Re:View your browser's TLS fingerprint
by gruez on Friday August 20, 2021 @08:50PM
(#28253058)
This seems... kind of pointless? You'd expect the fingerprint to be fully determined by the OS/browser combination, since TLS is implemented entirely in software. But you can already get both pieces of information through the user-agent, so what's the point?
[ Parent
| on HN ]
For those exposing a lot of fingerprintable data it doesn't help much but that's not really a problem since there is already plenty of fingerprintable data.
For those trying to hide/fake fingerprintable data the mismatch between spoofed user agent and detected browser/OS combo creates a strong fingerprint in itself.
This is the general premise of fingerprinting: if you throw enough data points at it trying to escape fingerprinting itself creates a unique fingerprint.
It can be used to detect scrapers/bots that don't use a browser.
The point is that there are many many ways to fingerprint even if people spoof their user agent.
Re:View your browser's TLS fingerprint
by citrin_ru on Saturday August 21, 2021 @05:08AM
(#28255415)
> determined by the OS/browser combination
And by browser settings; at least Firefox has quite a few TLS related knobs in about:config (and settings like spdy disable affect TLS hello too).
Re:View your browser's TLS fingerprint
by richardwhiuk on Saturday August 21, 2021 @05:40AM
(#28255586)
You can observe it without being the server.