Logic Inconsistencies, Hardware Mismatches, and Leaks in Generated Fingerprints (Detailed QA Analysis)

[atahan150]

Hi team,

I have been extensively testing the fingerprint-generator / fingerprint-suite with a large set of generated profiles across Windows, macOS, Android, and iOS. While the tool is highly effective, I've identified several logical inconsistencies and "impossible" hardware combinations that significantly increase the detectability of the generated fingerprints by advanced anti-bot systems (e.g., Datadome, Cloudflare, Akamai).

Here is a detailed breakdown of the issues found during the analysis of over 50+ generated profiles:

1. Hardware & Architecture Mismatches (Frankenstein Devices)

The generator frequently creates device profiles where the hardware components contradict each other, the OS architecture, or the device model.

• Apple Silicon vs x86 Conflict: Generated macOS profiles sometimes report architecture: "x86" in userAgentData while simultaneously reporting renderer: "Apple M4" (or M1/M2/M3) in WebGL. Apple Silicon chips are ARM64 architecture, never x86.
• CPU/GPU Bottlenecks on PC: High-end GPUs (e.g., NVIDIA RTX 3070, AMD RX 6800) are sometimes paired with extremely low hardwareConcurrency (e.g., 2 cores) or low RAM (e.g., 2GB/4GB). This combination is statistically impossible for modern hardware.
• Mobile Hardware Conflicts:
  • Model vs GPU: Some profiles assign a Mali GPU to device models that strictly use Snapdragon processors (e.g., Samsung Galaxy S-Series US versions which use Adreno).
  • RAM vs GPU: Entry-level GPUs (e.g., Mali-G57) are sometimes paired with high-end RAM amounts (e.g., 16GB), which is not a realistic configuration.

2. iOS / Safari Leaks (Critical Detectability Issue)

The generation logic for iOS seems to leak Chromium/Engine traits into what should be pure Safari profiles.

• UserAgentData on Safari: The generator often injects a navigator.userAgentData object into iOS profiles. Real WebKit (Mobile Safari) does not support Client Hints / userAgentData. It should be undefined.
• Chrome Plugins in Safari: Some generated iPhone profiles list Chrome PDF Viewer or Chromium PDF Viewer in the navigator.plugins array. Real Mobile Safari has an empty plugins list ([]).
• Header Leaks: sec-ch-ua headers are sometimes sent with iPhone profiles, which is a clear signal of a non-Safari browser.

3. Android Platform Typo

In some Linux/Android profiles, the platform architecture is returned as Linux armv81 (ending with the number one).

• Current: Linux armv81
• Expected: Linux armv8l (ending with the letter 'l' for little-endian).

4. Screen Geometry & "Impossible" Resolutions

• Window Dimensions: On Windows and macOS, the screen.availHeight is sometimes equal to screen.height. In a realistic non-fullscreen scenario, there should be a calculated gap for the Windows Taskbar (~40px) or macOS Menu Bar (~25-30px).
• Ancient Mobile Resolutions: Occasionally, the generator produces fallback resolutions like 320x480 for modern Android versions (e.g., Android 15), which triggers emulator detection mechanisms.

5. Version Logic

• Future Versions: The generator sometimes produces platformVersion or Browser Versions (e.g., Safari 26.0) that are projected far into the future.
• OS Mismatch: Windows profiles sometimes report platformVersion: "19.0.0", whereas the correct Client Hint versions for Windows 10/11 are usually "10.0.0" or "15.0.0".

---

Suggestion:

Implementing a stricter "Consistency Layer" or a "Dictionary Mapping" system where the GPU, Cores, RAM, and Screen specs are tied to specific Device Models (or tiers) would greatly improve the trust score of the generated fingerprints.

Thank you for your hard work on this project.

[barjin]

Hello, and thank you for your interest in this project! I'll convert this into a discussion, as I believe some of the claims are not right (but I'd like to discuss this further)! Can you please share the sources of your claims?

The data in fingerprint- and header- generators is calculated from fingerprints collected from actual devices seen on the web. The possibility that the fingerprints are inconsistent is slim (but never zero for sure).

See some sources regarding a few of the points:

3. Android Platform typo

This is not true, see https://www.chromium.org/updates/ua-reduction/#reduced-navigatorplatform-values-for-all-versions

5. Version logic

The Windows platformVersion value depends on OS internals. See more details here (check the table at the end of the page).

Safari 26 is out.