Nothing Private

What it is

Nothing Private is a PoC by gautamkrishnar demonstrating that browser fingerprinting re-identifies users across private/incognito sessions. It pairs a fingerprint (via the Client.js library) with a name you type, stores it, and returns the name when the same browser revisits — even in a fresh incognito window.

How it works

The frontend uses Client.js to compute a fingerprint from these data points:

user agent, screen print, color depth, current resolution, available resolution, device XDPI, device YDPI, plugin list, font list, local storage, session storage, timezone, language, system language, cookies, canvas print

On form submit, a PHP backend saves the fingerprint alongside your name in MySQL. On a later visit the fingerprint is matched against that column and the stored name is returned. Because the fingerprint is derived from device/browser characteristics rather than cookies, incognito's cookie/history wipe does not change it. A historical SQLite version of the backend also exists.

What to do

Run it locally to reproduce the effect (build/run verbatim from the page):

git clone git@github.com:gautamkrishnar/nothing-private.git
cd nothing-private
docker-compose up -d # use --build to update image if you do 'git pull'

Then visit http://localhost/. To reproduce against the hosted demo: visit http://nothingprivate.gkr.pw, enter a name, click "See the magic", then reopen the site in incognito.

For mitigation, the page points to a community-curated list of browsers that implement fingerprinting countermeasures (e.g., the referenced anti-fingerprinting browser list) as the way to reduce identifiability — not incognito mode.

Caveats

• This is a demonstration, not a hardened tracker; effectiveness depends on the browser. The page notes users reported it "working correctly with the latest version of Firefox Focus," and a Mozilla-community issue was opened — so behaviour varies by browser and version.
• Fingerprinting is presented as only one tracking vector among several; the page explicitly frames ISPs, search engines, and analytics (e.g., Google Analytics) as additional tracking channels not addressed by this PoC.
• The prior nothingprivate.ml domain expired and was re-secured to prevent misuse; use the current gkr.pw host or the local Docker build rather than stale links.