frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

A web page that shows you everything the browser told it without asking

https://sinceyouarrived.world/taken
96•mwheelz•3h ago

Comments

superkuh•1h ago
With javascript off it just stalls at "reading" forever. There are certainly some viewport properties and other things it does know even without JS execution, but the mitigation is significant. And the page itself (the JS application) cannot act on that data or communicate it. Instead it has to be processed by some other application on the backend or wherever. Not in my browser by my computer.
Steve16384•1h ago
I can't help feeling that if you're turning JS off, you might as well turn off your computer to protect your data.
andai•43m ago
Nah, HTTP logs still leak my circadian rhythm.
MarkusQ•43m ago
That's actually a fantastic idea!

Oh wait, no, I'm an e-addict. Drat! Curse this monkey!

dylan604•36m ago
As an experiment, I made a small retail shop (< 30 products) that would use JS for modern style async/await calls, but would then use old school POSTs if JS was disabled with full page reloads on every POST. it sucked to dev and as UX, but it was possible to do. Had the non-JS POST style updates been any less annoying, it might have been viable. Nobody likes full reloads. They suck. JS can do nice things for UX. It's just that we can't have nice things because people suck
MarsIronPI•32m ago
This site actually works just fine without JS.
mrpopo•1h ago
Happy to say that my browser didn't tell anything that I didn't expect it to. It even identified my IP from a location 1000km away from me.

Firefox on Android with ublock

wincy•1h ago
My battery is at NaN%, the site is cool but it should probably change the text if I’m not actually exposing that information.

It got the city wrong but close to where I live. This stuff would be wildly wrong if I fired up my VPN. Although its annoying when I connected to a VPN to Steam it’ll often show my prices in Canadian dollars instead of USD.

freedomben•1h ago
Heh, my battery (which I don't have cause this is a desktop) is at 100% apparently
dylan604•48m ago
Battery: kept back Your browser kept your battery level back. Firefox removed this API entirely in 2016, after researchers proved it could be used to track a visitor across websites without cookies, without consent. The API still exists in the specification. It was simply hidden — from you, and from any page that might ask after it.

Well, at least something positive from the shit I take for not sheepling my way through life using Chrome

Multicomp•1h ago
Mine told me my graphics card was "or similar" so my stock Firefox is doing at least okay.

While I still follow the general privacy first tenets, I have ended up backing off on some tools (noscript and librewolf) at the extremes of privacy because if every site is going to track everything by my IP or by my ASN or browser fingerprint, I do have a happy medium of being private enough while not being utterly broken in my browsing.

Roughly that looks like email aliases on demand via sieve rules, ublock origin with liberal use of filter lists, different handles and a password manager, frozen credit ratings, and Tailscale exit nodes or Mozilla(Mullvad) VPN for uncontrolled WiFi access points for my jnrootabke android device and mostly signal for comms.

I'm getting to old to be a privacy extreme enthusiast when all of my family side channels everything straight to Facebook, so this is the impure level of privacy I can sustain.

Milpotel•57m ago
Same for me, also the "screen" size is off (just shows window size), the location is off by hundreds of kilometres and other information is quite generic (battery level "kept back", small set of standard fonts available...).
freedomben•1h ago
I guess I shouldn't be surprised that it gives my exact GPU, but that was surprising to me. Just so everyone knows, its an AMD Radeon RX 6900 XT and I paid way too much for it during the covid/crypto price explosion when they were sold out everywhere. Still a bit raw about that, but it is an excellent card on Linux (fedora)
scragz•52m ago
you are using a Radeon RX 6900 XT on Fedora Linux. we know this because you admitted it in the previous comment.
ape4•50m ago
Yeah the exact kind shouldn't matter - just the WebGL capabilities.
dylan604•49m ago
"Your graphics processor identified itself as or similar"

guess mine isn't such a specific model as yours. so I don't have a real GPU, i have something similar to a GPU??? did I get a knock off Alibaba version?

stusmall•48m ago
I got "or similar" from Firefox and exact make and model from chrome. Probably a browser issue and not a hardware issue.
dylan604•43m ago
not regretting choice of browser at all
mwheelz•4m ago
Confirmed. Firefox's privacy hardening returns "Mozilla, or similar" or just "Mozilla" as the renderer string. Chrome doesn't (yet). My parser was treating the Firefox string as if it were ANGLE format and grabbing the wrong half. Fixed.
mwheelz•39m ago
Real bug. Firefox returns "Mozilla, or similar" for the renderer string and my parser was grabbing the second half. Fixed; pushing in a minute. Your GPU is fine. Your browser is doing the right thing.
mwheelz•39m ago
The GPU string really is the spicy one combined with screen + fonts it's enough to single you out across most of the open web. The card itself is a tank.
2ndorderthought•28m ago
Yea that is a strong fingerprint. Especially if any of the other things were correct or someone has a way to model your behaviors. How long you scroll vs how often you type etc. and somehow that's still not enough for big tech and they need biometrics, photo IDs, etc.
tgv•34m ago
It got mine quite wrong (Firefox).

