What's new

WhiskerJS has three version numbers in every result:

• version: the library release (0.1.0, not yet published).
• signalsVersion: what is measured: the collectors, the integrity checks and the exclusion table. A bump can change ids (when a stable component changes) and flags.
• idVersion: how the visitorId and structuredId are derived. A bump changes every id.

Compare ids only within the same signalsVersion and idVersion.

0.1.0 (in development, not published)

Newest first. The live demo runs the current version.

signalsVersion 5, idVersion 2 (current, main 1100e48)

• Fixed a false positive in the Firefox resistFingerprinting class: stock Firefox under automation such as Playwright (UTC time zone, screen equal to the viewport) was classed firefox_rfp and lost nine components. The class now needs every trait at once (an RFP time zone, now also Atlantic/Reykjavik; screen equal to the content area; no taskbar space; pixel ratio 1; window at 0,0) and never applies when navigator.webdriver is true.
• Id effect: only for Firefox browsers that were wrongly classed before; their browser_class and excluded components change.

Opt-in result hook (no version change)

• load({ onResult }): off by default; called with a copy of every result. The library still sends nothing itself.

idVersion 2 (with signalsVersion 4)

• New structuredId: the idVersion and one 48-bit part per signal group (gpu, audio, fonts, device, browser, locale, prefs), so two results can be compared group by group. New exports ID_GROUPS, ID_GROUP_ORDER, ID_PART_LENGTH.
• New anti-replay binding: collect({ binding: { nonce, timestamp } }) echoes them in result.binding with a digest over the whole result; bindingInput() gives the exact text. Not a signature.
• The visitorId prefix line is now whiskerjs/id/2. Id effect: every visitorId changes.

signalsVersion 4

• Seven new integrity flags: engine_mismatch, iframe_mismatch, impossible_hardware, permissions_inconsistent, plugins_inconsistent, prototype_lie, webdriver_writable (14 in total). A clean about:blank iframe realm is used for the cross-checks.
• automation_globals knows more tools (CEF, CefSharp, Awesomium, FMiner, Geb, Phantomas, WebdriverIO and older drivers).
• Id effect: none (no collector changed).

signalsVersion 3

• Six new components (46 in total): webgpu, fonts_canvas and font_preferences (in the visitorId), and canvas_readback, audio_latency, content_blockers (not in the visitorId).
• fonts_canvas added to the Brave exclusions.
• Id effect: the three new stable components change nearly every visitorId.

signalsVersion 2

• Ten new components (40 in total): ua_client_hints, cpu_architecture, intl_locale, heap_limit, apple_pay, private_click (in the visitorId), and ua_versions, permissions, keyboard_layout, screen_frame (not in the visitorId).
• screen_frame added to the Firefox resistFingerprinting exclusions.
• Id effect: the six new stable components change nearly every visitorId.

signalsVersion 1, idVersion 1 (first collector)

• load() and agent.collect(), which never throw; a 1000 ms inner timeout per component, an overall budget (default 5000 ms) and abort support.
• 30 components: audio, browser_class, canvas, color_depth, color_gamut, device_memory, dynamic_range, fonts, forced_colors, hardware_concurrency, languages, math, media_codecs, pdf_viewer, pixel_ratio, platform, plugins, prefers_contrast, reduced_motion, screen_resolution, speech_voices, storage, time_zone, touch_support, vendor, vendor_flavors, webgl_image, webgl_params, webgl_renderer, webgl_vendor.
• Seven integrity flags: automation_globals, automation_webdriver, headless_markers, headless_user_agent, native_tampering, navigator_own_property, software_renderer.
• Large values reported only as the first 128 bits of SHA-256.
• visitorId over the stable components with the prefix whiskerjs/id/1.
• Exclusion table for Brave farbling and Firefox resistFingerprinting.