Recognising a browser can stop fraud or enable tracking; the limits decide which

Keshia Rose, who works in developer relations at Fingerprint, described on Software Engineering Daily how the company recognises browsers to stop fraud. She also described a Firefox flaw that let sites recognise a browser in a way that tracked people across sites. The episode covered fraud prevention and AI agents.

What was said

Rose described Fingerprint's open source library. It looks at how a browser draws images, which fonts and plugins it has, its screen size and its operating system. It combines these into a hash, a short code that can identify the device later.

A bank can use that code to skip a repeat password. It can also flag a browser last used with a stolen credit card. Cookies fail for fraud work, Rose said, because a bad actor deletes them. "Now you've completely lost track of this person."

She then described a Firefox flaw in private browsing, which also affected Tor Browser. She said she was not the researcher. Websites can store databases in the browser, and the list came back in a scrambled order. She thought the order came from IDs the browser stored per database name. Sites using the same names therefore saw the same order, and could recognise the browser. Fully quitting the browser reset it.

Fingerprint's research team found the flaw, and the company disclosed it. Rose said each customer gets a different visitor ID, so two customers cannot match the same phone. She said the company does not want to build profiles on people or follow them across the internet.

Why it matters

Our reading: both cases identify a browser, but with different signals. One uses drawing and fonts. The other used the order of a database list. So the signal alone does not decide whether the result is fraud defence or tracking. Scope does: whether an identifier is shared across customers and sites. Buyers can ask how identifiers are separated between customers, and what a vendor does when it finds a flaw.

Users carry the cost of a leak. Rose pointed to people in private browsing or Tor who may be doing government work or dissenting.

The other side

Rose speaks for a company that sells device recognition, and the limits she described are that company's own choices. She said she did not make the disclosure call herself. She said such disclosures are rare, with a couple so far. The test is whether the company believes in the privacy aspect and whether the signal is strong. That is judgement, not an outside rule.

The excerpts do not say whether Mozilla fixed the flaw. They also do not say what holds other vendors to the same limits, or how a user could check.