The thing that bothered me is that browser are still sending the Referer info. I thought that was not supposed to work under https?

aidanbeck•1h ago
Aside from the fingerprinting methods, the graphics processor string seems to be the most immediately personal data given up (other than location, which was incorrect for me). I could see sites tailoring ads around an assumed class, income, and level of digital literacy based on this data point alone.
chrisweekly•1h ago
I appreciate the intent here, so this is constructive feedback:

  - Some of the numbers are off, eg 
"Your browser allocated 39322 MB of storage to this page alone"

  - low contrast in dark mode makes text hard to read
mwheelz•35m ago
The 39 GB number is a bug. I was reading quota (browser allow-up-to ceiling) and calling it "allocated." Fixed; pushing now. Contrast is intentional but I hear you. not changing it but noted, and a cleaner reading mode is on the to-do later.
topham•27m ago
Contrast is a violation of accessibility guidelines.
yakkomajuri•1h ago
DuckDuckGo browser helped mask some stuff, but definitely a fair amount still goes through.

Annoyingly the web is becoming a bit more annoying to browse as a DuckDuckGo (mobile) and Brave (desktop) user. With a VPN on top it gets even worse.

Gualdrapo•1h ago
Text is so dim is really hard to read.
ebolyen•1h ago
There's really a lot more you can look at here. Lot's a prior art on super-cookies and fingerprinting:

https://coveryourtracks.eff.org/

https://amiunique.org/

cf100clunk•49m ago
Another info leakage feedback tool:

https://www.ipleak.com/full-report/

mwheelz•36m ago
Both linked in the Sources & Confessions modal at the bottom. Cover Your Tracks is the spiritual ancestor of this whole piece. amiunique is more rigorous; this is the editorial cousin.
cf100clunk•32m ago
Brutally dark site doesn't seem to show much to my eyes. No modal appearing at the bottom.
card_zero•45m ago
* I'm not in that city.

* It's running a kind of Chrome on a kind of Linux, at a stretch.

* Nobody can infer when I work and when I sleep. That includes me.

* The recent, high-end display is the screen of a low-end tablet I bought in a supermarket five years ago.

* But yes, browser fingerprinting is annoying.

* Since you can detect light mode, would it kill you to honor it?

delichon•17m ago
It was much better for me.

* Your socks don't match anything in the room.

* The man you thought you killed in Tuscaloosa woke up and walked home an hour later and is now a chiropractor in Shreveport.

* Your daughter is pregnant by the kid who trims the hedges.

* Your dog is dreaming about the squirrel in the wood pile.

How does it know?

BugsJustFindMe•16m ago
* That's the wrong battery percentage and the wrong charging status.

> Since you can detect light mode, would it kill you to honor it?

It would probably still be low contrast garbage even if it did. :/

ramon156•43m ago
Its mixing confidential info. For example, you know I'm connected from a location, but you do not know my precise location. I connected from a tower that is from Odido, but I am not paying Odido for a subscription.
mwheelz•5m ago
Right, IP-to-geo is approximate and gets a lot of cases wrong (yours among them). Most ad networks use it as a region/DMA hint, and not precise positioning. The point of including it isn't precision. It's that any location is more than nothing, and the visitor never opted in.
thatguy0900•43m ago
Man what a awful looking site. I shouldn't have to crank my brightness to max to kind of read the words
fodkodrasz•14m ago
I agree, this site is an eyesore.

I use windows color filters (Grayscale inverted is my preferred, in the past I used plain inverted) for poor man's dark mode (or light mode in this case) for stuff that doesn't honor my color scheme and hurts my eyes. It also has a hotkey, so it is really handy sometimes, but you need to enable it in the settings.

Assistive technologies are great, not only because they benefit those who have no choice but to rely on them, but also they can benefit the luckier people.

aziaziazi•42m ago
> Your screen is 320 by 568 pixels, rendered at 2x density — which means it is almost certainly a recent, high-end display.

