// HACKER NEWS — CYBERSECURITY
Show HN: GlassBox – what the browser reveals, and how identifiable you are
What this is. A diagnostic mirror. Each panel runs one family of fingerprinting or device-enumeration technique and reports the raw values plus a rough identifying power rating. Individually, most signals are weak; combined, they routinely single out one browser in millions. That combination is the whole game.
The identifiability % is a model, not a measurement. Signal ratings (High / Medium / Low) reflect research consensus — canvas, WebGL, audio, font lists and the API matrix are consistently strongest. The headline % sums published per-signal entropy, counts only what your browser actually exposes (masked canvas/GPU are discounted), applies a correlation haircut, and caps at the ~33 bits needed to single out one person among ~8 billion. True rarity needs a live population dataset to compare against — the one thing a no-server tool can't compute on its own — so treat this as an order-of-magnitude indicator. One honest wrinkle: a browser that blends into a big crowd (Tor Browser at its default window size, say) is safer than its bit-count here suggests, because everyone in that crowd reports the same values and this model can't see that. For live-population numbers, compare with EFF Cover Your Tracks and amiunique.org.
Sandbox caveat. If you are viewing this inside an embedded frame, some probes (WebRTC, media devices, permissions, sensors) may be blocked by the frame's permissions policy and will report blocked rather than a real value. Host the file at its own origin for the full surface. Shortcuts: E expand · R re-run.
From CodeCanary. GlassBox is a companion to codecanary.org, a passive scanner that grades a site's security headers, verifies its JavaScript hasn't drifted, and checks MCP servers. Source on GitHub.