Show HN: I built a cross-browser extension that controls fingerprinting surfaces

[tomaszjanusz]

Hello Hacker News! I’m Tomasz, creator of Privacy Thing, a browser extension for Firefox and Chromium-based browsers. I’ve just released its Preview version.

Privacy Thing aims to reduce browser fingerprinting—the tracking of users without cookies.

It began as an internal project: a simple location simulator. Over time, I expanded it to cover more fingerprinting surfaces. It now has 13 protection categories affecting 50+ browser APIs and methods: Geolocation, time and locale settings, Canvas, WebGL, Audio, Navigator, Screen, Client Hints, Battery, WebRTC, Dedicated Workers, Service Workers, and Shared Workers. The list is still growing.

The extension is fully configurable. Users can create regional profiles and assign them to domain rules, with separate protection settings for each domain. Or they can skip domain rules and rely on the global configuration—I’m not here to decide what works best for them :-)

Privacy Thing uses Manifest V3, with all its pros and cons. Chrome and Firefox appear to offer similar extension APIs, but differ fundamentally at the level where Privacy Thing operates. This matters because its scripts must load as early as possible to be effective.

Its X-Ray module communicates with scripts running in the page context to show which APIs a site uses and how often it queries them. An aggregate count appears on the extension’s toolbar badge by default.

Each release includes processed, compact datasets covering Chrome build numbers, supported language codes, language-to-country mappings, popular screen resolutions, and hardware configurations. This keeps the extension independent of external services and there is no good reason to build extra infrastructure for it.

There are two exceptions. The regional preset wizard uses OpenStreetMap’s Nominatim geocoding service, but only after the user consents to sending the query. Maps are displayed using OpenFreeMap.

Presets can also be created manually. Users who know the coordinates can enter them directly without contacting any 3rd-party service.

The extension does not transmit telemetry or usage data. This makes development harder, but it is fundamental to its identity: user data belongs to the user. Privacy Thing configuration can be exported, edited and imported.

The Preview is currently distributed under a proprietary license. This is not ideal; I ultimately intend to release the source under an open-source license, most likely the AGPL.

More about the development process: https://tomaszjanusz.dev/en/projects/privacy-thing/

Download:

- Mozilla Addons: https://addons.mozilla.org/en-US/firefox/addon/privacy-thing...

- Chrome Web Store: https://chromewebstore.google.com/detail/privacy-thing-previ...

The extension is STILL under review in the Microsoft Edge Add-ons store -_-

Thank you for your suggestions and feedback. Please remember that this is still a preview: some things may not work, may be slower, or may not behave as intended. I sincerely hope such issues will be few and far between.

P.S. Yes, Privacy Thing fully supports Firefox Containers. I like the concept and believe extensions should support containers whenever possible. Privacy Thing will support them elsewhere too, including Brave, if Brave Software makes its container API public.

[xnx]

The only thing that will protect against fingerprinting is enough people connecting through some type of stock configuration virtual machine.

[mtweak]

Have you thought of active fingerprint pollution? Mathematically, find the search term that has the farthest embedding + noise than your current search term. You search for Harley Davidson, a parallel search is done for "3 mo old diapers".

Like another person said: passive fingerprint protection will be limited.

[gruez]

Anti-fingerprinting measures with configurable knobs is always going to be a risky proposition because those options themselves end up being a fingerprinting surface. It's better to take firefox/tor browser's approach and have a common profile eg. "resistfingerprinting" to get crowd anonymity.

[tomaszjanusz]

This extension does not allow you to adjust how a given patch works - for the reasons you wrote. You are 100% right. This extension allows you to configure the availability of certain spoofed surfaces for specific sites. Moreover, this extension does not try to override the protections that Firefox uses, e.g. in the case of limits on the presentation of the amount of available RAM.

Your opinion is completely correct if we assume that most users will use Tor Browser. However, it is 2026, and it does not seem that Firefox will regain its position on the market. The idea behind this extension is to provide very basic (relative to what the browser manufacturer could do - and often does not do) protection for users of mainstream browsers. I use Helium and Zen myself, depending on the context of the work I do, but I am aware that most people will reach for a browser whose manufacturer sunsetted Privacy Sandbox a year ago.

[m00dy]

There's a business value if you implement your patches on C++/source code level.

[tomaszjanusz]

Thanks for this opinion. You may be right. However, I believe that this type of protection will reach a wider audience in the form of an extension written in TypeScript. If we wanted to dress this code in the form of native code, we would be talking about making a fork of one of the popular browsers. It's a big challenge and a big responsibility.

[clonedhuman]

I find, as time goes on, that more and more sites are breaking over relatively minimal privacy protections in my browser.

[tomaszjanusz]

I believe that the genesis of this type of problems has several reasons: 1) Incorrect implementation of spoofing 2) a family of browser APIs whose context extensions do not (usually) have access to 3) the website owner decided that, for example, to fill out the form, the user must show him the RAM volume, battery charge level or graphics card manufacturer.