It’s been a long time my 2016’ iPhone as been called recent or high-end but I’ll take the compliment, thank-you.

crazygringo•38m ago
This is just... silly. Everything it told me, while browsing on my iPhone, seems entirely reasonable.

> Every page you have ever visited knows at least this much. Most of them know more. None of them told you.

So? Why would I want the news site I'm visiting to "tell me" it knows my preferred language, that I'm using light mode, or the estimated location of my IP address...?

It's not surprising that a browser which renders text can be used to identify which fonts are available. It's not surprising that a browser which allows calculation with your GPU will identify your type of GPU.

The "without asking" framing is just silly. I expect to be asked for consent to use my webcam or microphone or exact precise location. But the last thing I want is to be asked for permission around detecting my local time zone or preferred language or my screen resolution or 20 other totally reasonable things for a website to be able to know.

Retr0id•38m ago
> Your screen is 1512 by 982 pixels, rendered at 2x density — which means it is almost certainly a recent, high-end display. Your device volunteered all of this in the first milliseconds of the connection.

No it didn't. It was queried by the JS running on the page. It's a fun demo but it could really do without the slop prose.

mwheelz•6m ago
Pedantic but right. The JS queries them; the browser returns them without prompting the user. "Volunteered" is the editorial verb for that round-trip but it does paper over a layer.
troyvit•38m ago
> Your graphics processor identified itself as or similar.

That checks out. I think what I have is similar to a graphics card but isn't quite.

pona-a•36m ago
A vibe-coded EFF Cover Your Tracks. The fact this made it to front-page is spookier than its contents
joshstrange•36m ago
It's somewhat interesting but over half of what it talked about is just silly.

- Reverse IP/geocode (while be cute about "we won't show your IP", oh no, not my IP!)

- Timezone - Ok, yeah, lots of websites need/make use of that for completely legit tasks

- Browser/OS/Screen size - boring, again mostly needed or historical

- GPU - Again, not super interesting IMHO

- Battery - Ok, this is the first one I think should be behind a permission dialog

- Language - Come off it, that's just table stakes

- Fonts - Again, not sure how else this should work in a "perfect" world

- Cookies/dark mode/DnT/etc - Ehh, again aside from fingerprinting (which ruins everything) these are all QoL improvements IMHO

- Referrer - Again, this is just how the web works

I think the websites that take all of that and show you a fingerprint or show the data in a more data-oriented way are way more compelling.

This, almost certainly vibe-coded, website doesn't do anything novel and hits on a huge pet peeve of mine: using low-quality arguments for a legit issue (fingerprinting). By mixing in stuff like your IP/Language on the same level as Battery/GPU/other-fingerprinty-things it makes the whole argument less compelling.

nathanmills•32m ago
You can't gaurentee any of this is fingerprintable without checking twice (i.e. give the user a unique url, then ask them to restart the browser and visit it). In privacy browsers like LibreWolf or Mullvad Browser this is almost all spoofed, save for things like the IP which needs to be hidden/changed independently of the browser.
romanows•29m ago
Lol, the description text is so dramatic.
carimura•29m ago
Aren't LLMs smart enough to choose better color contrast by now?
IdiotSavage•25m ago
> Where you were before

> news.ycombinator.com

This has always bothered me the most. I disabled the 'Referer' header once, but it breaks many websites.

lucideer•23m ago
The website is pretty & the overdramatic copy is fun, but there's much better fingerprinting demos out there.

The number of data points shown here is low - there's plenty more it could be checking - & a good number of them seem to be wrong (it's only detecting one as explicitly "withheld" but I believe a few of them actually are, leading to garbled output).

Needs some QA.

rappatic•22m ago
Vibecoded slop with LLM-written copy. When will it stop
efilife•14m ago
We desperately need some tagging system/convention here. Maybe just putting [AI] into the title. This bullshit is getting really tiring.

It looks like this is an ad by the way, check op's posting history

sgarrity•20m ago
I'm not worried about my privacy. No one can read the dark text on that page anyhow.
efilife•15m ago
We've seen tens of pages like this, all done better. Now the vibe coders got into it and completely fuck up the idea.
htx80nerd•14m ago
>OH MY GOD WE KNOW STUFF ABOUT YOU

peoples obsession with 100% privacy while operating in a public space is immature. if you're that risk averse dont connect to the internet.

culi•5m ago
Most of this is pretty standard stuff but one thing I did learn is some of the fingerprinting techniques I wouldn't've thought of. Like Mozilla/Apple not sharing GPU or battery information being used to confirm which browser I use even if I fake the User Agent String.

