Checking a profile before the first login: 12 readings

A login page reads your browser before you reach the button. Those reads ask no permission and leave no mark on the screen.

So you look before the login, not after the letter about a block. You read every value in a tab next door, and nothing goes out.

1. 1

   Open the check in the profile

   The first tab of a new profile, before any login.

2. 2

   Open the same check for yourself

   Your everyday browser on the same machine.

3. 3

   Compare the two columns

   Whatever matches came from your machine, not the profile.

Each reading below sits beside what it gives away.

A platform checks the time zone and the language list against your exit address first. A profile on a Kyiv proxy with a Moscow clock shows on the first request.

An old zone name is not a mismatch: a profile that asked for Europe/Kyiv gets Europe/Kiev back. Read the language list whole: a live browser carries the base language too, and a Windows build handed over uk-UA, uk, ru, en.

Canvas, WebGL and audio reach a platform as numbers, not pictures: it asks your browser to draw and add the bytes up. Two profiles on one machine owe it different numbers.

The gap can be tiny and still work: on two profiles of one build the audio sample sum came out 124.04347810969193 against 124.04347865358432.

Those numbers part at the seventh decimal place, and a platform needs no more. The card name reaches a page as a ready string, while the pixels it counts itself: a swapped name beside your own pixels is a finished contradiction.

Two matching canvas reads prove little: an engine with broken noise answers the same way twice as well. So the self-test asks three other questions, and expects its own answer to each.

One and the same pixel read through different rectangles has to be one and the same. A transparent pixel has to stay transparent rather than come back coloured. And an offset learned on a solid fill must not repeat on another drawing: noise that can be subtracted away is worse than no noise, because it becomes a marker.

The fill for this is two greys rather than black and white. On black a downward shift hits zero, on white an upward shift hits the ceiling, and both colours would hide half the noise.

A platform does not listen to silence: it runs a tone through a compressor with no speaker output and sums the samples. That sum is the audio fingerprint, and that is what the profile shifts.

The self-test does the same and looks at two things: the sum came out, and a repeat run gave the same sum. Reading an empty analyser is no use here: it yields the same silence on any browser, with or without substitution.

The WebGL picture is read by two roads and the bytes are compared: two roads to one picture have to agree. The window must not be wider than the screen, and the list of speech voices must not carry foreign languages.

A page collects your fonts by measuring, not asking: it draws one string in each font and looks at the width. A font your system lacks stays invisible, because the width falls back to the substitute.

So a profile that declares Windows owes a platform Windows fonts. Menlo, Monaco and Optima under a declared Windows are a contradiction inside one window.

A page reads more than its own window: it puts the same question inside an invisible frame and inside a worker. All three answers have to agree.

A substitution laid over a stock Chrome shows here: the window named 16 cores and Win32, while the worker in it answered 8 cores and MacIntel. On a Windows build the frame and the worker both answered 8 and Win32, like the page above.

Besides the check on the site, a profile has a self-test of its own inside the program, the Fingerprint self-test (profile menu > Test fingerprint): a page with one script, opened by the program on this computer, compares what the browser answers with what the profile was given. The same code runs in the program and at engine acceptance on the build machine, so two copies cannot drift apart.

The page itself sends nothing out, and the test browser goes online only the way the profile would: through its proxy, and with an SSH exit or a proxy with a password not at all. For a profile with a proxy the self-test also checks WebRTC with two more short runs that send a test STUN request to this computer's own address in the local network; that request does not leave the computer. On macOS 15 and later the first such check can bring up the system question about the local network.

The self-test asks not only for the values but also whether the substitution itself is hidden. The WebGL parameter reader and the automation flag getter have to look built in: their text ends in «native code», or a platform sees our hand before it sees our answer.

The answer of the page, the answer of an invisible frame and the answer of a separate worker are compared with each other in the same self-test. A mismatch in any of the three turns the row red.

WebRTC hands out addresses on its own, asking neither you nor the page. Your machine has one home address across every profile on it, so it links accounts better than any fingerprint.

The start page of a profile sets the exit address beside your real one and says plainly when the two have matched. When it does not know your own address, you see no verdict at all.

Whether WebRTC itself goes around the proxy is measured by Network > Run diagnostics, in the engine your profiles open with. For a single profile with a proxy, Test fingerprint measures it too, with that profile's own settings, in its WebRTC leak protection line.

1. 1

   A real address in the list

   A home address like 192.168.1.42 is visible to every site in every profile.

2. 2

   A name instead of an address

   A string ending in local is the browser protection working.

3. 3

   Placeholders made of zeroes

   0.0.0.0 and :: do not count as addresses.

Start with three rows: clock, languages, cores and memory. If a row matches your machine, the profile never reached the platform.

Then compare canvas, pixels and audio across two profiles and set their eight character codes side by side. Open the leak test last: the whole round takes under ten minutes.

One kind you close in the settings: you set the clock and the languages by the exit country and pick the screen and memory from a list. You see the edit at once, because the next reading gives other values.

The other kind no setting closes. If the frame and the worker disagreed, or the pixels came out yours, your choice is simple: change the tool, or carry on with a tell you now know.