Series · 7 articles
The web from the user's side
I build websites and browser extensions for a living, which puts me on the side of the screen you do not see. This series looks at the same web from your side.
Each piece starts from a question people ask without being developers. Does "Reject all" do anything? Who can still see me in incognito? Why is this page so slow? Then I measure it on my own laptop and write down what came back, along with the places where one laptop and one afternoon is thin evidence.
It is written for the person using the software. You do not need to read code to follow any of it, and where a piece prints a command, it is there so you can run the same check on your own machine. If you run a website, the same pages show what your visitors' browsers hand you and what your site asks of them.
What do my privacy choices change?
Three buttons people press to be left alone, and what each one did when I pressed it.
What 'Reject all' on a cookie banner actually does
I answered one news site's cookie banner both ways and counted the tracking domains the page contacted. After "reject all" it contacted none, and after "accept all" thirteen. A few cookies stay either way, and the banner only speaks for the companies the site signed up in advance.
10 min read
What incognito mode actually hides, and from whom
I opened one test site in a normal Chrome window and an incognito one and compared what it received. 26 of 29 things were identical, including the internet address and all 11 device traits. The three that changed were the two kinds of cookie and the storage allowance.
8 min read
What 'clear browsing data' leaves behind
Two test sites, visited 62 minutes apart in a fresh Chrome profile, then one press of Delete browsing data. The dialog opens on the last hour, so the older site kept all seven things it had stored. With All time both lost everything, but a notification permission survived, and so did the device traits and the address.
7 min read
What can a page or an extension see?
What gets read about your browser without a prompt, and who is reading.
What a website learns before you click anything
I followed one link to a test site and touched nothing. The request arrived with 15 headers, and a script on the page then read 33 more values with no prompt. Location, camera, microphone, notifications and the clipboard all stayed behind a permission, and nothing in any of it named a person.
9 min read
What a CAPTCHA checks before it decides you're a robot
I loaded a public CAPTCHA demo widget and did nothing at all. 584 milliseconds after the page loaded it had a pass token ready, with no click. The rest is what the vendors document about the checks behind that, and where their documentation stops.
7 min read
What a browser extension can actually see
Every extension ships a manifest file that states what it is allowed to do, and I read the one for each extension in my own Chrome. 12 of the 20 could read and change every page I open. The script is printed in the article, so you can count your own.
13 min read
Why does this site feel slow?
One piece so far, and it did not find what I expected.
Why websites feel slow, measured on four real sites
I timed four sites from my laptop and counted what each front page asks a browser to fetch. On the first run, between half and three quarters of the wait for the first byte went on setting up the connection. None of the four had a single parser-blocking script, which is the fault performance guides lead with.
11 min read
New posts by email
One email when something new lands here. No schedule, no digest, no sales sequence - and you can leave from any of them.
Your address is used for these posts and nothing else.