Implementing Device Fingerprinting
1. Understanding Device Fingerprinting
| Use | Detail |
|---|
| Risk assessment | Detect new/unusual devices |
| Anti-fraud | Spot account takeover patterns |
| Privacy concern | GDPR — informed consent |
| Stability | Browser changes degrade fingerprint over time |
2. Collecting Browser Fingerprints
| Signal | Detail |
|---|
| User-Agent | Reducing (Client Hints) |
| Canvas | Render text/shapes → hash output |
| WebGL | GPU info, rendering |
| Audio | OscillatorNode hash |
| Fonts | Available fonts list |
| Screen | Resolution, color depth |
Deprecated: UA string detail. Use User-Agent Client Hints (Sec-CH-UA-* headers).
4. Implementing IP Address Tracking
| Signal | Detail |
|---|
| ASN | ISP / hosting provider (datacenter IPs suspicious) |
| GeoIP | Country/city — flag impossible travel |
| VPN/Proxy | Lists like IPQS, MaxMind |
| Tor exit nodes | Public list |
5. Using Device IDs
| Platform | ID |
|---|
| iOS | IDFV (per-vendor); IDFA requires ATT consent |
| Android | SSAID (per-app-signer); AAID requires opt-in |
| Web | FedCM + localStorage |
6. Implementing Feature Detection
| Feature | Signal |
|---|
| Touch support | Mobile vs desktop |
| Hardware concurrency | CPU cores |
| Device memory | RAM tier |
| Languages | navigator.languages |
| Timezone | Intl.DateTimeFormat().resolvedOptions() |
7. Using TLS Fingerprinting
| Technique | Detail |
|---|
| JA3 / JA3S | Hash of TLS ClientHello / ServerHello fields |
| JA4 | Newer, more granular |
| Use | Detect bot stacks (curl, python-requests) |
8. Implementing Trust Scoring
| Signal | Weight |
|---|
| Recognized device | + strong |
| Same IP/ASN as prior | + |
| New country | − |
| Datacenter IP | − |
| Headless browser | − strong |
9. Detecting Suspicious Devices
| Indicator | Action |
|---|
| webdriver flag | Flag as bot |
| Plugins=0 + headless | Likely automation |
| Inconsistent timezone vs IP | VPN/proxy |
10. Implementing Risk Analysis
| Step | Detail |
|---|
| Collect | Signals at login |
| Score | Weighted sum or ML model |
| Decide | Allow / step-up / block |
| Feedback loop | Mark false positives, retrain |