A good fingerprinting method (only applies to devices on private networks), is using JavaScript to enumerate the devices/services on a user's network (running H

A good fingerprinting method (only applies to devices on private networks), is using JavaScript to enumerate the devices/services on a user's network (running HTTP(S) or other services if they are in the 'safe' port range). You can also test for models/versions of a router on their network (for example, many routers allow access to static content such as images without authentication), so if a unique/uncommon image, CSS, or JavaScript URL can be accessed without authentication, then the user can be fingerprinted not just across browsers, but across devices as well (even in a VM). This is done using network timing (to test if TCP servers exist) and the onload/onerror XHR events which can be done even for 3rd party origins, by creating img or iframe elements.