I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
Browser Fingerprinting: An Introduction and the Challenges Ahead | Tor Project
In the past few years, a technique called browser fingerprinting has received a lot of attention because of the risks it can pose to privacy. What is it? How is it used? What is Tor Browser doing against it? In this blog post, I’m here to answer these questions.
Browser Fingerprinting: An Introduction and the Challenges Ahead | Tor Project
In the past few years, a technique called browser fingerprinting has received a lot of attention because of the risks it can pose to privacy. What is it? How is it used? What is Tor Browser doing against it? In this blog post, I’m here to answer these questions.
Biohackers Encoded Malware in a Strand of DNA
Researchers planted a working hacker exploit in a physical strand of DNA.
BSidesSF 2018 - Navigating the Vast Ocean of Browser Fingerprints (Russell Thomas)
nullpt.rs • Devirtualizing Nike.com's Bot Protection (Part 1)
In this blog post, we'll examine the virtualization obfuscation used by Nike
Introduction - What is BrowserGate?
Linkedin is searching your computer Every time you visit linkedin.com, a JavaScript program embedded in the page scans your browser for installed Chrome extensions. The program runs silently, without any visible indicator to the user. It does not ask for consent. It does not disclose what it is doing. It reports the results to LinkedIn’s servers. This is not a one-time check. The scan runs on every page load, for every visitor.
nullpt.rs • Reverse Engineering Tiktok's VM Obfuscation (Part 1)
TikTok has a reputation for its aggressive data collection. The platform has implemented various methods to make it difficult for reverse-engineers to understand exactly what data is being collected and how it is being used.
Cap'n Web: a new RPC system for browsers and web servers | Hacker News
> .map() is special. It does not send JavaScript code to the server, but it does send something like "code", restricted to a domain-specific, non-Turing-complete language. The "code" is a list of instructions that the server should carry out for each member of the array.
High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478) › Searchlight Cyber
This morning, an advisory was released for Next.js about a vulnerability that leads to RCE in default configurations, with no prerequisites. The root cause of this issue lies in React Server Components, which Next.js utilizes. Over the last day, we have noticed an incredible amount of incorrect PoCs floating around on GitHub that do not
What is it? - NoScript: consensual browsing!
The NoScript Security Suite is Free Software protecting Firefox (on Android, too!), Chrome, Edge, Brave and other web browsers. Install NoScript now!
An update on the scraper situation
Our article 'Fighting the AI scraper bot scourge', published in early 2025, discussed the probl [...]
Kevin Boone: The privacy nightmare of browser fingerprinting
If you were worried about tracking cookies, you really don’t want to know about browser fingerprinting.
Now sites can fingerprint you online even when you use multiple browsers
Online tracking gets more accurate and harder to evade.
Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives
Perplexity is repeatedly modifying their user agent and changing IPs and ASNs to hide their crawling activity, in direct conflict with explicit no-crawl preferences expressed by websites.
