Nothing Private
gautamkrishnar‘s proof-of-concept site that re-identifies a returning visitor in
private-browsing / incognito mode. Type your name, close the tab, reopen the site in a private window,
and it greets you by name. GPL-3.0, JavaScript + PHP + MySQL, 2,251★ / 163 forks, created
2016-12-16, last pushed 2025-12-09, demo at nothingprivate.gkr.pw (a snapshot taken 2026-08-13).
T3 — a working demonstration by one developer, nine years old and still maintained, with no measurement in it. It shows the mechanism rather than establishing a rate.
What it actually does
The fingerprint comes from Client.js, and the README lists the data points it hashes:
user agent, screen print, color depth, current resolution, available resolution, device XDPI, device YDPI, plugin list, font list, local storage, session storage, timezone, language, system language, cookies, canvas print
The name and the fingerprint go into MySQL on submit; the next visit looks the fingerprint up and returns the name. Nothing is stored on the client, which is the whole point — private mode clears the client, and the client is not where the identifier lives.
Why it belongs here
ip-reconnaissance names three leaks a VPN doesn’t close — WebRTC, DNS, and browser fingerprinting — and until now the spoke held a tool that tests for the third (myip) and no source on the technique itself. This one demonstrates it end to end, and it does so from the subject’s side: the visitor is the one being shown what they disclose.
It also states the corrective plainly, which most tracking writeups do not: “using private browsing or incognito mode will just help you to clear your browsing history” — your ISP, search engines and the sites themselves still track you. That is the specific misconception the demo is built to break, and it is the same defensive-education stance myip takes at the level of one connection.
The countermeasures list, and what it reveals about the mechanism
The repository carries a community-maintained table of browsers that defeat it, and the table is more informative than the demo. Both defences named there are about one data point, the canvas:
- Randomize the canvas readout so every read differs — firefox v78+, Tor Browser 10.0+, brave v1.11.104+, Ungoogled Chromium, Bromite, Pale Moon, BriskBard.
- Blank the canvas readout entirely, so every browser looks identical on that property and it stops discriminating — Tor Browser 8.0–9.5, firefox v58–77.
The README warns that under the blanking approach the site “may still look functional” while having lost the ability to separate visitors — a false negative built into the demo, disclosed by its own authors. It also says the list “only covers one aspect” of online tracking. Both admissions raise the source above a marketing demo; neither makes it a measurement.
The browsers in that table are the privacy current in ../web-browsers-wiki (brave, firefox),
which was the runner-up spoke for this source. The route came here because the subject is the
re-identification technique, not the browser market.
What it does not have
- No numbers. No entropy estimate, no collision rate, no share of visitors it can re-identify. The
demo measures nothing. Its own reference list pointed at the answer, and the research pass followed
it the same day: Panopticlick is cover-your-tracks, the study behind it is
eckersley-browser-uniqueness (83.6% of browsers unique, ≥18.1 bits), and
amiunique.orgis laperdrix-amiunique (89.4% unique, canvas among the top attributes). The demo was citing the evidence for its own claim without using any of it. - No modern baseline. The fingerprint surface it uses is the 2016 one. Plugin and font enumeration have been narrowed by browsers since, and the README does not track that.
- A PHP/MySQL backend, which makes the demo self-hostable and also means the live site holds the names visitors typed.
Related
browser-fingerprinting · ip-reconnaissance · myip · gautam-krishna · osint · mysterium-node · synthesis