I would say how unique the fingerprint really is is actually an important issue, I wonder how much traffic / time does it take before collisions start to occur.

I would say how unique the fingerprint really is is actually an important issue, I wonder how much traffic / time does it take before collisions start to occur. In the current setting it would probably suffice if the fingerprint generated one of just 100 or 500 values, the traffic is probably rather low and you visit the page for maybe few minutes and you probably won't go back to it in 3 days or even in 1 hour just to check whether some other guy didn't overwrite your secret word. Regardless, it's a very interesting idea, and also picturing how difficult and counter-intuitive security can be if you do not study such issues, as an API designer I would surely have a hard time foreseeing that exposing the screen size or fonts list can turn out to be a security issues for the users.