security

Glassbox dev admits he had some help from Claude to build locally running tool

If you're curious how easily tech companies can fingerprint your browser and device and potentially single them out from the crowd, a new utility Glassbox will show you.

Aside from pinging a public geolocation API, it runs entirely in a user’s browser and doesn’t ship any info out to the web while acting just like all the various trackers, anti-fraud scripts, and other browser fingerprinting tricks one is likely to encounter online.

Unlike some other available tools that do the same, Glassbox provides a whole bunch of raw, unfiltered data you can sift through to see what makes your browser stand out, along with an estimate of how identifiable its fingerprint may be.  

In this vulture’s testing, Glassbox's estimate ranged from 99 percent in the Chrome window I use daily for work to a low of 56 percent in Tor Browser with an active circuit. 

“The ‘identifiability’ number is an honest model, not a measurement,” Glassbox developer David Dale said of his tool in a Hacker News thread. “It sums published per-signal entropy, discounts your browser masks, and caps at the ~33 bits needed to single out one person on Earth.” 

Dale added in the thread that, since it runs locally, that identifiability number is an estimate, as Glassbox doesn’t have a live population to pull against. AmIUnique and the EFF’s Cover Your Tracks, the other tools mentioned above, provide real population numbers, he noted. 

Dale got the idea for GlassBox after learning about silent sawtooth waves used by fingerprinting code found on Alibaba's AliExpress site to identify browsers using audio.

Rather than fork one of the existing open source tools - both EFF's Cover Your Tracks and AmIUnique have GitHub repos - he decided to build his own, with some help from AI.

“I'm a solo entrepreneur and long-time security engineer; tools like Claude Code have made it much easier to polish ideas and offer the useful ones to a wider audience,” Dale told us in an email.

“I knew a fair number of fingerprinting methods but not that one, and I wanted to see all of them in one place, running against my own browser,” he said on Hacker News. 

In other words, Glassbox factors Alibaba’s tricks into its identifiability estimates alongside 30 other probes for unique browser data - things like canvas, WebGL, font libraries, WASM features, API matrices, and cross-site login states. 

According to Glassbox, my particular Chrome session I use for work is unique to around 1 in 7.6 billion browsers, and my IP address narrows that further (my ISP apparently uses IPv6, making me even more identifiable).

As for which browsers appear to be safer, I have Safari, Edge, Firefox, and Tor on my machine alongside Chrome; Firefox and Tor are the only ones that didn’t label me “effectively unique,” giving me estimated identifiability ratings of 89 and 56 percent, respectively.

What that means is that I share the same fingerprint as 1 in 681 million Firefox users and 1 in 408 thousand Tor users - that still doesn’t exactly make me a ghost online, but it definitely puts me in a pool much larger than Chrome, Edge, or Safari. Again, those are estimates, Dale reminded us, not a hard truth as, he says, “a no-server tool [can’t] measure true rarity.” 

“The single highest-impact move is to use a browser that puts you in a large, identical crowd,” Dale explained in an email. “Counterintuitively, a heavily customized ‘hardened’ setup often makes you more identifiable, because almost nobody else looks exactly like it. Blending in beats standing out.”

Aside from using a browser that does a good job of obfuscating its user, Dale said a VPN or Tor is a must, as is finding a way to close the WebRTC leak that has long dogged internet users and leaves browsers identifiable through some VPNs thanks to being enabled by default in most web browsers. 

Glassbox includes a page of suggestions for how to anonymize yourself online, and let’s face it: With everything from invisible pixels to silent sound waves doing their damndest to figure out who’s behind a browser in order to make money off them, that’s more important than ever. ®