Device fingerprint

A page reads these in the first milliseconds of a visit and asks nothing for any of them. Each reading is ordinary on its own, and the set of them is not.

• Screen and pixel density

  The size in layout points and how many real pixels sit behind each of those points.

• The graphics string

  The vendor and renderer names the graphics chip reports, which on many machines name the exact model.

• Cores and memory

  How many processors the browser admits to and the figure it rounds its memory to.

• Touch points

  How many fingers the screen accepts. Zero on an ordinary desktop and five on most phones.

• Installed fonts

  Measured by drawing a string and comparing widths, which is ordinary page work and needs no permission.

These five come from the computer you are reading this on. A second browser on the same machine would repeat most of them exactly.

The readings have to belong to one machine that somebody actually built. A phone screen beside a desktop graphics string describes a computer nobody has ever sold.

So a profile draws a whole device at once rather than assembling one from readings each taken out of a list of its own.

• Phone models

  Each carries its own screen, pixel density, graphics string, cores, memory and vendor fonts.

  22

• Tablet models

  The same rule, with the touch points and the usable screen height of a tablet rather than a desktop.

  7

• Readings in the self-test

  Screen, memory, cores and the graphics strings are among them, each reported by name.

  29

The values are derived from the profile seed and handed to the engine as it starts. They are not written over the page by a script after it has loaded.

That is why the document, a frame and a worker answer the same numbers. All three inherit one source instead of being patched one at a time.

• Browser fingerprint

  The wider set, which also holds what the browser reports about itself and what it draws.

• Canvas fingerprint

  One drawing surface inside that set. The graphics chip shapes it, so the two overlap without being the same thing.

• A hardware serial number

  A page cannot read one. Everything here is inferred from behaviour a page is allowed to observe.

• A virtual machine

  It hands you a different device at the cost of tens of gigabytes, and it announces itself as a virtual machine.

The panel above shows five readings for this browser. Inside a profile the self-test names every device check it runs and shows what each one answered.

Then compare two profiles on one computer. Readings that differ across the pair are the whole point of the exercise.