Clearing your cookies used to feel like doing something. In Fingerprints are the new cookies, developer royfish walks through why that feeling was mostly theater: sites can build a stable ID for you out of your hardware alone, no cookie required, no consent banner to click through, nothing to delete. The post hit the Hacker News front page and pulled 242 comments, and the thread is where the real argument happens.
Table of Contents
- What a fingerprint actually is
- The entropy math, in plain terms
- Cookies and fingerprints are not the same threat
- The pushback: fingerprinting isn’t as clean as it sounds
- The irony the thread kept circling back to
- What I’d actually do about it
- FAQ
- Sources
What a fingerprint actually is
A browser fingerprint is a hash built from dozens of small signals your browser hands over without asking. royfish splits them into two buckets. The network side is fragile: IP address, User-Agent, Accept-Language. These change when you switch networks or get a new IP from your ISP. The code side is the stronger signal, because it comes from actual hardware: GPU vendor and rendering behavior, CPU thread count, installed fonts, screen resolution, even how your audio stack processes a signal. None of this requires a permission prompt. A page can measure your GPU by asking it to render something and reading the result back, and you never see it happen.
That hash does not need to be globally unique to be useful. It only needs to be rare enough to separate you from everyone else in a tracker’s sample, and that’s where it stops being a cookie problem and starts being a different kind of engineering problem: a cookie is state you control, a fingerprint is a read-only measurement of hardware you can’t easily hide.
The entropy math, in plain terms
The part of the article worth bookmarking is the explanation of why a handful of boring signals adds up to something close to unique. royfish frames it through information entropy: every answer that narrows down which group you’re in is worth a certain number of bits, and the rarer the answer, the more bits it’s worth. A trait shared by half of people is worth one bit. A trait shared by one in 128 people is worth seven bits. Combine enough independent traits and the pool of people who match all of them collapses fast.
The article cites a concrete version of this: a ZIP code, a birth date, and a sex field are, together, enough to uniquely identify more than 60% of Americans, even though none of those three fields is unique on its own. A browser fingerprint works the same way. Millions of people run the latest Chrome. Fewer of them run it in French. Fewer still run it in French on a specific GPU model with a specific set of installed fonts. You don’t need an exotic signal to become identifiable, you need enough ordinary ones stacked together.
Cookies and fingerprints are not the same threat
A lot of the public conversation still treats the two as interchangeable. They aren’t:
- A cookie is a file on your device. You can see it, and you can delete it.
- A fingerprint is built from your hardware. There’s nothing to find or delete.
- Cookies require consent under EU law, which is why the banner exists.
- Fingerprinting runs silently in the background, with no banner and no prompt.
- Blocking third-party cookies does not reduce your fingerprint at all.
That last point is the one people miss most often. A browser that aggressively blocks cookies can still leave you maximally fingerprintable, because cookie blocking and fingerprint resistance solve different problems.
The pushback: fingerprinting isn’t as clean as it sounds
The strongest pushback in the discussion came from a commenter who pointed out that most commercial fingerprinting still leans heavily on IP address, not the exotic hardware signals the article focuses on, because IP is cheap to collect and good enough for most ad-targeting. Hardware-based fingerprints also aren’t as stable as the article implies: browser updates, OS updates and font installs all change the hash over time, which makes a fingerprint less reliable for long-term tracking than a cookie that just sits there unchanged.
Another commenter argued the 2018 EU cookie rules were never really about cookies specifically, they were about consent for tracking and profiling in general, and the law got nicknamed after cookies only because of how tracking happened to be implemented at the time. If that’s right, the fix for fingerprinting was never a new law, it’s the same consent requirement already on the books, applied to a mechanism nobody’s enforcing it against yet.
The irony the thread kept circling back to
The sharpest exchange was about privacy extensions. Someone asked why browsers don’t just randomize the values trackers read, so every fingerprint looks different on every page load. Another developer answered with the actual failure mode: randomized values are themselves detectable, because most real users don’t have randomized values, so a tracker can flag “this fingerprint looks artificially randomized” as its own signal.
The same logic applies to running a privacy extension at all. Fewer people install them than don’t, so installing one makes you rarer, and rarer is the opposite of what you want if the goal is to blend into a crowd. A tracker doesn’t need to defeat your protection, it just needs to notice it’s there.
What I’d actually do about it
None of this means fingerprinting defenses are pointless, it means the defense that works is different from the one most people reach for first. A single extension on an otherwise ordinary Chrome profile mostly signals “this person cares about privacy” without doing much to hide you. The approaches that hold up are built into the browser engine and applied to everyone who uses that browser, so no individual stands out for using it: Brave’s farbling adds small, consistent noise to the signals a page can read, and Tor Browser and Mullvad Browser try to make every user report the same values. Chrome and Edge stop at isolating one site’s data from another’s, without extending that model to fingerprinting at all.
If you want to know where you actually stand, coveryourtracks.eff.org measures your fingerprint’s entropy directly instead of asking you to guess. That’s a better starting point than installing an extension and assuming it worked.
FAQ
Does deleting my cookies stop browser fingerprinting?
No. A fingerprint is built from read-only measurements of your hardware and software, not from a file stored on your device. Clearing cookies removes stored state; it does not change what your browser reveals when a page asks.
Do privacy extensions make fingerprinting worse?
They can. Running an uncommon extension, or one that randomizes the values trackers read, is itself a detectable, rare signal. Fewer people run these tools than don’t, so using one can make your fingerprint rarer and easier to single out.
Sources
- Article: Fingerprints are the new cookies, by royfish.
- Discussion: Hacker News thread, for the counterpoints on IP-based tracking’s prevalence, the EU cookie law’s actual scope, and the irony of privacy extensions making you more identifiable.