Fingerprintability

[MasterInQuestion]

[ Mohammad M (Free Iran) @ CE 2024-03-31 23:36:06 UTC:
https://remark42.browserleaks.com/web/iframe.html?site_id=browserleaks&url=https://browserleaks.com/http2#remark42__comment-54bc1852-4497-4903-a63e-4c75a5438fad
    Can someone please help me with this?

    I've been trying to spoof TLS and HTTP 2 fingerprint.
    However someone from a company who is doing anti-detect solution says:
    “You shouldn't: as it's constant for a browser, or I guess it's constant for a certain version of a browser.
    And it's independent from the client machine.”
    I need to ensure that using multi-account on a web site undetected.

    Can a company identify a client uniquely using Akamai fingerprint?
    Or does it represent a browser brand and version only?

    If I have different realistic fingerprint (using collected real fingerprints) of other factors (WebGL, ClientRect, fonts, ...) for each of my accounts:
    Will they be able to see 2 of my accounts belong to same person based on Akamai fingerprint?

    Thanks. ]

----

    First off:
    |*| Akamai is derived from HTTP 2 characteristics
    |*| JA3 is of TLS
    ; these are not web technologies selves. ("auditing" technologies, perhaps)

    It's not constant, but tends to vary unpredictably:
    Browser vendors may introduce, inadvertently or not, unpredictable changes on them: as long as no visible breakage observed.

    Access pattern related side-channels is the culprit: some are incorrigible technically. (mostly user fault)

    Extreme invert. Excess amok.
    Too much unpredictability becomes predictability.

[Mohsentrade741]

    Thank you so much for the reply!
    For my accounts, JA3 are different (apparently Chrome changing it randomly) though JA3n are same (normalized JA3 which seems to be same for each Chrome kernel).
    My concern is that Akamai is same for all accounts, not sure if that shows all accounts are from same user or not.
    Can the site owner consider them as same user?

[MasterInQuestion]

    Fingerprinting based on HTTP 2, TLS characteristics alone cannot be reliable:
    For aforementioned reasons.

    Chrome maybe doing the no-op:
    https://security.stackexchange.com/questions/273101/why-the-ja3-hash-changed-everytime-refresh-the-webpage