Vercel TLS Fingerprint

Help
1

Hey all, I am having trouble with the Vercel TLS fingerprint where it seems users are sharing the same fingerprint. Just wondering if you guys have any suggestions or if that is expected behaviour.

I am assuming now that the fingerprint can be shared among users who may have a similar config, but seeing first if anyone has any insight.

I am referring to these questions mostly:

2

The fingerprint consists of similar unique factors so it should remain unique always for specific device. Can you share an example?

3 Likes
3

Thanks for the reply!

We ended up finding that users in similar areas (EU, America/Canada, Pacific/Japan) were sharing fingerprints.

We are getting this by grabbing event.request.headers.get(‘x-vercel-ja4-digest’) for each user.

For instance we would have a t13d1517h2_8daaf6152771_b0da82dd1658 (I’ll need to get an exact ID if you guys needed) that would be set initially by me (on the east coast in the US). Then a user in Canada (EST as well) would enter the app and get the same shared state.

I ended up working around this by combining a few identifiers in the headers you guys give us (including x-vercel-ja4-digest). This seems to work well, but wasn’t sure if ja4 was supposed to handle that itself, which it initially seemed to. We essentially use that fingerprint to identify a non-user similar to what we would a userId.

Let me know if you needed anything else!

4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

5

It turns out that while JA4 fingerprinting can provide valuable information, it’s not designed to uniquely identify individual users or devices. The assumption that each user should generate a unique JA4 fingerprint is unfortunately not accurate. Here’s why:

  1. Standardized TLS libraries: Many applications use standard TLS libraries, which can result in identical JA4 fingerprints for different users.
  2. Common browser engines: Popular web browsers often share similar or identical TLS configurations, especially if they’re based on the same engine (e.g., Chromium).
  3. Operating system updates: When OS updates occur, many users on the same version may suddenly share the same JA4 fingerprint.
  4. Limited variability: While there are many possible TLS configurations, in practice, only a subset of secure and efficient options are commonly used.
  5. Cloud services and CDNs: Users accessing content through popular cloud services or CDNs may generate similar or identical JA4 fingerprints.

These factors explain why you are generating the same fingerprint. Your specific JA4 fingerprint is even the first one listed in this Github repo:

It’s not a malfunction, but rather a limitation of using JA4 fingerprinting for unique user identification.

2 Likes
7

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.