It's sufficient to identify you since there is still all other tracking data any browser supplies as part of the HTTPs connection handshake [1]. It's also not

It's sufficient to identify you since there is still all other tracking data any browser supplies as part of the HTTPs connection handshake [1]. It's also not necessary to have Mozilla be the bad actor. Anyone who has access to the information in the future is a possible bad actor as they might be able to cross-reference the allegedly "innocuous" information with some future, more-pervasive data. --- [1] - https://github.com/salesforce/ja3 https://github.com/salesforce/ja3