Fingerprints are the new cookies

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Try refreshing the page. Clear the cookies. Connect to a VPN.

尝试刷新页面。清除 Cookie。连接到 VPN。

Now open it on your phone or some other device and your nickname will be different and just as consistent.

现在在你的手机或其他设备上打开它，你的昵称会变得不同，但同样保持一致。

Is it different in incognito? Good. But it’s always the same? Bad news.

在无痕模式下它变了吗？很好。但它始终如一？坏消息。

Most websites you visit get paid to show ads and indirectly run my script that lets me know you’re the …. I can use it to decide what ads you’ll see. But more importantly, if you’ve made an account on that website, I can offer to buy your data - whatever they can share under their privacy policy: your name, activity, conversations with AI…

你访问的大多数网站通过展示广告获得报酬，并间接运行我的脚本，让我知道你是谁……我可以用它来决定你会看到什么广告。但更重要的是，如果你在该网站上注册了账户，我可以出钱购买你的数据——只要是他们隐私政策允许分享的内容：你的姓名、活动、与人工智能的对话……

Pretty soon I’d know more about you than your friends do - perhaps more than you know yourself.

很快，我对你的了解就会超过你的朋友——甚至可能超过你对自己的了解。

“I have nothing to hide. And I prefer my ads to be relevant… sometimes they show me exactly what I need! And the data is anonymised anyway…”

“我没什么可隐瞒的。而且我更喜欢相关的广告……有时它们展示的正是我的需求！反正数据也是匿名的……”

See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.

你看，关键在于，这根本不是关于你。这也不再仅仅是关于广告了。没人关心你。如果警察或政府碰巧关心，我也会很乐意收他们的钱。

I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.

我看着所有这些数据，看到的不是人。我看到的是模式。从模式中涌现出的模式。一个关于经济、社会和人类心理的鲜活的数字分形状态。这是 21 世纪的水晶球，而且它是用硅做的！这就是产品。

And to the highest bidder it goes!

它将卖给出价最高的人！

What does that make you then? A gear? An ox? A volunteer?

那么你算什么？一个齿轮？一头牛？一个志愿者？

Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.

还记得关于第三方 Cookie 的大惊小怪吗？这件事闹得太大，以至于欧盟已经推出了其最伟大的发明之一——同意横幅。

If EU ships faster than tech companies, that can only mean the tech companies are sitting on their hands. And one of those tech companies happens to hold two-thirds of the browser market.

如果欧盟的行动比科技公司还快，那只能说明科技公司在袖手旁观。而其中一家科技公司恰好占据了三分之二的浏览器市场。

Let’s give it up for Google - the biggest ad company on Earth!

让我们为谷歌鼓掌——地球上最大的广告公司！

ACT I. PRESSURE - “PRIVACY IS PARAMOUNT TO US, IN EVERYTHING WE DO.”

第一幕：压力——“隐私对我们来说至关重要，在我们所做的一切中都是如此。”

It’s 2019 and the cookies are still hot. It’s become bad PR and Safari and Firefox already block them.

那是 2019 年，Cookie 依然火热。这已经成了糟糕的公关，Safari 和 Firefox 也已经开始屏蔽它们。

A year later Google pledges: we will destroy cookies!! And establish a new, privacy-first reign.

一年后，谷歌承诺：我们将消灭 Cookie！！并建立一个新的、隐私至上的统治。

ACT II. DISTRACTION - “INSTEAD OF DEPRECATING THIRD-PARTY COOKIES, WE WOULD INTRODUCE A NEW EXPERIENCE”

第二幕：转移注意力——“我们不会弃用第三方 Cookie，而是会引入一种新的体验”

5 years later: people are now preoccupied with far greater worries than cookies, and the solutions Google has developed (Privacy Sandbox) kinda suck and have raised antitrust concerns so nobody uses them.

5 年后：人们现在忙于比 Cookie 更大的担忧，而谷歌开发的解决方案（隐私沙盒）有点糟糕，并引发了反垄断担忧，所以没人使用它们。

“You know what, let’s just keep the cookies. We’ll mask your IP address* though!” (* but only when incognito while authenticated) (** in the end they didn’t even deliver on that)

“你知道吗，我们还是保留 Cookie 吧。不过我们会掩盖你的 IP 地址*！”（*仅在经过身份验证的无痕模式下）（**最终他们甚至连这一点都没做到）

ACT III. ACCELERATION - YOU CAN NOW USE DEVICE FINGERPRINTING IN OUR AD PRODUCTS

第三幕：加速——你现在可以在我们的广告产品中使用设备指纹识别

Now there’s a better way to know who’s who!

现在有一种更好的方法来辨别谁是谁！

Nice, let’s nerd out properly.

很好，让我们深入探讨一下技术细节。

You visit a website. Your browser sends a request to the server and the server returns code for the browser to run.

你访问一个网站。你的浏览器向服务器发送请求，服务器返回代码供浏览器运行。

The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.

