JavaScript fingerprint for user authentication with no cookies enabled

William Parsons · Jul 3, 2020

Would this JavaScript / PHP combination I've created in my open-source project be secure enough to fingerprint a user when no cookies are enabled?

I'd like to know your opinions (and if cookies are strictly necessary for this):

Client-side:

JavaScript:

const retrieveBrowserDetails = function() {
    const browserDetails = window.clientInformation ? window.clientInformation : window.navigator;
    const retrieveMimeTypes = function(mimeTypeObject) {
        let response = [];

        for (let mimeTypeObjectKey in Object.entries(mimeTypeObject)) {
            let mimeType = mimeTypeObject[mimeTypeObjectKey];
            response.push(mimeType.description + mimeType.suffixes + mimeType.type + (mimeType.enabledPlugin ? mimeType.enabledPlugin.description + mimeType.enabledPlugin.filename + mimeType.enabledPlugin.length + mimeType.enabledPlugin.name : false));
        }

        return response;
    };
    const retrievePlugins = function(pluginObject) {
        let response = [];

        for (let pluginObjectKey in Object.entries(pluginObject)) {
            let plugin = pluginObject[pluginObjectKey];
            response.push(plugin.description + plugin.filename + plugin.length + plugin.name);
        }

        return response;
    };
    return {
        appCodeName: browserDetails.appCodeName ? browserDetails.appCodeName : false,
        appName: browserDetails.appName ? browserDetails.appName : false,
        appVersion: browserDetails.appVersion ? browserDetails.appVersion : false,
        cookieEnabled: browserDetails.cookieEnabled ? browserDetails.cookieEnabled : false,
        doNotTrack: browserDetails.doNotTrack ? browserDetails.doNotTrack : false,
        hardwareConcurrency: browserDetails.hardwareConcurrency ? browserDetails.hardwareConcurrency : false,
        language: browserDetails.language ? browserDetails.language : false,
        languages: JSON.stringify(browserDetails.languages) ? JSON.stringify(browserDetails.languages) : false,
        maxTouchPoints: browserDetails.maxTouchPoints ? browserDetails.maxTouchPoints : false,
        mimeTypes: browserDetails.mimeTypes ? JSON.stringify(retrieveMimeTypes(browserDetails.mimeTypes)) : false,
        platform: browserDetails.platform ? browserDetails.platform : false,
        plugins: browserDetails.plugins ? JSON.stringify(retrievePlugins(browserDetails.plugins)) : false,
        product: browserDetails.product ? browserDetails.product : false,
        productSub: browserDetails.productSub ? browserDetails.productSub : false,
        userAgent: browserDetails.userAgent ? browserDetails.userAgent : false,
        vendor: browserDetails.vendor ? browserDetails.vendor : false
    };
};

Server-side PHP:

sha1(SALT_KEY . $_SERVER['HTTP_USER_AGENT'] . $_SERVER['HTTP_HOST'] . $_SERVER['REMOTE_ADDRESS']);

insightstudio · Jul 4, 2020

So what happens when you are using 4G mobile connection, and your IP just rotates?

TomTheCat · Jul 4, 2020

Get inspired.

Code:

https://github.com/fingerprintjs/fingerprintjs2

William Parsons · Jul 4, 2020

insightstudio said:
So what happens when you are using 4G mobile connection, and your IP just rotates?

Do 4G mobile connections rotate that often? I suppose they'd have to log in again after the IP rotates every few days, or they'd just enable cookies.

insightstudio · Jul 4, 2020

4G IPs can rotate really often. People can use VPNs and proxies - especially if your website / service could be somehow abused for freebies depending what you offer. People will do that.

William Parsons · Jul 5, 2020

insightstudio said:
4G IPs can rotate really often. People can use VPNs and proxies - especially if your website / service could be somehow abused for freebies depending what you offer. People will do that.

So the tradeoff of not requiring cookies for authentication would be having to log in and create a new session whenever your IP changes.

For it to be completely secure, it seems like they'd have to either install a custom browser plugin with a unique name or just use a dedicated IP (with a VPN, proxy or static IP home connection).

daibu · Nov 5, 2020

You're reinventing the wheel. Unless this is for a school project or something, you should probably just use fingerprintjs2.

JavaScript fingerprint for user authentication with no cookies enabled

William Parsons

BANNED

insightstudio

BANNED

TomTheCat

Elite Member

William Parsons

BANNED

insightstudio

BANNED

William Parsons

BANNED

daibu

Junior Member

Main Menu

Marketplace

Making Money

BlackHat World