... visibly fail, passkeys just quietly don't get adopted. the irony is that the friction is mostly on the builder side, not the user side. once a passkey is set up, the experience is genuinely better. face ID or fingerprint, done. no form, no reset email, no support ticket. curious where people are on this. are you shipping passkeys yet? and if not, what's actually blocking you? Comment from Zara Noelle(@zara_noelle): @riya_pariyar   @ethan_gabriel ...

... rest. Anyone who actually wants around it changes network and carries on. Cookie and localStorage counters. Cleared trivially, so they only stop the people who weren't trying. Not worthless, but a speed bump rather than a limit. Browser fingerprinting. Would probably work. I don't want to do it. It feels like a worse thing to do to a stranger than asking them to sign in, which is the exact thing I just removed. Where I'm actually stuck ...

... account, so the free tier survives without a login; putting the gate on the output rather than the input; and simply accepting first-touch as lost. I'm stuck on that last one, because both obvious fixes are bad. Fingerprinting is creepy and I don't want to do it. An email capture on the anonymous path just rebuilds the wall I removed, one step later. Two questions for anyone who's been through this: What do you actually ... ... number you trusted again, or did you give up and start measuring something else entirely? Comment from Lily Harrison(@lilydigital): I would create temporary session ID and let users voluntarily claim it during signup. That keeps attribution useful without fingerprinting

... happen to scan while the implant is sitting there. Useless for the two questions you actually have when a worm is circulating did something change, and what could whoever got in reach? Now: every scan records a fingerprint of what auto-executes in the repo, and the next one tells you what moved. A file that auto-executes appeared. An existing one's contents changed. A branch tip that used to be signed no longer is. It survives renames ... ... repos got hijacked rather than a filename list, which is why renamed variants still trip it. but i should be straight about the delta axis specifically: it can't be validated that way by construction. you'd need a fingerprint

... public profiles, phone number discovery or messages from strangers. Connections are created through single-use, time-limited QR, NFC or private token invitations. The current Android build includes encrypted messaging and attachments, trusted contacts, automatic message expiry, PIN and fingerprint protection, multiple selected recipients and an emergency alarm feature. I m especially looking for feedback on: APK installation and onboarding Invitation and pairing Adding trusted contacts Sending messages and images Message expiry PIN and fingerprint

... aggressively the same IPs get reused across customers, and once an IP gets flagged, it stays flagged. A smaller pool of freshly validated IPs consistently outperformed a massive pool of stale ones. 2. Rotation patterns are easy to fingerprint We used to rotate IPs on every request, thinking that was the gold standard. But anti-bot systems don't just look at IPs they look at patterns. If your requests always come from a new IP with identical timing, headers ... ... browser fingerprints

... months ago, I started building StealthHound with one goal: make invisible web tracking visible. Most people know about cookies, but far fewer know about browser fingerprinting a technique that can identify your device without relying on cookies. I wanted to build a tool that could expose and block these techniques in real time while keeping everything local and privacy-first. Today, I was genuinely surprised to see StealthHound featured by Lifehacker in their article about protecting yourself from browser fingerprinting

... encrypted vault when you type your secret trigger word in the search bar. What makes it different: 100% offline, zero cloud, zero accounts AES-256-GCM encrypted vault Real notes app on the outside, private vault on the inside Fingerprint, PIN, pattern, and password unlock Multiple isolated vaults We are on Google Play and would love feedback from the Product Hunt community on the UX, positioning, and what would make this more useful or trustworthy. Happy to answer any questions ...

... blocked instantly. Match the rotation mode to the task, not a fixed interval. 2. Your TLS handshake is leaking. This one caught us off guard. Anti-bot systems don't just check your IP they fingerprint your TLS handshake (JA3/JA4 hash) before any HTTP header is even sent. Python's requests library, curl, and non-browser clients each produce recognizable fingerprints

... Working on StealthHound Premium . More insights. More control. More visibility into hidden trackers and browser fingerprinting. Target release: End of 2026. Building for the 2,000+ people who already trust StealthHound to protect their privacy ...

... sitting in your own record, and it lands better coming from you than from the person who looked it up. Comment from Abdullah Javaid(@abdullah_javaid3): @abhineetarora  Watermarking and the manifest are the same kind of claim. The fingerprint lookup is not. A manifest travels with the file, so a stranger checks it without asking you anything. A fingerprint

... when the agent hits a genuine judgment call, not a failure, who in that 30-person setup ends up being the input, and how does it know? Comment from Alexander Bering(@alexanderbering): @aadilghani  The reason "edit vs. tell-it-to-revise vs

... StealthHound just crossed 1,000+ users StealthHound - https://chromewebstore.google.co... Built completely independently in 5 months: no paid ads no growth team no funding just shipping relentlessly StealthHound protects users from: hidden trackers browser fingerprinting silent data collection invasive tracking scripts The idea was simple: Most people block ads, but very few know websites can still identify and track them through fingerprinting

... Firefox-based browser. Oasis ships  Enhanced Tracking Protection  on by default. Insight for other users:  ETP blocks known  trackers  that follow you across the web:  social buttons ,  cross-site scripts ,  fingerprinting ,  cryptomining , and many  third-party analytics . It is  not a full ad blocker . It targets  tracking-related  content while trying to keep core site features working. What you get: Privacy:  Less cross-site profiling ... ... meaningful default for daily browsing. Doc:  https://kahana.io/docs/enhanced-... Questions we would love your take on: Default level Is  Standard  the right default, or should new users start on  Strict ? Strict vs

