Zero-Telemetry Browser Fingerprint, TLS/ECH & URL Sanitizer Workbench

Beyond Third-Party Cookies: How Stateless Browser & Transport Fingerprinting Works

Deprecating cross-site tracking cookies and blocking known analytics domains in uBlock Origin stops naive session storage, yet commercial identity graphs (FingerprintJS Pro, ThreatMetrix, Akamai Bot Manager, DataDome, and Real-Time Bidding SSPs) routinely re-identify returning visitors across cleared cookies, incognito windows, and rotated VPN servers. Stateless re-identification succeeds by combining high-entropy JavaScript hardware probes with transport-layer TLS/HTTP2 protocol signatures and URL click-ID decoration.

Following the landmark Laperdrix et al. (AmIUnique) and Eckersley (Panopticlick) studies, an adversary links two visits whenever the joint surprise (self-information) across independent browser and network attributes exceeds the log2 size of the active user population (~33 bits for the entire 8.1 billion human population, and often 18 to 24 bits within a single regional ISP or publisher cohort):

Total Identifying Information I(X) = - sum_k log2 P(attribute_k = observed_value_k)

  1. Canvas 2D Font & Bezier Subpixel Hash       : ~5.5 to 8.5 bits
  2. WebGL Unmasked Vendor + Renderer + Limits   : ~6.0 to 9.5 bits
  3. Screen / Viewport Geometry + Pixel Ratio    : ~4.2 to 6.8 bits
  4. OfflineAudioContext Compressor Float Sum    : ~2.5 to 4.5 bits
  5. Timezone + Intl Locale + Installed Fonts    : ~3.5 to 6.0 bits
  6. Navigator CPU Cores + RAM + Platform        : ~2.8 to 4.2 bits
  7. Transport TLS 1.3 JA4 + HTTP/2 AKAMAI Frame : ~5.0 to 7.5 bits

Unlike commercial "Am I Unique?" scanner websites that harvest your live fingerprint into a server-side research or ad-tech database the instant the page loads, Tab 1 (Client Entropy Probe) and Tab 2 (72-Param URL Sanitizer) execute 100% locally in JavaScript RAM with zero automatic network calls. Only Tab 3 (Stateless /api/tls-echo) transmits a single minimal GET request to our zero-storage Cloudflare Worker endpoint if and only if you explicitly click the opt-in button, because no client-side script can observe its own outer TLS 1.3 cipher negotiation or Encrypted Client Hello wire state from inside the DOM.

Deep-Dive Anatomy of the Six Browser & Network Entropy Surfaces

1. HTML5 Canvas 2D Subpixel Rasterization

When a webpage draws overlapping curved paths, translucent RGBA gradients, emojis, and serif/sans-serif text onto an offscreen <canvas> element and invokes canvas.toDataURL() or ctx.getImageData(), the resulting pixel array varies subtly across operating systems and GPUs. Font hinting engines (Apple CoreText on macOS/iOS, DirectWrite / ClearType on Windows, FreeType / Cairo on Linux/Android), GPU anti-aliasing sample tables, and color-space gamma conversion alter least-significant RGBA channel values. Hashing those pixel bytes yields a stable device signature unless the browser intercepts readback via per-domain farbling (Brave) or permission gating / standardized software rasterization (privacy.resistFingerprinting in Firefox, LibreWolf, Mullvad Browser, and Tor Browser).

2. WebGL WEBGL_debug_renderer_info & Shader Precision

Originally exposed to help 3D game developers work around buggy graphics drivers, the WEBGL_debug_renderer_info extension (UNMASKED_VENDOR_WEBGL = 0x9245, UNMASKED_RENDERER_WEBGL = 0x9246) hands any script your exact silicon string (for example, ANGLE (Apple, Apple M3 Max, OpenGL 4.1) or NVIDIA GeForce RTX 4080 Direct3D11 vs_5_0). Even when unmasked strings are redacted, sophisticated scripts measure MAX_TEXTURE_SIZE, ALIASED_LINE_WIDTH_RANGE, and GLSL fragment-shader floating-point precision bounds (getShaderPrecisionFormat). Hardened browsers sanitize or mask WEBGL_debug_renderer_info to generic values, and ultra-high-threat profiles (Tor Browser Safest / Vanadium per-site toggle on GrapheneOS) disable WebGL and JIT compilation completely on untrusted origins.

