One of the more effective techniques is measuring the speed at which JS renders to your canvas. That's a sidechannel I don't think can be closed easily.

As long as JS exists, there will be effective means to examine the sandbox.

(I do agree they have unsafe defaults info. It's just removing it isn't enough.)

Is this a reliable metric? One would think there would be lots of jitter. But if you combine with something else like IP address it may be useful.

There is some noise, but there are bounds. Everyone tends to have fairly common habits and periods of transition into new habits, that combined with IPs, or geolocation, or screen sizes, that you can fairly accurately pin individual devices..

Your processors, memory, and so on all have manufacturing quirks, and then workloads provide some more. The fuzzy circle of rendering times becomes easy to use.

Various places have used it since before '14. But here's one random paper that goes into more depth. [0]

[0] https://www.ndss-symposium.org/wp-content/uploads/2022-93-pa...

You can avoid this by using curl. Half kidding.

Curl, by default, tells sites exactly what version of Curl you are using.

Then pass a random user agent string on each request