Fingerprints are the new cookies

514 points · 252 comments on HN · read original →

Points and comments are a snapshot, not live.

Browser fingerprinting is replacing third-party cookies as a more persistent tracking method.

The article demonstrates fingerprinting by assigning visitors a persistent nickname like Jazzy Narwhal, even after clearing cookies or using a VPN. Fingerprinting combines network data (IP, headers) with hardware measurements (GPU, CPU, audio processing, fonts) that are stable and often unique. The author calculates information entropy to show how combining traits like GPU model and language can uniquely identify users. Browser-level protections differ: Brave uses farbling (adding noise), while Tor makes all fingerprints look identical. Extensions like JShelter can be detected and may make users more unique. Google initially pledged to phase out cookies in 2019, then delayed, and now allows fingerprinting in its ad products.

What commenters are saying

Two camps: those arguing fingerprinting is already illegal under EU law (since consent banners were always about tracking, not cookies), and those pointing out that enforcement fails: users are still blocked by Cloudflare or forced into captchas despite using static IPs. Commenters note that SHA-256, JA3/JA4 fingerprints, and services like Fingerprint.com already prove the technology works. Some argue the privacy concern is overblown if data is deidentified, but others counter that fingerprinting is inherently deanonymizing. One commenter reports Brave's fingerprint obfuscation causes 2FA to flag every visit as a new device.