3. OfflineAudioContext Dynamics Compressor Summation

Unlike microphone capture, OfflineAudioContext requires zero user permission prompt because it synthesizes mathematical waveforms entirely in memory. Fingerprinting scripts wire a triangle OscillatorNode (10 kHz) into a DynamicsCompressorNode (threshold: -50 dB, knee: 40, ratio: 12, attack: 0, release: 0.25) and sum absolute 32-bit IEEE-754 floating-point samples across frames 4500..4999. Because x86_64 AVX2 and Arm64 NEON transcendental math libraries round sin, exp, and pow differently at the 23rd mantissa bit, the resulting float sum separates Apple Silicon, Intel, AMD, and Qualcomm Snapdragon SoCs instantly unless farbled or clamped.

4. Navigator Hardware Enumeration, Viewport Letterboxing & Sec-GPC

Unprotected navigator properties expose hardwareConcurrency (logical CPU thread count, such as 16 or 24), deviceMemory (RAM bucket in GiB on Chromium), Intl.DateTimeFormat().resolvedOptions().timeZone (pinpointing geographic region even when connected to a foreign VPN exit!), and exact inner window dimensions (window.innerWidth x window.innerHeight, which reflect custom dock widths, taskbar heights, and split-screen tiling).

At the same time, one browser signal protects you legally rather than tracking you: navigator.globalPrivacyControl === true (Sec-GPC: 1 HTTP request header). Under the California Consumer Privacy Act (Cal. Civ. Code § 1798.135(b) / CPRA Regulations § 7025), the Colorado Privacy Act, the Connecticut Data Privacy Act, and the New Jersey Data Privacy Act, websites and ad-tech controllers are legally required to treat an incoming Sec-GPC: 1 header as a binding statutory opt-out of the sale or cross-context behavioral sharing of personal information (enforced via seven-figure Attorney General settlements against Sephora, DoorDash, and Honda).

5. Zero-STUN Local RTCPeerConnection ICE Candidate Inspection

Most online "WebRTC Leak Testers" instruct your browser to contact Google's STUN server (stun:stun.l.google.com:19302) or their own custom STUN server, thereby leaking your real IP address to Google or the test operator! In strict contrast, Tab 1 initializes new RTCPeerConnection({ iceServers: [] }) with an empty iceServers array, creating a purely local data channel that never transmits a single packet off your machine. It inspects only what the browser reveals to local JavaScript in onicecandidate:

• Protected (RFC 8828 mDNS): Modern desktop browsers replace private 192.168.x.x / 10.x.x.x LAN addresses with ephemeral .local UUID hostnames (a4f9...c1.local) or suppress host candidates entirely.
• Exposed: Misconfigured profiles or legacy WebViews emit raw 192.168.x.x or IPv6 SLAAC interface addresses directly into SDP candidate strings, allowing websites to fingerprint your home or corporate subnet layout.

6. State Partitioning, CNAME Cloaking & Navigational Bounce Tracking

Even when third-party cookies are blocked, ad-tech vendors attempt to smuggle persistent state across origins via three network and storage bypasses defeated only by Total State Partitioning and DNS CNAME Uncloaking:

• Unpartitioned Side-Channel Caches (HSTS Supercookies, Favicon Cache, Alt-Svc & Blob URLs): Historically, trackers encoded 32-bit user IDs into per-subdomain HTTP Strict Transport Security (HSTS) flags or cached ETag/favicon headers shared across top-level sites. Modern privacy browsers (Tor, Mullvad, Brave, Firefox Total Cookie Protection) key every network cache, TLS session ticket, localStorage, IndexedDB, and service worker strictly by top-level (eTLD+1, frame_origin) tuple (State Partitioning).
• First-Party CNAME Cloaking: Publishers delegate a subdomain such as metrics.news-site.example via a DNS CNAME record to an external tracker (collector.adtech-vendor.example) so browsers treat first-party cookies (Set-Cookie without SameSite=None) as same-site and share existing session cookies! Defeating CNAME cloaking requires a DNS-aware content blocker (uBlock Origin on Firefox/LibreWolf, Brave's native CNAME uncloaker, or an upstream Pi-hole / Unbound / NextDNS resolver that inspects the full CNAME chain).
• Navigational Bounce Tracking: When you click an outbound link, a tracker briefly redirects your top-level tab through https://bounce-tracker.example/redirect?dest=..., writing first-party storage in its own top-level context before forwarding you within 80 ms. Brave (Debounce + ephemeral bounce storage purging) and Firefox (PurgeTrackerStorage) automatically wipe state for intermediate domains that receive zero direct user interaction.

