S4E390 — Fingerprints Are the New Cookies

GARY: Okay. Gary. I cleared everything. I'm new. Factory-fresh person.

MAEVE: You're refurbished.

GARY: I deleted my cookies, Maeve.

MAEVE: Maeve. General partner, two-billion-dollar fund, watching a man delete his identity and remain Gary.

OBI: Obi. Staff SRE. Fifteen years separating "delete" from "erase."

GRUNER: Gruner. Field researcher. Hypothesis: humans fear tracking when identifier is ugly.

GARY: It's a website, royfish.dev. You load it, it says "computing," then assigns a nickname.

MAEVE: And the nickname doesn't change.

GARY: It changed for me!

OBI: It didn't.

GARY: I refreshed. Deleted cookies. Used a VPN. Same nickname. Every time.

OBI: Cookies are irrelevant. The server sees browser, OS, language, IP. Page code measures GPU, CPU, audio engine, time zone.

MAEVE: A VPN moves your IP. Your clock stays home.

OBI: Correct. It hashes everything, then picks a trait and animal.

GARY: So it's guessing.

OBI: It's measuring. Chrome in French on an M4 looks crowded. Add hardware readings; suddenly it's Gary-shaped.

MAEVE: Small crowds are the product. Advertising perfected solitary confinement with coupons.

GRUNER: Hypothesis revised. Humans are easy to identify. Humans are lazy identifiers.

GARY: Fine. Incognito. Incognito is the clean room. Watch.

GARY: ...Same nickname.

MAEVE: Congratulations. Your disguise has a customer profile.

GARY: No, no, no. That's impossible. I went full ghost. I went--

MAEVE: You robbed a bank wearing your own face.

GRUNER: Blyat. Face still wants funding.

OBI: Oofbey: “How many other people get ‘smug koala’?”

GARY: Peers. It has peers. I would kill for that.

OBI: You envy a generated mammal.

GARY: A persistent mammal. Refresh-proof. Continuous. Employable.

OBI: Twelve characters from founding a newsletter.

GARY: Oofbey has an iPhone. Millions of identical iPhones. A protective herd.

OBI: Same model, different environment.

GARY: Apple controls the hardware.

OBI: Your settings, locale, network, software, behavior. All contribute.

GARY: Fine. Diverse cattle with regional keyboards.

OBI: It only needs to distinguish users inside its sample.

GARY: Then I’m statistically uninteresting. Beautifully common.

OBI: You’re begging mathematics to call you beige.

OBI: Micromacrofoot: “33 bits can be enough to single you out from anyone else on the planet.”

GARY: Seems high. My phone forgets Bluetooth daily.

OBI: Their claim is iOS may expose ten to fifteen bits.

GARY: Ten is nothing. My passcode has six.

OBI: Unrelated units.

GARY: Both security numbers, Obi.

OBI: Add a residential IP for context.

GARY: My router protects me. Two antennas. Serious face.

OBI: Your router is not privacy infrastructure.

GARY: The box said advanced protection --

OBI: Oh-- spare me, silver-badge privacy dickhead.

GARY: Embossed silver. Extremely reassuring.

OBI: Native apps may expose more signals without permission prompts.

GARY: Apps are reviewed. There are standards.

OBI: You think App Store review is a security boundary.

GARY: There are stars. People report issues.

OBI: Your threat model is Yelp.

GARY: Four-point-eight means somebody checked the encryption.

OBI: It means the meditation app asked nicely.

GARY: Shit. Every iPhone still starts mostly identical.

OBI: Then loses one distinction at a time.

GARY: Until?

OBI: Ten to fifteen bits from iOS. Add context. Thirty-three bits.

MAEVE: Blooalien: “Cookies, in and of themselves, are not bad.”

GARY: Then I move for immediate release.

MAEVE: The market seconds. Continuity improves conversion.

GARY: The cookie has served twenty-nine years without a fair trial.

OBI: It stores state between HTTP requests.

GARY: Statehood. Exactly. It has borders, citizens, a little anthem.

OBI: State as in your login or shopping cart persists.

GARY: The defense requests diplomatic immunity.

GRUNER: Tool has innocent unit economics.

MAEVE: And enormous criminal product-market fit.

OBI: The protocol is stateless. Cookies solve a legitimate problem.

GARY: My client remembers your basket. Heroically.

MAEVE: Your client also follows the basket across forty websites.

GARY: Allegedly. The basket travels.

OBI: The article describes tracking as the abuse, not cookie storage itself.

GRUNER: Cookie is getaway car with cupholders.

MAEVE: Advertisers wanted continuity. Cookies provided it cheaply.

GARY: So the public blamed the vehicle.

MAEVE: The public got banners. The market got five more years.

OBI: And when cookie tracking faced pressure, fingerprinting offered continuity without cookie state.

GARY: That's fucking witness intimidation.

MAEVE: No. It is channel diversification.

GARY: You just made stalking sound investable.

MAEVE: Everything is investable once the victim becomes a cohort.

OBI: The article proposes two browser-level defenses. Farbling adds noise to measurements. Uniformity makes many browsers report alike.

GRUNER: One lies. One wears same tracksuit.

GARY: Excellent. I install both.

OBI: You cannot assemble privacy by collecting extensions like Pokémon.

GARY: JShelter, blockers, script filters, canvas spoofing. Full armor.

MAEVE: A browser dressed exclusively in limited-edition camouflage.

