Beyond IP: 15-Dimensional Browser Fingerprinting and the Environment It Exposes

1. Why Focusing Only on IP Creates a False Sense of Security

Many people evaluate whether an environment is “clean” by doing only one thing: visiting an IP-lookup page to see which city their exit IP belongs to. IP addresses are indeed important, but they are only a weak, easily spoofed, outermost server-side signal. Within tens of milliseconds after a page loads, a modern browser can legitimately read many environment-related properties. Together, these properties have a much higher uniqueness than a single IPv4 address.

More importantly, most risk-control decisions do not depend on whether one specific value is rare. They depend on whether the characteristics contradict each other. For example, an IP located in the western United States, a system time zone set to UTC+8, a preferred language of Chinese, a font set containing full Simplified and Traditional Chinese font libraries, and a sound-card driver signature from a local vendor may each individually be explained as “a Chinese user living abroad.” However, the probability that all of these conditions hold at the same time drops rapidly toward zero in statistical terms. What triggers a risk signal is not “who you are,” but the fact that the signals tell an internally inconsistent story.

2. What Dimensions Make Up a Browser Fingerprint

The following sections organize the main dimensions into three layers: directly readable by the client, requiring active probing, and visible to the server. This covers the common checks used by enterprise-grade anti-fraud engines.

1. Fonts: An Easily Overlooked, High-Weight Signal

Font probing is very cheap to implement. The same probe text can be measured using three baseline font families: serif, sans-serif, and monospace. Each candidate font is then measured again. If the width changes, the font is considered installed.

function probeFonts(candidates, sample = 'mmmmmmmmlli1234567890') {
  const ctx = document.createElement('canvas').getContext('2d');
  const baselines = ['serif', 'sans-serif', 'monospace'];
  const baseWidth = {};
  for (const b of baselines) {
    ctx.font = `72px ${b}`;
    baseWidth[b] = ctx.measureText(sample).width;
  }
  // If any baseline width changes, the font is considered installed.
  return candidates.filter(name => baselines.some(b => {
    ctx.font = `72px "${name}", ${b}`;
    const w = ctx.measureText(sample).width;
    return Math.abs(w - baseWidth[b]) > 0.5;
  }));
}

An English-default environment should not contain a complete Chinese font set. Similarly, a purely Chinese desktop environment should not contain only Western fonts. A font set is essentially a snapshot of the operating system’s out-of-box configuration, and it is difficult for an ordinary user to change casually, which is why it carries high weight.

2. Canvas and WebGL Rendering Pipelines

The same drawing instructions can produce pixel-level differences depending on the GPU, driver version, and anti-aliasing implementation. Hashing the rendered result creates a canvas fingerprint. On the WebGL side, additional information can be read, including vendor and renderer strings, extension lists, maximum texture size, and precision parameters. Virtual machines and cloud hosts without a dedicated GPU often show a highly concentrated small set of hash values due to software rendering.

3. Audio Fingerprinting

By rendering a waveform containing an oscillator in an offline audio context, small but stable differences at the end of the result can appear because of differences in floating-point operations and audio-stack implementations. This method does not require microphone permission or user authorization, making it a “silently collectable” signal.

4. Cross-Checking Language, Time Zone, and Region

This is one of the easiest groups to self-check and also one of the easiest to get wrong:

const info = {
  timezone: Intl.DateTimeFormat().resolvedOptions().timeZone, // e.g., Asia/Shanghai
  offsetMinutes: -new Date().getTimezoneOffset(),            // -480
  locale: navigator.language,                                 // UI language
  acceptLang: navigator.languages?.join(','),                 // language negotiation list
  utcString: new Date().toString(),
  localeSample: new Date(0).toLocaleString('en-US'),          // formatting implementation differences
};
// Consistency check: time zone, UTC offset, and language should point to the same geographic and linguistic region.

Intl can also expose ICU data version and region-specific formatting details, such as date order, currency symbols, and number grouping. These details can be harder to fake than the time zone itself.

5. Hidden Network-Level Leaks

• UDP channel leaks: When establishing peer-to-peer candidate addresses, local network interface addresses and the public exit may be exposed at the same time, potentially bypassing the intended proxy exit.
• DNS leaks: Domain resolution may go through a local recursive resolver, meaning the resolution source and the network exit are in different regions.
• IPv6 leaks: A proxy may only handle IPv4 traffic, while IPv6 direct connections expose the real origin.
• Transport-layer fingerprints: TLS handshake cipher suite order and extension ordering, as well as HTTP/2 frame parameters and header order, create protocol-stack-level fingerprints that are difficult to forge. These fingerprints are completely invisible to browser-side JavaScript and can only be observed by the server. This also explains why changing the user agent often has no effect.

