Public Fingerprint Databases Are Not Ground Truth
We reviewed the main public fingerprint resources. The formats are open, but current application labels and auditable ground truth remain scarce.
A Network Fingerprint Is a Cohort, Not a Client
TLS fingerprints group similar protocol implementations. They do not prove which application, device or person made a request.
Two Lineages of TLS Fingerprinting: JA3, JA4 and Cisco Mercury
JA4 did not descend from Cisco Mercury. The two projects come from different strands of TLS fingerprinting research and solve different operational problems.
Before JA3: How TLS Handshakes Became Fingerprints
JA3 made TLS fingerprints easy to log and share, but the technical ideas behind it had already been tested in SSL Labs experiments, a p0f patch and FingerprinTLS.
One ClientHello, Three Fingerprints: JA3, JA4 and Mercury
A reproducible lab runs JA3, JA4 and Cisco Mercury against the same TLS ClientHello and compares what each fingerprint preserves.