Browser Fingerprinting in 2026: JS Signals Fade as Network-Level Techniques Rise

·1 views

Browser fingerprinting remains viable in 2026, but the landscape has shifted significantly as major browsers have neutralized many traditional tracking signals. Chrome, Firefox, Safari, and Brave have frozen or restricted JavaScript-accessible APIs such as User-Agent strings, navigator.plugins, and navigator.platform, rendering them largely useless for identification. Meanwhile, techniques like WebGL rendering, AudioContext, and TLS fingerprinting via JA4 continue to provide meaningful identifying signals due to hardware-level variation or network-layer operation. Network-level signals, including HTTP/2 settings and TCP/IP stack analysis, are increasingly favored because they operate below the browser API surface and cannot be blocked by privacy extensions. Experts caution that no single fingerprint should be treated as definitive proof of a visitor's identity or intent, and much of the guidance published just two years ago is now considered outdated.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

oxlint outpaces ESLint by 13x on Vue core, even with type-aware rules enabled

A developer benchmarked ESLint and oxlint against Vue's core repository — 445 TypeScript files totalling around 150,000 lines — using both syntactic and type-aware rule sets. ESLint completed the plain syntactic pass in 4.4 seconds and climbed to 12 seconds when type-aware rules were enabled, requiring the TypeScript compiler to run first. oxlint, a Rust-based linter built by VoidZero — the company founded by Vue and Vite creator Evan You — finished the syntactic pass in just 0.24 seconds, with its internal engine time recorded at 75 milliseconds. When oxlint's own type-aware mode was enabled via the --type-aware flag, it completed the same class of analysis in 0.9 seconds, roughly 13 times faster than ESLint's equivalent pass. The author noted that while the rule sets are not identical between the two tools, the results challenge the assumption that oxlint's speed comes from skipping expensive checks rather than from genuine performance gains.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a deprecated cryptographic key exposed a flaw in schema validation design

A developer encountered a validation failure after adding a retired signing key whose scheme was no longer in the accepted set. Rather than widening the live set or discarding the old key, the solution was to introduce a separate 'schemes_retired' field, keeping the two sets distinct by capability rather than by time. The published specification was updated by retiring the old claim and adding a new scoped one alongside it, preserving an auditable record of the change. A pre-existing audit tool flagged the retired key as a violation, but this was logged as a known gap rather than silently patched, to avoid masking an underlying design flaw. The episode highlighted how naming conventions and set boundaries that appear cosmetic can carry real downstream consequences for counters, audits, and published guarantees.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a Single Accuracy Score Can't Measure Bot Detection's Real Cost

Bot detection systems that report high overall accuracy can still cause significant harm by wrongly blocking legitimate users, a problem known as false positives. The consequences vary sharply by route — a blocked checkout interrupts revenue, while a failed password reset locks out a real customer. Because most traffic on consumer-facing apps is legitimate, a detector can appear 99.7% accurate while still mishandling thousands of genuine requests daily. Experts recommend evaluating three separate metrics — precision, recall, and false-positive rate — rather than relying on a single aggregate score. Different enforcement actions such as hard blocks, challenges, and monitoring should each be governed by different thresholds based on the cost of each type of error.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agent Authentication in 2026 Requires Layered Stack, Not a Single Protocol

As AI agents grow more complex, experts warn that no single protocol can handle their full authentication needs. A 2026 IETF Internet-Draft proposed a multi-layer architecture covering agent credentials, delegated user authority, workload identity, authorization, and audit trails. Google separately announced the open Agentic Resource Discovery (ARD) specification to help agents find and verify agentic capabilities without relying on hard-coded endpoints. Together, ARD, Web Bot Auth, OAuth, and workload identity standards each address distinct gaps in the agent identity chain. Collapsing these layers into a single API key, experts note, eliminates the audit trail and exposes systems to serious security risks.

0 comments Read more at DEV Community