... Next.js / Vercel, stateless PWA. No native app. 75-register mood taxonomy I hand-curated over months. Each one has an editorial definition + canonical exemplar films. Stuff like warm hug, neon nights, anxious dread, intellectual puzzle, melancholy beauty. Defining "wistful" vs "melancholy" as non-overlapping is a real design problem. 43,000 films classified across all 75 registers via batched LLM pass, that was trained on the sources and ways to score. Each film ends up with a 75-dim mood ... ... popular-but-bland ones. A 200-vote cult film beats a 1M-vote generic action film if the mood vector matches. Every film page shows its top 3 mood registers + an "In the same key" panel using the same fingerprints

... installed for the future Shopify OAuth state vault. Where we are now: Blaze can now preview the future Shopify OAuth state lifecycle without storing anything yet. That includes: issuing a future state receipt binding state to tenant/workspace/store/operator context showing fingerprint-only receipts previewing one-time-use state consumption previewing replay rejection previewing expired state rejection previewing session mismatch rejection previewing rollback posture showing the future migration structure before it is created This is intentionally not live OAuth yet. No real ... ... been run for the future OAuth state vault yet. That is the point of this stage: we are building the lock system before opening the door. The latest beta room previews the future shopify_oauth_states table, including: state fingerprint

... Product Hunt! I'm the solo maker behind PeekMyIP a free privacy & network toolkit. Instant IP lookup, DNS leak test, proxy check, browser fingerprint and more. No sign-up, no ads. Launching this Tuesday May 12th would love your support! Built it because I was tired of IP tools cluttered with ads that required accounts just to see basic info. Happy to connect with other makers here! Comment from Rian Robertson(@rianbrob): Love this...a clean, ad-free toolkit ...

... installed for the future Shopify OAuth state vault. Where we are now: Blaze can now preview the future Shopify OAuth state lifecycle without storing anything yet. That includes: issuing a future state receipt binding state to tenant/workspace/store/operator context showing fingerprint-only receipts previewing one-time-use state consumption previewing replay rejection previewing expired state rejection previewing session mismatch rejection previewing rollback posture showing the future migration structure before it is created This is intentionally not live OAuth yet. No real ... ... been run for the future OAuth state vault yet. That is the point of this stage: we are building the lock system before opening the door. The latest beta room previews the future shopify_oauth_states table, including: state fingerprint

... built a privacy-friendly analytics tool and I'd love your feedback I'm a solo dev and I built Pulse - a lightweight, privacy-first alternative to Google Analytics. One script tag, no cookies, no fingerprinting

... text. Even the general structure doesn't tell you much, at least for articles where humans were pushed into the same handful of SEO-friendly templates before generative AI became widespread. Comment from Fabrizio Pfannl(@fabriziowexare): Honest answer: AI-vs-human detection is mostly broken now. What still works is detecting whether a piece of writing was edited by someone with an opinion versus

... bots and fake accounts Improve trust in conversations Clean up spam-heavy communities On the other hand, Reddit has always been built on anonymity , and changes like this could shift how people use the platform entirely. There are also alternative ideas being floated: Zero-knowledge proof verification Device-based authentication Temporary human verification tokens Two questions for the PH community here: If you use Reddit, what would you want: fewer bots or actual anonymity? Should Product Hunt apply the same ... ... ideas, not the identity behind them. Some of the best technical advice I've ever gotten came from throwaway accounts. Kill anonymity, and you kill that dynamic. For Product Hunt specifically , I think lightweight verification (like email + device fingerprinting

... much of your traffic is actually bots? We've been seeing a pattern where teams are making campaign decisions based on analytics that are heavily skewed by bot traffic. It's not just the obvious stuff, it's fingerprinting, scrapers, and sophisticated traffic that looks legitimate at first glance. And it's poisoning conversion rates, skewing ROI, and making it impossible to trust dashboard data. Some context: I'm working on a solution for this (intelligent edge-routing that validates ...

... Half of them were bots. Not simple ones either. Headless browsers mimicking human behavior perfectly. Selenium scripts automating clicks at scale. Click farms using mobile devices. Advanced stuff rotating IPs, spoofing geolocation, faking mouse movements, generating realistic referrer patterns. Fingerprinting evasion. Timing tricks. Some were so good they looked completely human. We realized most link tools just count clicks. They don't ask if those clicks are real. So we built something different. We analyze every single click in real ... ... signals. We're looking for browser automation flags, Selenium and PhantomJS and Puppeteer signatures. Rendering engine discrepancies. Timing inconsistencies. Headless browser signatures. Impossible geographic travel patterns. Click velocity, if someone's generating 10 clicks per second from the same fingerprint

... hack your way to an edge. Out-of-sample is sacred the system locks OOS testing to one shot. You don't get to peek and re-run. Once it's done, it's done. Fingerprinting every unique combination of formula, market, horizon, and entry is tracked. You can't accidentally double-count or test the same thing twice. Real event studies, not curve-fitted backtests we measure forward returns from pattern signals, not fit a model to historical equity ...

... Solo builder here, won't say much about the product yet but happy to talk shop on the plumbing. Quick version of what I'd tell my past self: Auth - Supabase, Clerk, Auth0, pick one. An afternoon of setup vs. days of building it badly. I tried the days version first, do not recommend. Permissions - this is the sneaky one. Most people check "can this user see this?" in their app code. Way better to push the rule into ... ... tattoos or mockups) Tech-wise I m using: Flutter for the mobile app Firebase (Firestore + functions) OpenAI + Replicate for image generation (testing multiple models right now like DreamShaper, Flux, Ideogram) Biggest challenge so far has been balancing quality vs