-
-
Notifications
You must be signed in to change notification settings - Fork 252
Description
TLS client version
latest
System information
windows ryzen 5 5600
Issue description
I am specifically trying to replicate Firefox on Windows. On Windows, Firefox’s network stack has a very distinct fingerprint. The automatic injection of SETTINGS_MAX_FIELD_SECTION_SIZE (ID: 6) with a hardcoded value of 262144 is inconsistent with how the Firefox/Windows client behaves in a real-world environment.
Many modern WAFs (Web Application Firewalls) compare the H3 SETTINGS sequence against the User-Agent and TLS JA4 fingerprints. Since the library forces this extra setting, it creates a mismatch that results in immediate fingerprinting (detection) by security services like Cloudflare or Akamai.
Steps to reproduce / Code Sample
with tls client - firefox147 profile:
"h3_hash": "d0b2cb200c4f80fd14d5d8bac620dc00",
"h3_text": "1:65536;7:20;727725890:0;16765559:1;51:1;8:1;6:262144|GREASE|m,s,a,p",
with my firefox browser:
"h3_hash": "d50d4e585c22bb92b6c86b592aa2d586",
"h3_text": "1:65536;7:20;727725890:0;16765559:1;51:1;8:1|GREASE|m,s,a,p",
tested on https://quic.browserleaks.com/