[Discussion] Browser Fingerprinting

[reallytiredofclowns]

Does anyone have any expertise with fingerprinting? Related to the suggestion with IP banning, I know Reddit does implement some sort of procedure to help detect ban evasion. This might help with the recurring !@#$-disturber on Discuit.

Here is an overview article of fingerprinting that I found fairly comprehensible, as someone completely new to the idea.

[Codycody31]

This could be possible. Though I believe it would case of once we block a user the fingerprint is added to a list that is blocked. A main issue with implementing this though would be privacy as we would need to store the fingerprint anyways to tie it back to a specific user/person.

Something like this maybe (just a same demo idea)

// getIP extracts the IP address of the client from the request
func getIP(r *http.Request) string {
    // Standard proxy forwarding header
    forwarded := r.Header.Get("X-Forwarded-For")
    if forwarded != "" {
        return strings.Split(forwarded, ",")[0] // return the first IP if multiple are present
    }
    return strings.Split(r.RemoteAddr, ":")[0] // fallback to direct connection IP
}

// browserFingerprint generates a unique identifier for a user based on their browser details
func browserFingerprint(r *http.Request) string {
    userAgent := r.UserAgent()
    acceptLang := r.Header.Get("Accept-Language")
    encoding := r.Header.Get("Accept-Encoding")
    ip := getIP(r)

    // Combine the collected details to form a unique identifier
    rawIdentifier := fmt.Sprintf("%s|%s|%s|%s", userAgent, acceptLang, encoding, ip)

    // Hash the combined string using SHA-256 for a consistent, anonymized identifier
    hasher := sha256.New()
    hasher.Write([]byte(rawIdentifier))
    hashedIdentifier := hex.EncodeToString(hasher.Sum(nil))

    return hashedIdentifier
}

[reallytiredofclowns]

I don't think having the IP address as a part of the hash is helpful in this particular case, as the user in question is apparently hopping IPs like crazy. But the general idea is interesting.

[Codycody31]

Ah, then that tends to make it harder. Either way, they could just spoof a new browser which is pretty easy