5 ms·

View your browser's TLS fingerprint

93 points by jonatron 5y ago

ElijahLynn 5y ago
I click through and it isn't immediately obvious how to View my browser's TLS fingerprint, it doesn't show it. Update: Works - Brave users - you need to disable Shields for it to show your fingerprint.
- jonatron 5y ago
  I had to disable uBlock for the site to see it.
  - gentleman11 5y ago
    Accidental advertisement for both?
    - judge2020 5y ago
      The TLS fingerprint uri it's blocking doesn't collect any information from the browser, sites can still use it as a fingerprint on noscript-disabled browsers.
- DeadBeatDad 5y ago
  Same here. I browse with JS disabled by default using uBlock Origin. I only rarely have to whitelist a site to make it work (as in this case)
hypothesis 5y ago
Interestingly, fingerprint changes after you reload that page. It went from #2 most common upon opening to #5 after subsequent reload.
- WelcomeShorty 5y ago
  I get this with a new tab / window Your browser generates the fingerprint 133e933dd1dfea90 (from Cluster #8), which is seen in 17.13% of connections, making it ranked #2 by popularity. And this after a reload: Your browser generates the fingerprint 833fb25fb38a093b (from Cluster #8), which is seen in 4.11% of connections, making it ranked #5 by popularity. macOS safari
  - deleted 5y ago
    [deleted]
- code_duck 5y ago
  It did that for me then changed back.
- bawolff 5y ago
  They say they're doing the clienthello message. That would change depending on if its your first visit to that domain or second because your second would use session resumption.
icecap12 5y ago
Nice tool. Reminds me a bit of amiunique.org, which provides similar browser diversity and fingerprinting details.
- beprogrammed 5y ago
  New to me, thanks. https://amiunique.org https://amiunique.org
beebeepka 5y ago
Oh, the irony of not being able to see one of your browser's fingerprints without opening up to all kinds of other js based data collection techniques
- jonatron 5y ago
  https://tlsfingerprint.io/static/fingerprint.js https://tlsfingerprint.io/static/fingerprint.js is only a few lines and readable if you don't want to enable javascript.
  - adolph 5y ago
    That JS just fetches the below, which seems to perform the interesting stuff serverside, and displays the data. https://client.tlsfingerprint.io:8443/ https://client.tlsfingerprint.io:8443/
gruez 5y ago
This seems... kind of pointless? You'd expect the fingerprint to be fully determined by the OS/browser combination, since TLS is implemented entirely in software. But you can already get both pieces of information through the user-agent, so what's the point?
- foxfluff 5y ago
  The point is that there are many many ways to fingerprint even if people spoof their user agent.
- jonatron 5y ago
  It can be used to detect scrapers/bots that don't use a browser.
- zamadatix 5y ago
  For those exposing a lot of fingerprintable data it doesn't help much but that's not really a problem since there is already plenty of fingerprintable data. For those trying to hide/fake fingerprintable data the mismatch between spoofed user agent and detected browser/OS combo creates a strong fingerprint in itself. This is the general premise of fingerprinting: if you throw enough data points at it trying to escape fingerprinting itself creates a unique fingerprint.
- citrin_ru 5y ago
  > determined by the OS/browser combination And by browser settings; at least Firefox has quite a few TLS related knobs in about:config (and settings like spdy disable affect TLS hello too).
- richardwhiuk 5y ago
  You can observe it without being the server.
- DeadBeatDad 5y ago
  > But you can already get both pieces of information through the user-agent This is why I have the `resistFingerprinting` flag set to `true` in Firefox
hosteur 5y ago
Can this be used to track me? By ad networks and others?
- bawolff 5y ago
  Its probably not unique enough to give the type of tracking that an ad network would want unless combined with something else. So, not by itself, but its might be part of a tracking solution.
deleted 5y ago
[deleted]
bradleyjkemp 5y ago
Similar: https://ja3er.com/ https://ja3er.com/ which is formed by taking a bunch of (stable) attributes from your TLS handshake, appending them into a string, and hashing it. They've also done the correlation with User Agent and it's surprisingly accurate. Original post by Salesforce security team: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967?gi=f77290b060b7 https://engineering.salesforce.com/tls-fingerprinting-with-j...