6. Client Hints and Hardware Parameters

A set of navigator properties also provides low-barrier signals: CPU logical core count, approximate device memory, screen resolution and color depth, devicePixelRatio, availability of the battery status API, number and labels of media devices, permission query result sets, touch point count, and support for specific codecs. Client Hints, also known as UA-CH, can additionally provide platform version, full version number, and architecture. If request headers and JavaScript-read values disagree, that disagreement itself becomes contradictory evidence.

3. A Minimal Design for a Self-Check Page

A practical self-check page should satisfy four constraints: pure front-end computation, raw data never leaves the browser, results are immediate, and conclusions are actionable. Architecturally, static resources can be hosted on object storage with a CDN, and the page should not send any data back. If aggregated statistics are needed, only bucketed hashes and dimension scores should be reported, not raw fingerprint values.

Several points matter when implementing the checks:

1. UDP leak detection: Provide a long-lived signaling entry point on your own server. The page can use a peer-to-peer channel to perform a handshake with it and compare the observed exit address with the exit address used by normal requests.
2. Font minimalization detection: Show the difference set between the installed fonts and the default font set for the target region, instead of simply listing all installed fonts.
3. Contradiction matrix: Map each detection result to the “expected region” and score consistency item by item, rather than scoring each item independently.
4. Actionable advice: Each failed item should directly produce an action, such as “remove eight font families that are not from the target region,” “disable the peer-to-peer channel,” or “align the system time zone with the target exit.”

4. Scoring Model: Weighted Factors, Hard Fails, and Consistency Penalties

A recommended model has three layers:

• High-weight independent items: Font set, rendering hash, transport-layer fingerprint, and time zone. Each item contributes a relatively large weight on its own.
• Consistency penalty: When time zone, language, and IP attribution are inconsistent, the score should be capped or immediately reduced to the penalty ceiling, rather than being reduced linearly.
• Hard-fail items: If there is obvious proxy residue, such as an exit address belonging to a public data-center range, a UDP channel bypassing the proxy, or IPv6 direct connection, the total score should not enter the “good” range, regardless of how clean the other dimensions are.

For repair priority, sort items by “implementation cost divided by risk-reduction benefit.” First adjust configuration items such as time zone, language, and fonts. Then adjust the network path, such as forcing all traffic through one proxy exit, using encrypted resolution, and disabling fallback channels. Only after that should rendering-layer isolation be considered.

5. General Optimization Checklist

• One configuration per environment: Use separate system users, separate configuration directories, and separate sessions and caches to avoid multiple identities sharing the same storage and font pool.
• Exit consistency: Route all traffic through the same exit. Disable proxy bypass lists and direct-connect fallback, and confirm that there is no IPv6 side path.
• Language and time zone should follow the exit region, not the local system settings.
• Font minimalization: Keep only the out-of-box font set for the target region, and remove extra Simplified Chinese, Traditional Chinese, and other East Asian font families.
• Parameter reasonableness: CPU core count, memory, resolution, and devicePixelRatio should fall within common ranges. Avoid rare combinations.
• Use fingerprint randomization carefully: Frequently switching fingerprints can create a new risk signal. A fingerprint that changes dramatically across sessions for the same account can itself look abnormal. A stable “normal” fingerprint is often better than an unstable “random” one.
• Clean up regularly: Session storage, indexed databases, caches, and font caches can accumulate cross-session linkage information.

6. Engineering Deployment and Boundaries

If you want to deploy such a detection service in the cloud, a typical approach is to place static pages and assets in object storage and connect them to a CDN. Only deploy signaling and exit-probing services on your own container platform. Use a log service to centrally collect probe failure rates and anomaly distributions, and use monitoring and alerting to set thresholds for probe timeouts, signaling failures, and missing checks. The entire pipeline does not need to retain raw fingerprint data. Only aggregated metrics are needed on the statistics side.

Finally, the boundary must be clear. The legitimate use of fingerprint self-checking is to protect yourself: identify privacy leaks, verify whether a test environment matches expectations, keep the declared region consistent with the actual environment, and help enterprise teams understand how risk control works. Using it to forge identities, bypass legitimate platform anti-fraud measures, or commit fraud violates service terms and goes beyond the scope of technical discussion. The value of understanding fingerprinting lies in knowing whether “your behavior on the network is honest and consistent,” not in learning how to tell a smoother fake story.