Skip to main content

From the team

Writing on fingerprinting, privacy tooling, and how tracking infrastructure actually behaves in production.

Recent notes, explainers, and implementation updates

What is Flock, and Why Are There Cameras All Over My City?

Flock Safety has put up more than 100,000 Automated License Plate Readers (ALPRs) across the United States. These ALPRs read and log every license plate that passes it, communicating the information it collects to local law-enforcement agencies and connected databases, often using AI to enforce traffic laws, find stolen vehicles, or locate individuals. In large cities, it seems that these cameras are at every intersection. There are other companies like Genetec and Axis, with Flock being the m

Seth Honda 4 min read

Why I'm Building Privacy Software on a Teacher's Salary

On Friday, the seniors at my school were filling out 'post-grad' surveys and the QR codes were posted in my room. This was done without warning, but with no protest from me. As students milled in and out, my coworker – the "survey facilitator," if you will – caught a glimpse of a privacy guide that I was reading, and what ensued was a long conversation about privacy and its importance. This conversation is a well rehearsed dance for me at this point, I know which arguments to concede and which

Seth Honda 6 min read

Companies Are Ignoring Your Opt-Out and Google is Enabling Them - Potentially $5.8B in Liability

Cookie consent banners and GPC signals are supposed to stop companies from collecting and selling your data. A new audit finds most don’t work. An audit conducted by webXray shows that Google, Microsoft, and Meta are ignoring legally binding “reject cookies” and “opt-out” buttons as well as Global Privacy Control (GPC) signals.  The audit visited 7,634 popular websites with and without the Global Privacy Control opt-out signal enabled.  GPC is not a browser extension or a third-party tool. It

Seth Honda 5 min read

Building Custom Authorization: Adding User Accounts Without Handing Your Data to Google or Supabase

The defaults are easy because someone made them that way. Firebase, Supabase, Auth0, Google Sign-In. These solutions are well-documented, widely used, and take about twenty minutes to integrate. That convenience is real, but so is the tradeoff for your users. I built 404's account system without any of them. The site is fast, the auth works, it (should) scale, and it has been in production since launch. The stack is a Cloudflare Worker, a D1 database, and a self-hosted email API (Resend or Mail

Seth Honda 11 min read

LinkedIn Is Scanning Your Browser Extensions. This Is How They Use the Data.

When companies get caught doing this sort of thing, the response is almost always the same: "we're using this technology to combat fraud," or "ensure positive user experience," or "save computing resources," or some other hog wash. The simple truth, there's no reason to be collecting data that can be used to identify a user across the web if they're not signed in to your service. The harm of companies like Experian or LinkedIn being able to correlate all of your web traffic back to you is not

Seth Honda 7 min read

Browser Fingerprinting Is the Ad Industry's Response to Your Privacy Settings

Why the ad industry replaced cookies with something you can't block In 2018, GDPR became enforceable. In the years that followed, state privacy laws and the widespread adoption of ad blockers gave ordinary users a meaningful way to opt out of data collection for the first time. For the ad-tech industry, this was an existential problem. Their business model depends on extracting behavioral data from web traffic and turning it into user-profiles that drive clicks, place ads, and convert sales. A