The Incognito Placebo: 30 Lines of JS Extract a Hardware Fingerprint That Survives Private Windows and Proxy IPs
Device fingerprinting turns incognito mode into a false sense of security: trackers can tie a private session to a known user simply by matching stable hardware traits. For developers building anti-fraud or privacy tools, the practical consequence is that local data clearing alone never works, and only browser-level fingerprint standardization or full VM isolation offers real protection.
Incognito mode only segments the local browser session: it stops writing history and resets cookies in memory, but every HTTP request still carries a set of hardware-derived identifiers. The article's 30-line probe combines Canvas 2D rendering, WebGL debug info, an OfflineAudioContext fingerprint, CPU core count, deviceMemory, screen resolution, and timezone. In tests, a normal Chrome window and a fresh incognito window produced byte-identical values, including a canvas hash of 0x244f4e0d and an Apple M4 GPU string.
The reason is that these traits come from the physical rendering stack: font rasterization, GPU shaders, and audio processing happen locally and change only with hardware and OS, not with private mode. EFF's Panopticlick model estimates 33-36 bits of entropy from combined traits, enough to make a device unique among 8.5 billion people. Switching to a proxy IP changes the network source but not the fingerprint, and WebRTC can bypass the proxy to leak the real IP over UDP.
Randomizing Canvas output with a plugin backfires because the anomaly itself becomes the rarest fingerprint, as the article's 'fingerprint paradox' demonstrates.
The WebRTC leak is a reminder that proxies only protect TCP/HTTP unless they intercept UDP at the network layer; this is why TUN mode is mandatory for real anonymity.
The defense tiers show that true anonymity requires either blending into a standardized group (Tor, Brave, Safari) or physically isolating the environment (VM), not tweaking settings in a regular browser.