Two Lineages of TLS Fingerprinting: JA3, JA4 and Cisco Mercury
JA4 did not descend from Cisco Mercury. The two projects come from different strands of TLS fingerprinting research and solve different operational problems.
Before JA3: How TLS Handshakes Became Fingerprints
JA3 made TLS fingerprints easy to log and share, but the technical ideas behind it had already been tested in SSL Labs experiments, a p0f patch and FingerprinTLS.
A Network Fingerprint Is a Cohort, Not a Client
TLS fingerprints group similar protocol implementations. They do not prove which application, device or person made a request.
Public Fingerprint Databases Are Not Ground Truth
We reviewed the main public fingerprint resources. The formats are open, but current application labels and auditable ground truth remain scarce.
One ClientHello, Three Fingerprints: JA3, JA4 and Mercury
A reproducible lab runs JA3, JA4 and Cisco Mercury against the same TLS ClientHello and compares what each fingerprint preserves.