How the fingerprint works

Any page can ask the browser about the machine it runs on. The answers, taken together, are the fingerprint:

• The browser and the system: the User-Agent, the platform, the browser version.
• Where you are: languages, time zone.
• The device: screen size and pixel ratio, color depth, processor cores, memory, touch support.
• How it draws and sounds: Canvas, WebGL with the name of the graphics card, audio, the list of fonts.
• The network: the IP address, and what WebRTC and DNS reveal about the route.

Two browsers with the same answers look like one device; one browser whose answers contradict each other looks like a disguise. Liminal works on both sides of that: different profiles answer differently, and each profile’s answers add up.

When a profile is created, Liminal generates a whole fingerprint for it — a desktop Windows, macOS or Linux machine, as its template asks. There is nothing to configure first, and this works on every plan.

The fingerprint is saved with the profile. The profile reports the same device tomorrow as today, so a site sees a returning visitor, not a new machine at every visit. It changes only when you change it.

A fingerprint is checked and corrected every time it is generated and every time it is saved, by the same rules. You cannot save one that contradicts itself — the app fixes it:

A profile that says “Berlin” by its time zone and comes from an address in Texas contradicts itself. So by default a profile takes its location from its connection: each time it opens with a proxy or VPN, the language, time zone and country are set from the checked location of that connection — before the first page loads.

The switch is Match Connection Location in the fingerprint sheet. Turn it off to set the language and time zone by hand.

If a profile’s fingerprint cannot be applied, the profile does not open. And while a profile runs, a page is not loaded until the browser confirms that this exact fingerprint is in place; if it cannot, the page is blocked rather than loaded with the values of your real machine.

A profile does not have to report the system it runs on: a Mac can run a profile that says Windows, and the other way round. For those two systems Liminal gives the profile the fonts of the one it claims, not the ones installed on your machine; a Linux profile has no such set of fonts.

It is fair to say where this ends. What your real graphics hardware draws cannot be made identical to what another system would draw. A profile that reports the system you actually run has fewer such differences to explain.

• No fingerprint makes an account safe by itself. A site also judges behavior, the reputation of the IP address and the history of the account. Liminal does not promise that an account is never flagged.
• Noise is visible as noise. Canvas and Client Rects protection add small random differences, and a site can notice that they are there. That is why both are off in a new profile.
• WebGL protection changes names, not numbers. The vendor and renderer are replaced; the numeric capabilities of your graphics card are not. Every protected profile of one system names the same graphics card.
• Internal pages are not covered. The fingerprint is applied to websites, not to the browser’s own pages and the pages of extensions.

Generated fingerprints, consistency and following the connection are the same on every plan. Editing the fields by hand is part of Pro and Team — see Fingerprint settings.