Session Context: the site that shows what your browser knows about you

The Session Context project (sessioncontext.org) isn't an article but a working illustration: the page shows in real time what it has managed to learn about the user who dropped by, and it drives home the main point — none of it required consent. The conclusions surface on their own, the moment the last data-collection pass finishes.

What can be read without a single request

The site breaks down what it has gathered into several groups: browser, screen and document parameters; storage, network and devices; graphics, audio and performance fingerprints; and, finally, the reduction of it all to a single identifier. Separately, it demonstrates that some of the data is sent by the browser itself, with every request, before even a single line of JavaScript runs — headers, language, supported compression formats. Blocking scripts won't stop this.

There's an interactive experience too: the visitor is asked to type the phrase “the quick brown fox…” twice, after which the page determines from the rhythm of the keystrokes (not from the text itself) whether it's the same person back at the keyboard.

The arithmetic of entropy

The authors honestly refuse to tell you that you are “one in 286,777”: such an estimate would require a database of other visitors — and keeping one would mean becoming exactly what the page argues against. Instead, they cite research findings (Laperdrix, Rudametkin, Baudry, IEEE S&P 2016, 118,934 browsers; Eckersley, PETS 2010). They show how many bits of entropy each signal yields and how the situation has changed: the plugin list, once the strongest feature (11.1 bits), is now nearly useless because browsers froze it; canvas rendering (8.3 bits) still holds up, and Chrome, unlike Firefox and Safari, never did add randomization.

An important caveat is made along the way: bits can only be added up for independent signals, and these are heavily correlated — a machine with a Retina screen is more likely to also report Apple fonts and an Apple chip. The naive sum of 63 bits (“one browser in 7 quintillion”) is called absurd precisely as a warning.

Permissions you can't take back

A separate section is devoted to the capabilities that do ask for consent: precise geolocation, camera and microphone, clipboard contents, connected monitors, installed fonts and applications. For each item it shows the “distance” between what the page has already worked out without asking and what will open up once you click “Allow.”

The ending is especially sobering. The page writes a single identifier into seven places on the device at once, and the server adds an eighth — to the browser cache. The point of the duplication is that clearing one copy doesn't touch the others, and the one that survives will restore the erased ones on your next visit. As for the permissions.revoke() method, it was removed from browsers long ago and never replaced: a permission once granted can be revoked only by the browser itself, through the site's settings.

Source: Lobsters