Your Browser Is a Fingerprint

If you think incognito mode protects you, it doesn’t.

Private browsing does one thing: it hides your activity from other people who use your device. That’s it. Your ISP still sees every site you visit. Websites still see your IP address. And your browser — the specific combination of your plugins, your fonts, your screen resolution, your language settings, your hardware — is a fingerprint nearly as unique as the one on your thumb.

If you’ve read Through the Looking-Glass, you remember the moment Alice steps through the mirror and discovers that everything on the other side is reversed — familiar but wrong, watching her as much as she’s watching it. Your browser is that mirror. You think you’re looking through a window at the internet. The internet is looking back through that same window at you — reading your configuration, cataloging your fingerprint, tracking your movement from site to site. Incognito mode is a curtain on your side of the glass. It doesn’t change what’s visible from the other side.

Go to coveryourtracks.eff.org. Run the test. It takes thirty seconds.

Look at the result. Look at how many bits of identifying information your browser broadcasts to every website you visit. Most browsers are unique among hundreds of thousands of samples. You’re not anonymous. You’re wearing a name tag you didn’t know you had on.

---

That fingerprint follows you. When you visit a news site, a shopping site, a porn site, a political forum — the trackers embedded on those pages read your fingerprint and correlate your visits across them. They don’t need cookies. They don’t need you to log in. Your browser configuration is enough.

This is the technical reality behind those ads that follow you around the internet. But it’s not just ads. In 2020, Denver police had no suspects in a fatal arson. They obtained a reverse keyword warrant — an order requiring Google to reveal everyone who had searched for the address of the house in the fifteen days before the fire. Google produced a list. Police identified three teenagers. One of them, Gavin Seymour, was charged and eventually convicted.

The Colorado Supreme Court upheld the evidence in 2023 — the first state high court to rule on reverse keyword warrants. The court acknowledged the warrant was “constitutionally defective” but let the evidence stand under a good-faith exception. Your search history is evidence. Searching while signed into Google makes you identifiable.

---

Three things. All today.

Install uBlock Origin on Firefox. Not Chrome — Google removed uBlock Origin from the Chrome Web Store in late 2024 as part of its Manifest V3 transition, and permanently disabled all remaining Manifest V2 extensions in mid-2025. A limited version called uBlock Origin Lite exists for Chrome, but it blocks significantly less. If you’re still using Chrome as your primary browser, this is a reason to switch. Firefox still supports the full extension and has committed to keeping it. uBlock Origin blocks trackers, ads, and known malicious domains. It is free and open-source.

Switch your default search engine to DuckDuckGo. DuckDuckGo doesn’t log your searches. When you search on Google, your query is tied to your account, your IP address, your device, and your browsing profile. DuckDuckGo processes the query and returns results without recording who asked. It’s not perfect — it pulls results from Bing — but the privacy difference is structural.

Test your browser fingerprint at coveryourtracks.eff.org — if you haven’t already. Record the result in your field journal. Then install uBlock Origin, and run the test again. Compare.

If you’re Tier 2 or 3 in your threat model, go further. Switch to Firefox if you haven’t already. Enable Enhanced Tracking Protection in strict mode — it’s in Settings → Privacy & Security. Try Firefox Multi-Account Containers, which lets you isolate different activities into separate containers so your banking session can’t see your social media cookies. Enable DNS over HTTPS — in Firefox, go to Settings → Privacy & Security → scroll to DNS over HTTPS and select “Max Protection.” This encrypts your DNS queries so your ISP can’t see which domains you’re visiting.

---

A note about VPNs, because I know you’re wondering.

A VPN encrypts your internet traffic between your device and the VPN server. This hides your browsing from your ISP and your local network. It does not make you invisible. The VPN provider can see your traffic instead of your ISP — so you’re choosing who to trust, not eliminating trust. VPNs matter most on public Wi-Fi, in situations where you don’t trust your network, or when you want to prevent your ISP from logging the sites you visit.

If you’re going to use one, use Mullvad or ProtonVPN. Mullvad doesn’t require an email address to sign up — you get a random account number. You can pay with cash mailed in an envelope. ProtonVPN is based in Switzerland, has a free tier, and integrates with other Proton services. Both have been independently audited. Both have no-log policies that have held up under legal pressure. Most of the VPNs you see advertised online are owned by companies you should not trust with your traffic.

---

You can now see more clearly how you’re tracked — through your location, your data, your passwords, your messages, your identity, and your browser. But there’s a skill that matters as much as all of these combined, and it has nothing to do with technology.

It’s about what you believe. The most sophisticated surveillance infrastructure in history is less dangerous than a population that can’t tell truth from fabrication.

---