How Websites Track You Without Cookies

Summary

The video explains how browser fingerprinting can identify users without cookies, even in incognito mode or while using a VPN. Incognito mode removes local browsing data, and a VPN changes the apparent IP address. Fingerprinting instead combines information exposed by the browser and device.

How fingerprints are assembled

Websites can query browser APIs for details such as screen size, time zone, language, and processor-core count. Each detail narrows the pool of possible users; together, many small clues can make a browser distinctive.

Canvas and audio techniques

A page can render text, shapes, or emojis in a hidden canvas and inspect tiny pixel-rendering differences caused by graphics hardware, fonts, or browser settings. Audio processing can also produce slightly different results across devices.

Demonstration

The narrator built a JavaScript page that creates a fingerprint without setting cookies. It produced the same ID in regular Chrome, an incognito window, and with a VPN enabled. The narrator says the demo is under 100 lines of code and provides a project link.

Real-world examples

The video cites FingerprintJS and bot-detection tools as examples of software that uses fingerprinting techniques. It also recounts a user report that background bot-detection scripts on AliExpress interfered with Bluetooth headphone audio. Blocking those scripts reportedly fixed the issue.

Limitations

Fingerprints can change when fonts or browser versions change, so they are not necessarily permanent identifiers.

How to test your browser

The narrator recommends EFF’s Cover Your Tracks, which reports whether a browser appears protected and how distinctive its fingerprint is, including which collected attributes make it stand out.

Ways to reduce tracking

The video advises against relying on extra privacy add-ons, which can make a browser more distinctive. Instead, it highlights browser-level defenses:

• Tor Browser and Mullvad Browser standardize details such as fonts and time zone, and round window sizes to help users resemble one another.
• Brave randomizes some answers.
• Firefox and Safari have introduced protections, including limits on certain fingerprinting techniques.

The suggested approach is to use a browser with built-in fingerprinting protections and then retest it with Cover Your Tracks.

Main speakers and sources

• Main speaker: An unnamed Better Stack presenter explaining and demonstrating browser fingerprinting.
• Sources and tools discussed: EFF’s Cover Your Tracks, FingerprintJS, Tor Browser, Mullvad Browser, Brave, Firefox, and Safari.
• Anecdote: A user report about AliExpress scripts and Bluetooth headphones.