Is YouTube Mini Player safe?
YouTube Mini Player generates a persistent device fingerprint and sends it with every request to the developer's server.
On each YouTube page load, the extension uses bundled FingerprintJS v4.5.1 to generate a stable device identifier (visitorId), which it stores locally and appends as a tracking parameter to all API calls. Every page visit triggers a config fetch to antonkhoteev.com that transmits this fingerprint ID alongside an install-time UUID and the extension version. User interactions such as enabling picture-in-picture mode, viewing the paywall, and submitting ratings also fire GET requests to the same server with the persistent identifier attached.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
FingerprintJS Generates Persistent Device ID Sent to Developer Server
DA captured a GET to antonkhoteev.com/khoteev-api/pipy/config carrying a FingerprintJS-derived userId, right after loading YouTube.
FingerprintJS hashes canvas/WebGL/audio/font signals into this ID, letting the server correlate sessions.
You open any YouTube page with the extension installed.
No interaction is required; the fingerprinting code runs automatically on page mount.
The extension runs FingerprintJS v4.5.1, generates a stable 32-character device fingerprint, stores it, and sends it to the developer's server.
The hash is calculated once and cached in chrome.storage.local; on subsequent visits the stored value is reused without re-fingerprinting.
generateUserId, FingerprintJS integration
const generateUserId = async => {
try {
const fp = await load;
const result = await fp.get;
if (result.visitorId) {
return result.visitorId;
}
} catch (e) {}
return null;
};| Field | Value | Why it matters | |
|---|---|---|---|
Device fingerprint ID | c3c46173b52097fd436012c4d25414fc | A 32-character hex hash of your browser and hardware traits. It stays the same across visits, letting the server link your YouTube sessions. | |
Canvas rendering signature | Aq6+ACgAAAAA... (base64 canvas snapshot) | How your GPU renders specific shapes; contributes to the fingerprint. Differs between devices and graphics drivers. | |
WebGL renderer string | ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Direct3D11 vs_5_0 ps_5_0) | Your GPU model and driver version, as reported by WebGL; a high-entropy fingerprint signal. | |
Audio context fingerprint | 124.04347527516074 | A numeric hash of how your browser processes audio; stable per device. |
- antonkhoteev.com
Developer's own API server. Receives userId (FingerprintJS hash), userUuid, and extension version on every YouTube page load. Declared in manifest host_permissions.
- m1.openfpcdn.io
FingerprintJS npm monitoring endpoint. Receives a GET request approximately 0.1% of the time (Math.random < 1e-3) to report library usage. Operated by Fingerprint Inc.
Config Fetch Transmits Device Fingerprint and Install UUID on Every YouTube Page
DA captured a GET to antonkhoteev.com/khoteev-api/pipy/config carrying userId (FingerprintJS hash), userUuid (install UUID), and version on every YouTube load, before interaction.
Both persist across restarts, tracking your visits.
You load any YouTube page with the extension installed.
The config fetch fires automatically on every page mount with no user interaction required.
The extension immediately sends your device fingerprint ID, install UUID, and extension version to the developer's server as a GET request.
The server returns configuration data (paywall limits, rating prompts) which the extension applies locally.
initConfig, identifiers appended to config URL
const initConfig = async => {
var _a, _b;
try {
const getConfigUrl = new URL("https://antonkhoteev.com/khoteev-api/pipy/config");
if (userStore.userId)
getConfigUrl.searchParams.append("userId", userStore.userId);
if (userStore.userUuid)
getConfigUrl.searchParams.append("userUuid", userStore.userUuid);
if ((_b = (_a = chrome.runtime)?.getManifest)?.version)
getConfigUrl.searchParams.append("version", chrome.runtime.getManifest.version);
const response = await fetch(getConfigUrl, { method: "GET" });
const config = await response.json;
// config.paywall, config.rating, config.activeSubscription applied
} catch (e) { console.log(e); }
};| Field | Value | Why it matters | |
|---|---|---|---|
Device fingerprint ID (userId) | c3c46173b52097fd436012c4d25414fc | A 32-character hex hash of browser/hardware traits from FingerprintJS v4.5.1. Stable across restarts; identifies your device persistently. | |
Install UUID (userUuid) | 7ef96777-8f6c-4087-a691-7e6d26131a3c | A UUID assigned when the extension is first installed. Unique per installation and persists in chrome.storage.local. | |
Extension version | 3.1.0 | The installed extension version number, allowing the server to track the extension version in use per user. |
- antonkhoteev.com
Developer's own API server. Receives userId, userUuid, and version on every YouTube page load, plus paywall-view and rating events. Declared in host_permissions.