Academy
Why platforms link accounts
Lesson 1 of 14
What gets compared
Every visit hands over a set of answers: the graphics card, the fonts, the screen, the clock, the languages, the address the request came from.
None of that is secret and none of it needs permission. It is how the web works, and a platform reads it before it reads your login.
The device
How your machine draws a picture, what fonts it has, how many cores it reports.
The way out
The address, its owner, the country, and whether it looks residential or hired.
The session
Cookies, storage and the logins already sitting in the browser.
The behaviour
When you act, how fast, and in what order.
Four signals, and what closes each
The rest of these lessons walk this table from the top. The last row has no browser answer, and pretending otherwise is where most of this trade loses its credibility.
| What is compared | What it is | What closes it |
|---|---|---|
| The device | Graphics, fonts, screen, clock, cores | A separate profile: its own derived machine |
| The way out | The address and the country behind it | A proxy per profile, and a country that matches the clock |
| The session | Cookies, storage, logins already present | A separate folder per profile, nothing shared |
| The behaviour | Timing, speed, order of actions | Nothing in a browser. This one is yours |
One machine is one person
Two accounts answering with the same device are one person to a platform, whatever the names say. That is the cheapest and most reliable signal it has.
It does not need to be certain. It needs to be right often enough, and a shared device is right often enough.
The address is half the story
An account opened in Berlin and used from Sao Paulo an hour later is a flag no device setting can cover.
Two accounts leaving through one address is the same signal from the other side: one exit, two identities.
Why a clean browser is not enough
Clearing cookies removes the session, not the machine. The next visit answers with the same graphics card and the same fonts.
Private browsing forgets the session when the window closes. The device is computed fresh each time and comes out the same.
What separate profiles change
A profile is a separate browser: its own folder, its own derived device, its own way out. Two of them have nothing in common to compare.
That removes one class of signal. It does not remove the others, and the rest of these lessons are about the others.
What it does not change
Behaviour, content and account history stay yours. A platform that sees fifty accounts posting the same text at the same minute does not need a device to link them.
This is the part most of this trade does not say out loud, and it is where most accounts are actually lost.
What this lesson does not claim
- It does not claim that separate profiles make accounts safe. They remove one signal out of four.
- It does not describe any single platform's rules. Those differ and they change.
- It does not tell you how many accounts are acceptable. No number is safe for everyone.
Where you can see this yourself
Every claim here is something you can read on your own machine.
- The 29 measurements the app takes of a profile
- apps/desktop/src/lib/fpAudit.js
- The free check that reads 12 values in your browser
- apps/web/components/tools/FingerprintCheck.tsx
- The leak test that asks your browser for its own addresses
- apps/web/components/tools/LeakCheck.tsx
Questions
- Is a VPN enough?
- It changes the address and nothing else. The device answers the same way through any tunnel.
- Do platforms admit they do this?
- They describe it as protecting accounts rather than as linking them, and the mechanism is the same either way.
- If I never reuse an address, am I fine?
- You have closed one of four doors. The other three are the device, the session and the behaviour.
- Why does the order of these lessons matter?
- Because each one removes a signal, and removing them out of order leaves the cheapest one standing.
See what your browser answers
The check reads 12 values and sends nothing anywhere.