93 points by jonatron 5y ago

I click through and it isn't immediately obvious how to View my browser's TLS fingerprint, it doesn't show it. Update: Works - Brave users - you need to disable Shields for it to show your fingerprint.

jonatron 5y ago
I had to disable uBlock for the site to see it.
- gentleman11 5y ago
  Accidental advertisement for both?
  - judge2020 5y ago
    The TLS fingerprint uri it's blocking doesn't collect any information from the browser, sites can still use it as a fingerprint on noscript-disabled browsers.
DeadBeatDad 5y ago
Same here. I browse with JS disabled by default using uBlock Origin. I only rarely have to whitelist a site to make it work (as in this case)

hypothesis 5y ago

Interestingly, fingerprint changes after you reload that page. It went from #2 most common upon opening to #5 after subsequent reload.

WelcomeShorty 5y ago
I get this with a new tab / window Your browser generates the fingerprint 133e933dd1dfea90 (from Cluster #8), which is seen in 17.13% of connections, making it ranked #2 by popularity. And this after a reload: Your browser generates the fingerprint 833fb25fb38a093b (from Cluster #8), which is seen in 4.11% of connections, making it ranked #5 by popularity. macOS safari
- deleted 5y ago
  [deleted]
code_duck 5y ago
It did that for me then changed back.
bawolff 5y ago
They say they're doing the clienthello message. That would change depending on if its your first visit to that domain or second because your second would use session resumption.

icecap12 5y ago

Nice tool. Reminds me a bit of amiunique.org, which provides similar browser diversity and fingerprinting details.

beprogrammed 5y ago
New to me, thanks. https://amiunique.org https://amiunique.org

beebeepka 5y ago

Oh, the irony of not being able to see one of your browser's fingerprints without opening up to all kinds of other js based data collection techniques

jonatron 5y ago
https://tlsfingerprint.io/static/fingerprint.js https://tlsfingerprint.io/static/fingerprint.js is only a few lines and readable if you don't want to enable javascript.
- adolph 5y ago
  That JS just fetches the below, which seems to perform the interesting stuff serverside, and displays the data. https://client.tlsfingerprint.io:8443/ https://client.tlsfingerprint.io:8443/

gruez 5y ago

This seems... kind of pointless? You'd expect the fingerprint to be fully determined by the OS/browser combination, since TLS is implemented entirely in software. But you can already get both pieces of information through the user-agent, so what's the point?

foxfluff 5y ago
The point is that there are many many ways to fingerprint even if people spoof their user agent.
jonatron 5y ago
It can be used to detect scrapers/bots that don't use a browser.
zamadatix 5y ago
For those exposing a lot of fingerprintable data it doesn't help much but that's not really a problem since there is already plenty of fingerprintable data. For those trying to hide/fake fingerprintable data the mismatch between spoofed user agent and detected browser/OS combo creates a strong fingerprint in itself. This is the general premise of fingerprinting: if you throw enough data points at it trying to escape fingerprinting itself creates a unique fingerprint.
citrin_ru 5y ago
> determined by the OS/browser combination And by browser settings; at least Firefox has quite a few TLS related knobs in about:config (and settings like spdy disable affect TLS hello too).
richardwhiuk 5y ago
You can observe it without being the server.
DeadBeatDad 5y ago
> But you can already get both pieces of information through the user-agent This is why I have the `resistFingerprinting` flag set to `true` in Firefox

hosteur 5y ago

Can this be used to track me? By ad networks and others?

bawolff 5y ago
Its probably not unique enough to give the type of tracking that an ad network would want unless combined with something else. So, not by itself, but its might be part of a tracking solution.

deleted 5y ago

[deleted]

bradleyjkemp 5y ago

Similar: https://ja3er.com/ https://ja3er.com/ which is formed by taking a bunch of (stable) attributes from your TLS handshake, appending them into a string, and hashing it. They've also done the correlation with User Agent and it's surprisingly accurate. Original post by Salesforce security team: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967?gi=f77290b060b7 https://engineering.salesforce.com/tls-fingerprinting-with-j...