Author
Seth Honda
Seth Honda is the founder and developer of 404 Privacy, working at the intersection of browser identity, surveillance infrastructure, and operational privacy. He also teaches computer science and literature.
Seth Honda is the founder and developer of 404 Privacy. Articles discussing browser fingerprinting, attribution risk, or anti-fingerprinting technology may reference software and services developed by 404 Privacy.
Published research
Articles by Seth Honda
How Israel Used Ad Auctions to Deliver Spyware to Journalists
Ad auctions were used to target journalists at Al Jazeera and plant spyware on their devices. Devices were reached through advertisements placed by Israeli company Discover-Tech. Devices were then directed into infrastructure associated with Candiru, a mercenary spyware developer.
· 9 min read
ICE is Researching an AI Assistant to Interface with Billions of Records
Overregulation often leads to circumvention. This is a broad concern surrounding privacy minimums in the United States. If we continue to raise privacy standards, the worry is that companies that depend on data extraction will become more aggressive, invasive, and creative in their collection methods. This was largely the case when data aggregators and the advertising industry realized cookies were an easy signal to reject, and they began investing heavily in browser fingerprinting technology.
· 4 min read
404 Privacy Selected for Hawaiʻi WAVE 2026-27 Cohort
404 Privacy has been selected for Cohort 2 of the Hawaiʻi WAVE Dual-Use Incubation Program. See the official release. Hawaiʻi WAVE is operated by the Pacific International Center for High Technology Research (PICHTR) and funded by the Hawaiʻi Technology Development Corporation (HTDC). The seven-month program supports technology companies exploring applications across commercial, government, and national-security markets. Aiming to provide companies the mentorship, customer-discovery support, m
· 2 min read
What is Flock, and Why Are There Cameras All Over My City?
Flock Safety has put up more than 100,000 Automated License Plate Readers (ALPRs) across the United States. These ALPRs read and log every license plate that passes it, communicating the information it collects to local law-enforcement agencies and connected databases, often using AI to enforce traffic laws, find stolen vehicles, or locate individuals. In large cities, it seems that these cameras are at every intersection. There are other companies like Genetec and Axis, with Flock being the m
· 4 min read
Why I'm Building Privacy Software on a Teacher's Salary
On Friday, the seniors at my school were filling out 'post-grad' surveys and the QR codes were posted in my room. This was done without warning, but with no protest from me. As students milled in and out, my coworker – the "survey facilitator," if you will – caught a glimpse of a privacy guide that I was reading, and what ensued was a long conversation about privacy and its importance. This conversation is a well rehearsed dance for me at this point, I know which arguments to concede and which
· 6 min read
Companies Are Ignoring Your Opt-Out and Google is Enabling Them - Potentially $5.8B in Liability
Cookie consent banners and GPC signals are supposed to stop companies from collecting and selling your data. A new audit finds most don’t work. An audit conducted by webXray shows that Google, Microsoft, and Meta are ignoring legally binding “reject cookies” and “opt-out” buttons as well as Global Privacy Control (GPC) signals. The audit visited 7,634 popular websites with and without the Global Privacy Control opt-out signal enabled. GPC is not a browser extension or a third-party tool. It
· 5 min read
Building Custom Authorization: Adding User Accounts Without Handing Your Data to Google or Supabase
The defaults are easy because someone made them that way. Firebase, Supabase, Auth0, Google Sign-In. These solutions are well-documented, widely used, and take about twenty minutes to integrate. That convenience is real, but so is the tradeoff for your users. I built 404's account system without any of them. The site is fast, the auth works, it (should) scale, and it has been in production since launch. The stack is a Cloudflare Worker, a D1 database, and a self-hosted email API (Resend or Mail
· 11 min read
Watched People are Different People
At the school where I teach, teachers stand in the hallway during passing periods. Admin tells us it's because "our presence has power." The idea is simple: an authority figure in the hall changes how students walk through it. No intervention required. The possibility of being caught is enough. Still, we don't watch them every minute of the day because, as teachers, as authority figures, we have to be aware of the effect that our presence has. I know what happens when I stand behind a student
· 5 min read
LinkedIn Is Scanning Your Browser Extensions. This Is How They Use the Data.
When companies get caught doing this sort of thing, the response is almost always the same: "we're using this technology to combat fraud," or "ensure positive user experience," or "save computing resources," or some other hog wash. The simple truth, there's no reason to be collecting data that can be used to identify a user across the web if they're not signed in to your service. The harm of companies like Experian or LinkedIn being able to correlate all of your web traffic back to you is not
· 7 min read
Browser Fingerprinting Is the Ad Industry's Response to Your Privacy Settings
Why the ad industry replaced cookies with something you can't block In 2018, GDPR became enforceable. In the years that followed, state privacy laws and the widespread adoption of ad blockers gave ordinary users a meaningful way to opt out of data collection for the first time. For the ad-tech industry, this was an existential problem. Their business model depends on extracting behavioral data from web traffic and turning it into user-profiles that drive clicks, place ads, and convert sales. A
· 7 min read