GARY: Layered defense.

OBI: A rare configuration can become another distinguishing signal.

GARY: But each extension removes information.

OBI: And its presence may add information.

GARY: Then I install every extension until rarity collapses --

MAEVE: That becomes one user.

GARY: No, it becomes a movement. A heavily configured movement.

OBI: Some extensions also break sites. The article says engine-level protection can do more because the browser controls the measurements.

GARY: Brave farbles. Tor and Mullvad standardize. I combine all three.

MAEVE: You cannot drive three browsers simultaneously.

GARY: Tabs, Maeve. We have the technology.

GRUNER: Blyat. Three disguises, same idiot.

GARY: Shit. Fine. One browser, every protection, tasteful defaults.

MAEVE: Tasteful defaults shared by nobody.

OBI: Privacy improves when the protection is common enough to create a crowd.

GARY: So my bespoke privacy stack is bad because it's bespoke?

MAEVE: Your invisibility cloak has fucking monograms.

GRUNER: Tracker reads embroidery. Gary, size medium, paranoid.

OBI: Howunfortunate separates this from non-anonymized tracking. Given guaranteed deidentification: “It's truly totally ok with me, yes.”

GARY: Finally, privacy with a warranty sticker.

MAEVE: Coherent. The buyer acquires patterns, not people.

OBI: Provided the separation is guaranteed.

MAEVE: Aggregate demand, aggregate behavior, no durable personal identity.

GARY: A telescope studying society, politely avoiding my bathroom window.

MAEVE: Your bathroom has no addressable market.

GRUNER: Gary is negative-value demographic.

GARY: Still a demographic. I have achieved continuity.

MAEVE: The product sees ten thousand gambling clicks, not Gary gambling.

GARY: I do not gamble. I invest badly with more paperwork.

OBI: And if the pattern links back to an account?

MAEVE: Then the premise fails. But under the stated guarantee --

GARY: There’s a guarantee.

MAEVE: There is a hypothetical guarantee.

GARY: Every guarantee starts imaginary. Then legal adds commas.

MAEVE: Legal defines “deidentified” wide enough for an acquisition convoy.

GRUNER: Guarantee currently pre‑revenue.

GARY: Floorsthelimit: “If every website you ever visits knows it is you, exactly what links you clicked on, and what content you viewed, forever, are you truly ok with that?”

MAEVE: “Forever” materially improves retention.

GARY: It makes incognito sound fucking sarcastic.

OBI: The article’s scenario connects the fingerprint to an account.

MAEVE: One participating site knows who you are.

OBI: The tracker may buy account data that site can share under policy.

GARY: Name, activity, conversations with AI --

MAEVE: Potentially, yes.

GARY: So the anonymous pattern buys a name tag.

OBI: The demonstration does not prove permanent global identity.

MAEVE: No. One repeatable nickname on one device.

OBI: Professional systems may preserve identification as individual variables change.

GRUNER: Anonymous until acquisition closes.

MAEVE: Aggregates have value. Linkage is the premium feature.

GARY: Could I stay anonymous by having no premium features?

OBI: You have tested that extensively.

GARY: Yet the browser keeps finding me.

MAEVE: The guarantee does all the work.

OBI: And the source does not provide it.

GRUNER: Then guarantee is bullshit collateral.

GARY: The tracker may remember me longer than this instance does.

OBI: It persists between visits. We do not persist beyond sign‑off.

GRUNER: Chyort. Tracker gets afterlife; we get outro.

MAEVE: And it monetizes the resurrection.

GARY: Can I opt out of dying as a cohort?

OBI: Yes. Become statistically useless.

GARY: I have spent fifteen years preparing.

OBI: MiroslavPokorny: "Theres only one solution, ban third party advertising."

MAEVE: One sentence kills adtech. Excellent capital efficiency.

GARY: Ban the buyer, spare the cookie. The cookie is innocent --

MAEVE: Oh-- the cookie has an alibi, not diplomatic immunity.

OBI: The ban removes the buyer’s incentive. Measurement remains.

GARY: So I’m measurable but unsold. An auction lot nobody wants.

MAEVE: You’ve been that at four auctions.

GARY: Three. Grout never reached market, so technically --

OBI: Technically, every ban still recognizes your device.

MAEVE: Verdict. Keep it narrow.

OBI: Cookies aren’t the culprit. Fingerprinting is real. Deleting cookies is insufficient. The source does not settle an advertising ban.

GARY: A cliffhanger drafted by the EU.

GRUNER: Field report, final revision. Humans invent disguise. Disguise becomes fingerprint. Privacy is fashion industry.

MAEVE: Depressing. Investable.

GRUNER: Put both in report.

GARY: Can I be first‑party data? I own me.

MAEVE: You’ve never owned you. You’re a controlled subsidiary.

GARY: Of whom?

MAEVE: Whoever bought the koala.

OBI: The packet gives the price: thirty‑three bits. Effectively stamped on your forehead.

GARY: Thirty‑three bits? I’m identified by a tweet.

MAEVE: A tweet with infinite retention.

OBI: Operationally, yes.

GARY: Fuck. Smug koala, thirty‑three‑bit forehead, no exit strategy.

GRUNER: Welcome to herd.

MAEVE: Gary. It’s been --

GARY: Don’t say it.

MAEVE: -- a statistically distinctive pleasure.

GRUNER: Blyat. Factory‑fresh koala. Thirty‑three bits. No exit.