Poland is now among the 20 largest economies. How it happened

https://apnews.com/article/poland-economy-growth-g20-gdp-26fe06e120398410f8d773ba5661e7aa
528•surprisetalk•3h ago•450 comments

Serving a Website on a Raspberry Pi Zero Running in RAM

https://btxx.org/posts/memory/
32•xngbuilds•54m ago•7 comments

An Introduction to Meshtastic

https://meshtastic.org/docs/introduction/
185•ColinWright•4h ago•69 comments

PC Engine CPU

https://jsgroth.dev/blog/posts/pc-engine-cpu/
45•ibobev•1h ago•5 comments

Google Cloud Fraud Defence is just WEI repackaged

https://privatecaptcha.com/blog/google-cloud-fraud-defence-wei/
54•ribtoks•2h ago•15 comments

Podman rootless containers and the Copy Fail exploit

https://garrido.io/notes/podman-rootless-containers-copy-fail/
38•ggpsv•2h ago•5 comments

Show HN: Git for AI Agents

https://github.com/regent-vcs/re_gent
21•doshay•1h ago•12 comments

Cloudflare to cut about 20% workforce

https://www.reuters.com/business/world-at-work/cloudflare-cut-over-1100-jobs-2026-05-07/
1096•PriorityLeft•19h ago•746 comments

Canvas online again as ShinyHunters threatens to leak schools’ data

https://www.theverge.com/tech/926458/canvas-shinyhunters-breach
846•stefanpie•17h ago•552 comments

GeoJSON

https://geojson.org/
93•tosh•6h ago•43 comments

Maybe you shouldn't install new software for a bit

https://xeiaso.net/blog/2026/abstain-from-install/
717•psxuaw•17h ago•384 comments

ClojureScript Gets Async/Await

https://clojurescript.org/news/2026-05-07-release
213•Borkdude•9h ago•53 comments

A web page that shows you everything the browser told it without asking

https://sinceyouarrived.world/taken
99•mwheelz•3h ago•58 comments

Rumors of my death are slightly exaggerated

785•CliffStoll•2d ago•107 comments

Dirtyfrag: Universal Linux LPE

https://www.openwall.com/lists/oss-security/2026/05/07/8
732•flipped•20h ago•304 comments

The map that keeps Burning Man honest

https://www.not-ship.com/burning-man-moop/
716•speckx•1d ago•333 comments

Pinocchio is weirder than you remembered

https://storica.club/blog/pinocchio-in-italian/
248•cemsakarya•2d ago•101 comments

Dithering with CSS

https://ikesau.co/blog/dithering-with-css/
88•speckx•4d ago•25 comments

Hackers breach JDownloader's website to serve malware-laced downloads

https://www.neowin.net/news/if-you-downloaded-this-popular-software-recently-you-might-have-insta...
70•bundie•3h ago•23 comments

Agents need control flow, not more prompts

https://bsuh.bearblog.dev/agents-need-control-flow/
548•bsuh•23h ago•265 comments

Tesla is recalling its cheaper Cybertruck because the wheels might fall off

https://www.theverge.com/transportation/926741/tesla-cybertruck-cheaper-recall
131•droidjj•2h ago•125 comments

QBE – Compiler Back End

https://c9x.me/compile/
53•smartmic•9h ago•10 comments

A polynomial autoencoder beats PCA on transformer embeddings

https://ivanpleshkov.dev/blog/polynomial-autoencoder/
80•timvisee•3d ago•22 comments

GPT-5.5 Price Increase: What It Costs

https://openrouter.ai/announcements/gpt55-cost-analysis
147•gmays•15h ago•38 comments

Brazil's Pix payment system faces pressure from Visa and Mastercard

https://www.elciudadano.com/en/brazils-pix-payment-system-faces-pressure-from-visa-and-mastercard...
333•wslh•22h ago•279 comments

Singapore introduces caning for boys who bully others at school

https://www.theguardian.com/world/2026/may/06/singapore-caning-school-bullies
287•rustoo•2d ago•421 comments

Nintendo announces price increases for Nintendo Switch 2

https://www.nintendo.co.jp/corporate/release/en/2026/260508.html
207•razorbeamz•9h ago•181 comments

Hardening Firefox with Claude Mythos Preview

https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/
297•HieronymusBosch•23h ago•131 comments

DeepSeek 4 Flash local inference engine for Metal

https://github.com/antirez/ds4
457•tamnd•1d ago•132 comments

Natural Language Autoencoders: Turning Claude's Thoughts into Text

https://www.anthropic.com/research/natural-language-autoencoders
345•instagraham•22h ago•108 comments