How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.
I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.
How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.
It doesn't actually work for that
I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.
If it didn't, why do you think every captcha solution uses it? It doesn't have to be 100% effective to be useful.