers but it's still origin-dictated, not visitor-dictated.
Correct on rigor. Proving a fingerprint requires the two-visit protocol you describe. The page doesn't actually compute a stable fingerprint or attempt to track returning visitors, it shows you the signals that go into one. The barcode at the bottom is deterministic from the data shown but isn't compared against anything stored. Sloppier than a real fingerprinting tool, by design.
Right that most of these aren't surprises individually, and right that nobody wants a permission prompt for Accept-Language. The argument isn't that you should, it's that the combination is enough to identify you across sites without your awareness, and that the wider tracking ecosystem trades on that bundle. The piece is editorial about the thing existing, not a proposal to gate every header. Reasonable to push back if you find the bundle isn't the point.
Fair pushback, and partially right. Most of these data points are individually defensible. Accept-Language helps with localization, Referer is just how links work, timezone is universally useful. The page's argument isn't that any single one is bad; it's that the bundle is identifying. Panopticlick / Cover Your Tracks measures combinatorial uniqueness, not any single point. The piece could be sharper about the distinction. Noted.
Update: I pushed two rounds of fixes for things people caught.
1. GPU "or similar" stranded prose. Firefox returns "Mozilla, or similar" as the masked renderer string and my parser was grabbing the second half. Masked-GPU case now gets its own observation.
2. Desktop battery showing NaN/100%. Chromium reports a phantom 100%-charging battery on machines without one; my filter was too narrow. Stricter check, falls through to "kept back."
3. Storage quota of 39+ GB reading as implausible. Now expressed in GB, and the prose was reworded ("would let this page write up to" rather than "allocated to").
4. Screen size matching window size (Firefox letterboxing / Brave farbling). Page now names it: "your browser appears to be returning the viewport in place of the real screen — anti-fingerprinting at work."
5. "Recent, high-end display" being claimed on old retina devices (iPhone 5-class). Tightened the heuristic.
6. No-JS hangs at "reading." <noscript> block added.
Worth saying directly since it came up. The prose is hand-written. Each observation has a small set of templated registers and the code selects among them based on what the data returns. There is no LLM in the runtime path. AI helped me iterate on the spec like it does for most projects now. The sentences on the page are mine. If that's not the kind of work you're in the mood for, fair, but the slop charge is wrong.
The 39 GB number is a bug. I was reading quota (browser allow-up-to ceiling) and calling it "allocated." Fixed; pushing now. Contrast is intentional but I hear you. not changing it but noted, and a cleaner reading mode is on the to-do later.
Both linked in the Sources & Confessions modal at the bottom. Cover Your Tracks is the spiritual ancestor of this whole piece. amiunique is more rigorous; this is the editorial cousin.