Browser Anti-Fingerprinting Architecture Matrix

Transport Layer Verification: TLS 1.3 Post-Quantum Key Shares & RFC 9849 ECH

Hardening JavaScript APIs inside the browser tab does nothing to blind your local ISP, cellular carrier, coffee-shop router, or nation-state autonomous system (ASN) if your transport layer leaks metadata on the wire. Even when you configure encrypted DNS-over-HTTPS (DoH) or Oblivious DoH (ODoH), a conventional TLS 1.3 (RFC 8446) handshake sends the destination hostname (example.org) in unencrypted ASCII inside the server_name (SNI, extension 0x0000) field of the initial ClientHello packet.

Two modern cryptographic upgrades close transport surveillance and harvest-now-decrypt-later (HNDL) quantum exposure simultaneously:

1. Encrypted Client Hello (RFC 9849 / ECH): Your browser fetches an ECHConfigList HPKE public key attached to the target domain's HTTPS (Type 65 / RFC 9460) DNS resource record over encrypted DoH. During the TLS handshake, the browser splits its ClientHello into an innocuous ClientHelloOuter (showing an outer shared CDN fronting name such as cloudflare-ech.com) and an HPKE-encrypted ClientHelloInner containing the true target SNI and ALPN list. Passive ISP middleboxes can no longer catalog which websites on shared edge infrastructure you visit!
2. Post-Quantum Hybrid Key Agreement (X25519MLKEM768, Codepoint 0x11EC): Standard elliptic-curve Diffie-Hellman (X25519) will be broken retroactively once cryptographically relevant quantum computers execute Shor's algorithm against recorded packet captures (HNDL). Negotiating hybrid X25519MLKEM768 combines classical X25519 with NIST FIPS 203 Module-Lattice-Based Key-Encapsulation (ML-KEM-768), ensuring session confidentiality remains secure so long as either elliptic-curve discrete logarithms or Module-LWE holds.

When you explicitly click Run Stateless TLS/ECH Echo in Tab 3, antitracking-probe.ts performs one GET /api/tls-echo request to a zero-binding Cloudflare Pages Function (functions/api/tls-echo.ts). That edge function holds zero database, KV, R2, or logging bindings; it reads request.cf.tlsVersion, tlsCipher, clientAcceptEncoding, asn, and incoming request headers (Sec-GPC, DNT), returns a Cache-Control: no-store JSON payload directly to your screen, and discards the ephemeral execution context immediately.

Why Sharing Unsanitized Links Leak Social Graphs (72-Parameter Sanitizer)

Whenever you copy a link from Meta (Facebook, Instagram, Threads), Google Search/Ads, YouTube, TikTok, X, LinkedIn, Substack, or an email newsletter (Mailchimp, HubSpot, Klaviyo, Marketo) and paste it into an encrypted chat (Signal, SimpleX, or Session), appended query parameters create a bidirectional identity bridge between the sender and every recipient who clicks the link:

• mc_eid (Mailchimp Unique Subscriber ID) & _hsenc (HubSpot): Directly encodes the recipient's email subscriber primary key! Forwarding a newsletter URL containing ?mc_eid=9f8a12b4c0 allows the publisher (and embedded page trackers) to link your private email address to the IP address and browser fingerprint of everyone who opens your shared link.
• si= (YouTube / Spotify Share ID) & igsh= / igshid= (Instagram): Mint a unique per-share token tied to the authenticated account that clicked the "Share" button. Even if two users communicate exclusively over end-to-end encrypted Signal, clicking an unsanitized ?si= or ?igsh= URL informs Google or Meta that Account A (Sharer) knows Account B (Clicker) in real life!
• fbclid, gclid, dclid, msclkid, ttclid, twclid, li_fat_id: High-entropy per-impression click identifiers designed specifically to bypass browser third-party cookie blocking via server-side Conversions APIs (CAPI), joining ad clicks directly to merchant checkout PII.

Tab 2 (72-Param URL Sanitizer) parses URLs via the standard WHATWG URL parser entirely offline, strips 72 exact tracking keys plus utm_*, hsa_*, mtm_*, pk_*, and matomo_* wildcard families while preserving functional query parameters (?v= video IDs, ?page= pagination, ?q= search terms), and flags embedded redirector wrappers so you never inadvertently dox your social graph. Pair clean URL hygiene with binary EXIF/XMP file stripping in our Metadata & Unicode MCP Sanitizer.