Analysis on fingerprints, some issues

[JWriter20]

Hardware Fingerprint Dataset Analysis

hardwareConcurrency — Major Contamination

This section of the dataset shows clear signs of contamination.

OS	"Junk" Core Counts Present
Windows	48 (7.6%), 56 (2.9%), 32 (2.3%), 24 (2.6%), 640 (1.6%)
macOS	384 (11.2%), 124 (2.1%), 90 (1.8%), 192 (1.8%)
Android	384 (13.4%), 96, 184, 192
iOS	384 (3.1%), 36 (3.1%), 96 (2.3%), 80, 104, 72, 64, 33

Key Observations:

• iOS Safari is hard-capped at 4 cores.
• macOS is hard-capped at 8 cores.
• Anything beyond these limits is a strong indicator of contamination.
• Extreme values like 384 and 640 cores are almost certainly server/cloud VM fingerprints leaking into the dataset.

Sane share: ~85–90%. The remainder is poison.

---

deviceMemory — Same Story

• Windows / Android / Linux: ~86% report 8 GB (correct — the API is capped at 8 GB). This is expected and clean.
• macOS: 75% at 8 GB, but 19% MISSING and ~6% spread across unrealistic values (0.5 / 1 / 2 / 4 GB). Half-GB memory on a Mac is impossible.
• iOS: 85% missing (correct — iOS does not expose deviceMemory), 15% at 8 GB.

---

Screen / DPR / colorDepth / HDR

• 800×600 resolution appears at:

  • 20.8% on macOS
  • 19.6% on Linux
  • 3.8% on Windows
    → This is the classic headless Chromium default, not a real user resolution.

• Realistic resolutions:

  • Windows: 1536×864, 1920×1080, 1366×768
  • iOS: 390×844, 393×852, 440×956, etc.

• colorDepth issues:

  • macOS: 24-bit = 70.8% (real Retina Macs report 30-bit). This skews older.
  • Windows: 32-bit = 60.7% (Chromium typically reports 24-bit; 32-bit is a legacy/spoofable value).

• DPR distributions look sane:

  • macOS: 2.0 = 57%
  • iOS: 3.0 = 84%
  • Windows: 1.0 / 1.25 / 1.5

• HDR:

  • macOS: 41.9% true
  • iOS: 72.5% true
  • Windows: 0.8% true (low but plausible)

---

Cross-OS Contamination (Consistency Failures)

navigator.platform is supposed to be conditioned on the User-Agent, but it does not match cleanly.

UA OS	Top navigator.platform Values
Windows	Win32 (92.9%), Linux x86_64 (6.9%), Win64 (0.2%)
macOS	MacIntel (78.6%), Linux x86_64 (21.3%)
Linux	Linux x86_64 (65.9%), Linux i686 (15.3%), MacIntel (4.5%), Win32 (0.2%)

A User-Agent claiming macOS with navigator.platform === "Linux x86_64" will fail even trivial consistency checks.

---

Bottom Line

• Browser side looks current (Chrome 145, Safari 26, M4/M5 Apple Silicon). The dataset has been refreshed recently.
• Hardware side is heavily poisoned (~10–15% of the joint mass):
  • Impossible core counts (384 / 640)
  • GPU-less software renderers (SwiftShader / MS Basic / llvmpipe) — ~8% Win, 38% Linux, 25% macOS
  • Headless 800×600 screens
  • Sub-8 GB Macs
  • Platform vs User-Agent mismatches

Recommendation:
If you sample from this dataset without filtering, your generated fingerprints will be detectable ~10–20% of the time using cheap consistency rules.

Fix: Apply a sanity filter at sample time:

• Reject if (macOS && cores > 24)
• Reject if (iOS && cores != 4)
• Reject if (Mac && deviceMemory != 8 && deviceMemory != null)
• Reject if (width <= 800)
• Reject if (macOS UA && platform != "MacIntel")
• etc.