July 2023 Summaries

Fingerprint has expanded its Smart Signals feature to enhance its ability to detect fraudulent activities in mobile applications and improve data intelligence for its users. The update includes six new Smart Signals that focus on mobile identification, user behavior, and bot detection, applicable to both iOS and Android platforms. Key features include cloned app detection for Android, factory reset detection for both iOS and Android, and jailbroken device detection for iOS. The Frida detection feature identifies tampering with apps, while privacy-focused settings signal the use of privacy-centric browsers like Tor. Additionally, virtual machine detection helps identify requests from automated traffic sources or individuals using virtual machines, which are often employed in fraud schemes. These enhancements are designed to provide Fingerprint users with more effective tools to combat mobile fraud, available to those with Fingerprint Pro Plus plans and above.

On July 26, 2023, FingerprintJS transitioned its licensing from MIT to Business Source License (BSL 1.1) to support fair usage and sustainability while continuing to offer the source code for non-commercial purposes. This change requires businesses using FingerprintJS in production to obtain a commercial license or migrate to the Fingerprint device intelligence platform, aiming to curb the use of the software in production without compensation. Version 4.0.0 of FingerprintJS introduces new features, such as Apple Pay support detection and compatibility with Safari 17, enhancing identification accuracy. The license shift seeks to protect the open-source community, encourage commercial partnerships, and maintain the availability of FingerprintJS for personal and exploratory use.

Constant online exposure subjects businesses to numerous cybersecurity threats, including online fraud, which can damage a company's reputation and incur financial losses. IP blocklist matching is a security measure that identifies potential fraudsters by comparing visitor IP addresses to a list of known fraudulent IP addresses, thereby preventing unauthorized access and malicious activities. This method is dynamic, frequently updated, and considers factors such as geolocation, historical data, and behavioral patterns to enhance accuracy. However, challenges such as false positives, dynamic IP addresses, and the use of VPNs by fraudsters can complicate its effectiveness, along with the effort required to maintain and update blocklists. Despite these challenges, IP blocklist matching remains a valuable tool in fraud prevention, and solutions like device intelligence platforms can enhance its accuracy by analyzing device attributes and behaviors to create unique digital identifiers, thereby improving fraud detection and prevention.

Fingerprint, a leader in device identification technology, has partnered with Dodgeball to enhance fraud prevention and improve user experiences for fintech, eCommerce, and Web3 companies. This collaboration integrates Fingerprint's advanced device identification technology into Dodgeball’s fraud journey orchestration platform, allowing for precise detection of devices and browsers, even under incognito modes or VPNs. This integration empowers companies to identify fraudulent activities in real time, streamline decision-making processes, and maintain robust security across digital platforms without disrupting product development timelines. Fingerprint's technology, which complies with major data security standards like ISO 27001 and GDPR, is trusted by thousands of companies globally. Together, Fingerprint and Dodgeball provide a comprehensive solution that spans the entire customer journey, from account creation to payment, ensuring both fraud prevention and enhanced user experiences.

An exploration into privacy vulnerabilities in Apple devices reveals a technique for disclosing a macOS user's first name without permissions using the multicast DNS (mDNS) protocol, a component of Apple's Bonjour feature. This method leverages a brute-force approach with a list of common names and locales to guess the user's name, achieving a 65% success rate. Despite the limitations and impracticality of this attack, which can be detected via browser developer tools, it underscores potential privacy risks associated with device name exposure over local networks. The article advocates for open discussions to prompt quick fixes by browser providers, and while the method is primarily discussed in the context of Apple devices, it could be adapted for use in discovering various IoT devices on local networks.

Fingerprint has announced a new integration with Microsoft Azure, enhancing the identification accuracy and privacy of user data, especially in browsers with strict privacy settings like Safari and Firefox. The integration with Azure, a robust cloud computing platform, offers businesses improved control and visibility over their user identification processes by routing requests through Azure's infrastructure, which helps meet compliance and auditing requirements. This integration prevents ad blockers from obstructing Fingerprint JS agents and extends the lifespan of cookies by treating them as first-party, thereby enhancing user identification accuracy and data retention. Key components of this integration include Azure functions for proxying requests, Azure Front Door for efficient content delivery, and Azure storage accounts for managing function source code. The setup process involves deploying Azure functions, configuring Front Door distribution, and customizing the Fingerprint JS agent, with comprehensive documentation and support available to ensure a smooth experience. The integration is accessible via GitHub, offering transparency and industry best practices for developers.