Device Fingerprinting

Collects over 100 distinct browser-level attributes to create a unique device signature. Key signals include:

• User-Agent string: Browser, version, and OS details
• HTTP headers: Accept-Language, Accept-Encoding, and Do Not Track preferences
• Installed fonts: Enumeration of system font libraries via Flash or JavaScript
• Screen resolution and color depth: Hardware display characteristics
• Timezone offset and language preferences: Geolocation indicators

Modern fingerprinting libraries like FingerprintJS combine these signals into a hash-based identifier with collision probabilities below 0.01%.

Exploits subtle rendering differences in the HTML5 Canvas API across different graphics hardware and driver configurations. The technique:

• Renders a hidden text string and geometric pattern onto a canvas element
• Extracts the pixel-level output as a base64-encoded hash
• Captures variations in anti-aliasing, sub-pixel rendering, and font hinting

Because identical rendering instructions produce slightly different outputs on different GPU/driver/OS combinations, canvas fingerprints serve as highly stable device identifiers even when cookies are cleared.

Leverages the WebGL API to probe the device's graphics hardware directly. This method extracts:

• GPU vendor and model: e.g., 'NVIDIA GeForce RTX 3080'
• Driver version strings: Specific build numbers and dates
• Supported extensions: Hardware-specific capabilities
• Render output analysis: Subtle floating-point precision differences

WebGL fingerprints are particularly effective at distinguishing devices with identical browser configurations but different physical hardware, adding a hardware-layer signal to the fingerprinting stack.

Uses the Web Audio API to measure minute differences in audio signal processing across devices. The technique:

• Generates a low-frequency oscillator signal through an AudioContext
• Processes it through a DynamicsCompressor node
• Reads back the processed waveform as a hashable byte array

Variations in floating-point arithmetic, sample rate conversion, and audio stack implementations produce device-specific artifacts. This method works even when JavaScript is heavily restricted and adds entropy independent of visual rendering pipelines.

Analyzes network-layer protocol behavior to identify the underlying operating system and device type. Passive techniques include:

• TTL (Time to Live) values: Initial TTL differs by OS (64 for Linux, 128 for Windows)
• TCP window size: OS-specific scaling factors
• IP fragmentation behavior: How the stack handles MTU boundaries
• TLS handshake parameters: Cipher suite ordering and extension preferences

Unlike browser-based methods, TCP/IP fingerprinting operates at the transport layer and cannot be spoofed by JavaScript modifications, making it valuable for detecting proxy and VPN usage.

Targets smartphone-specific signals unavailable on desktop platforms. Key mobile attributes include:

• Device model and manufacturer: Extracted via navigator properties
• Battery level and charging status: Via the Battery Status API
• Accelerometer and gyroscope calibration offsets: Hardware sensor fingerprints
• Installed app detection: Via URI scheme probing
• Cellular carrier and radio type: NetworkInfo API data

Mobile fingerprints are particularly stable because hardware sensors exhibit factory-calibrated biases that persist across factory resets, providing a hardware-rooted identity anchor.

A rule-based control that monitors the rate of specific activities from a single identity, device, or IP address within a defined time window. Key applications include:

• Login velocity: Flagging rapid successive authentication attempts indicative of credential stuffing
• Application velocity: Detecting bulk account creation from a single device fingerprint
• Transaction velocity: Identifying anomalous spending patterns inconsistent with human behavior

Velocity thresholds are typically calibrated against historical baselines and adjusted for false positive reduction.

The process of aggregating and evaluating an identity's publicly available online presence to assess authenticity and longevity. This includes examining:

• Social media profiles: Account creation dates, activity patterns, and connection graphs
• Domain registrations: WHOIS records and website history
• Data breach correlations: Cross-referencing email addresses and usernames against known breach databases

A synthetic identity typically exhibits a shallow or absent digital footprint, with accounts created recently and lacking organic interaction patterns. This analysis complements device fingerprinting by providing longitudinal identity context.

A biometric authentication safeguard that distinguishes a live human presenter from a spoofing artifact during identity verification. Techniques include:

• Active liveness: Requiring the user to perform randomized actions like blinking, smiling, or head turning
• Passive liveness: Analyzing micro-textures, light reflections, and depth information without user cooperation
• Challenge-response: Presenting unpredictable illumination patterns and verifying physiological responses

Liveness detection is critical for preventing deepfake and presentation attacks where fraudsters use photographs, video replays, or 3D masks to bypass facial recognition systems paired with device fingerprinting.