请求已经揭示了关于你的信息；你使用的浏览器、语言、运行它的操作系统以及你的 IP 地址，服务器需要这些信息来向你发送响应。这通常会暴露你的位置。

See, we’ve made a lot of civilizational progress in making browsing safe. Long gone are the days when getting a virus just by visiting a website was a daily concern. The thing is, the definition of safety varies depending on who you ask. The broad consensus ends at isolation: a website’s code can’t see the data stored by other websites, and it can’t see your files or other applications without permission. Chrome and Edge stop here. Then you have Safari (especially on iOS/macOS 26+) and Firefox extending that definition to privacy, but they still don’t fully protect you from fingerprinting. Brave and Tor are the leading privacy-first browsers, with up and coming Mullvad Browser (Mullvad being, in my opinion, one of the best VPN providers out there).

你看，我们在使浏览变得安全方面取得了很大的文明进步。仅仅因为访问一个网站就感染病毒而成为日常担忧的日子早已一去不复返了。问题在于，安全性的定义因人而异。广泛的共识止于隔离：一个网站的代码无法看到其他网站存储的数据，也无法在未经许可的情况下看到你的文件或其他应用程序。Chrome 和 Edge 到此为止。然后是 Safari（特别是在 iOS/macOS 26+ 上）和 Firefox 将该定义扩展到了隐私，但它们仍然不能完全保护你免受指纹识别。Brave 和 Tor 是领先的隐私优先浏览器，还有新兴的 Mullvad 浏览器（在我看来，Mullvad 是目前最好的 VPN 提供商之一）。

The code runs on your hardware, which can be measured in ways that produce consistent and unique readings. There’s not much that can be done about this really, so there’s only two established solutions:

代码在你的硬件上运行，可以通过产生一致且唯一读数的方式进行测量。对此真的没有太多办法，所以只有两种既定的解决方案：

So there are two sources for data that can make up your fingerprint; the network request and the code environment.

因此，构成你指纹的数据有两个来源：网络请求和代码环境。

When you look at network, the data is generally either fragile or generic:

当你查看网络时，数据通常要么脆弱，要么通用：

When you can execute code on the device, you have ways to measure its hardware qualities (without any permission prompts!) and these are surprisingly stable:

当你可以在设备上执行代码时，你有办法测量其硬件质量（无需任何权限提示！），而且这些测量结果出奇地稳定：

And on the software level; installed fonts, extensions, system info…

在软件层面；已安装的字体、扩展程序、系统信息……

Millions of devices use the latest Chrome, there are millions of Macs with the M4 chip and there are millions of browsers in French.

数百万台设备使用最新的 Chrome，有数百万台配备 M4 芯片的 Mac，还有数百万个法语浏览器。

But when you look at devices that run the latest Chrome in French on an M4, that number now drops significantly. Add to it hardware measurements and it gets so low it becomes practically unique.

但当你查看在 M4 芯片上运行法语版最新 Chrome 的设备时，这个数字就会大幅下降。再加上硬件测量，它变得如此之低，以至于实际上是唯一的。

The fingerprint doesn’t need to be truly, globally unique - it just needs to be unique enough to tell people apart in your sample size.

指纹不需要在全局范围内真正唯一——它只需要在你的样本量中足够唯一，以便区分不同的人。

A ZIP code (inferred from IP), a birth date (you’ve given away on some platform) and sex (you fill it in everywhere) together are enough to uniquely identify over 60% of Americans.

邮政编码（从 IP 推断）、出生日期（你在某些平台上泄露过）和性别（你在任何地方都会填写）加在一起，足以唯一识别超过 60% 的美国人。

You can always add another variable to decrease the potential pool of candidates.

你总是可以添加另一个变量来减少潜在的候选人池。

Have you ever played Akinator? You think of a character, a genie asks you some twenty questions, and somehow it knows. That’s fingerprinting in a nutshell, except your browser answers the questions for you. Once you understand information entropy, Akinator’s magic turns into a simple trick.

你玩过 Akinator 吗？你心里想一个角色，精灵问你大约二十个问题，不知何故它就猜到了。这就是指纹识别的本质，只不过是你的浏览器在替你回答问题。一旦你理解了信息熵，Akinator 的魔法就变成了一个简单的把戏。

Let’s simplify with that game where you have to guess the character on a board through questions like “Is my character a man?”. If I say “yes”, and half of the characters on your board are men, you’re now considering only half of the total candidates. Now we can say that my answer gave you log₂(100 / 50) = log₂(2) = 1 bit of information, because it cut the pool of candidates in half.

让我们用那个通过“我的角色是男人吗？”之类的问题来猜棋盘上角色的游戏来简化一下。如果我说“是”，而你棋盘上有一半的角色是男人，那么你现在只考虑总候选人的一半。现在我们可以说我的回答给了你 log₂(100 / 50) = log₂(2) = 1 比特的信息，因为它将候选人池减少了一半。

The bits you get from one answer are called its surprisal: the rarer the answer, the more it tells you.

你从一个答案中获得的信息量被称为它的“惊奇度”（surprisal）：答案越罕见，它告诉你的信息就越多。

Surprisal quantifies the value of the answer, and ent

惊奇度量化了答案的价值，而熵