Bits of identity
Why it matters Fingerprinting sites often say "your browser is unique". This lesson gives you the simple maths behind that claim, so you can judge how worried to be, and which traits are worth hiding.
The guessing game
Remember the game where one person thinks of someone and the others ask yes-or-no questions? A good question splits the suspects in half. Each halving is called one bit.
Bit of identifying information: one halving of the crowd. A trait that one person in 2 shares gives 1 bit; one in 4 gives 2 bits; one in 8 gives 3 bits. Each extra bit halves the crowd again.
Doubling adds up fast:
| Bits | Crowd narrowed to 1 in |
|---|---|
| 1 | 2 |
| 4 | 16 |
| 10 | about 1,000 |
| 20 | about 1 million |
| 30 | about 1 billion |
| 33 | about 8.6 billion |
Why 33 is the magic number
There are about 8 billion people. Halving 8 billion 33 times leaves fewer than one, because 2 to the power 33 is about 8.6 billion. So in theory, 33 bits of information are enough to single out any one person on Earth.
To turn "1 in N people share this" into bits, ask "how many times do I halve to get to N?" Mathematicians write this as log2(N). You do not need to calculate it: the table above is enough to estimate.
A worked example, with made-up numbers for a practice site's visitors:
- Time zone shared by 1 in 16 -> 4 bits.
- Screen size shared by 1 in 32 -> 5 bits.
- Installed fonts shared by 1 in 1,000 -> about 10 bits.
- Canvas result shared by 1 in 4,000 -> about 12 bits.
Added up, that is 31 bits, close to the 33 needed. This is why fonts and canvas worry privacy researchers more than language does: rare traits carry many bits.
Caveat 1: bits only add up when traits are independent
Independent: two traits are independent when knowing one tells you nothing about the other.
Time zone Asia/Tokyo and language ja-JP are not independent: most people with one have the other. Learning the second tells the tracker almost nothing new. Adding their bits would overcount, like counting the same clue twice.
Caveat 2: unique among whom?
When a test site says "your browser is unique", it means unique among the people who visited that test site, perhaps a few hundred thousand. Those visitors are an unusual crowd: privacy-curious people with uncommon setups. Being unique among them is not the same as being unique among billions.
So "unique" is a warning, not a verdict. It still matters: a real tracker only needs you to be unique among its visitors, and that crowd is also much smaller than the world.
A common misconception
"More rare settings make me safer because they confuse trackers." Usually the reverse is true. Every unusual choice adds bits and makes you stand out. The next lesson explains why the best defences make you look more ordinary.
Recap
- One bit halves the crowd; about 33 bits can, in theory, single out one person among 8 billion.
- Rare traits carry many bits; common ones carry few.
- Bits only add up for independent traits, so related traits must not be counted twice.
- "Unique" on a test site means unique among its visitors, not the whole world.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.