Re: Fingerprinting with JA3 and JA4 hashes

Hi,

On Sat, Jul 13, 2024 at 08:03:13PM +0200, [email protected] wrote:
>I was doing some tests on browserleaks.com with TLS fingerprinting.
>
>https://tls.browserleaks.com/iframe/ja3_hash
>
>On Dillo with LibreSSL, this hash changes every time I reload the page.
>On Firefox (which uses NSS), the hash stays the same. I don't know if I
>understand fully, but it seems like LibreSSL is resistant to this type
>of fingerprinting.

Very nice discovery. I can also reproduce the same behavior with 
LibreSSL, but with OpenSSL it stays the same.

Unfortunately, the JA3n hash stays the same for LibreSSL.

I also found a way to access the "raw" data in JSON using:

   https://tls.browserleaks.com/tls

With this little patch, the response can be shown in Dillo too:

--8<--
diff --git a/src/IO/mime.c b/src/IO/mime.c
index 9d5e6738..2361a459 100644
--- a/src/IO/mime.c
+++ b/src/IO/mime.c
@@ -112,6 +112,9 @@ void a_Mime_init()
  
     /* Add a major type to handle all the text stuff */
     Mime_add_major_type("text", a_Plain_text);
+
+   /* Display JSON as plain text too */
+   Mime_add_major_type("application/json", a_Plain_text);
  }
  
  
--8<--

There is also JA4[1,2], which can be displayed here:

   https://ja4db.com/id/ja4/
   https://ja4db.com/id/ja4h/

[1]:https://developers.cloudflare.com/bots/concepts/ja3-ja4-fingerprint/
[2]:https://github.com/FoxIO-LLC/ja4

Both JA4 hashes seem to stay the same on reloading the page using 
LibreSSL.

Best,
Rodrigo.
_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]