TLS Fingerprinting Explained: From Handshakes in TLS 1.2/1.3 to JA3, JA4, HTTP/2 Analysis and uTLS Evasion
The article opens by explaining why even carefully crafted HTTP headers often fail against modern website protections. Servers detect automated clients through TLS fingerprinting long before any application data is exchanged.
TLS handshakes expose a rich set of parameters including supported cipher suites, extension order, elliptic curve groups, and ALPN values. These values form a stable digital signature that distinguishes real browsers from scripts written in Python, Go, or curl.
Historical Evolution of TLS
The text recounts the development from Netscape SSL 1.0 through SSL 3.0 to the IETF-standardized TLS 1.0 in 1999. It describes how RSA key exchange gave way to ECC curves such as X25519 to reduce computational load on mobile devices while enabling perfect forward secrecy via ECDHE.
Examples of cipher suite strings like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 illustrate how each component specifies key exchange, authentication, encryption, and integrity algorithms.
TLS 1.2 versus TLS 1.3 Handshakes
In TLS 1.2 the full handshake requires two round trips. The Client Hello remains plaintext, revealing the full list of supported versions, ciphers, and extensions. TLS 1.3 reduces this to one round trip and encrypts the server certificate and subsequent messages, leaving only the initial Client Hello visible to passive observers.
Wireshark captures of connections to GitHub demonstrate the structure of a modern TLS 1.3 Client Hello, including the SNI extension and the list of AEAD-based cipher suites.
JA3 Fingerprinting and Its Limitations
The article details the JA3 algorithm created by Salesforce engineers in 2017. It extracts five fields, concatenates them with commas and dashes, and produces an MD5 hash. Real examples show how two consecutive page loads from the same browser generate completely different JA3 hashes because of GREASE (RFC 8701) random extensions.
This randomness renders static JA3 blacklists ineffective against sophisticated clients.
JA4+ Standard
The newer JA4 format addresses these shortcomings. It produces a human-readable string divided into three blocks: JA4_A for high-level connection properties (transport, TLS version, SNI presence, cipher and extension counts, ALPN), JA4_B for a sorted SHA-256 hash of cipher suites, and JA4_C for sorted extensions plus signature algorithms.
An example fingerprint t13d1518h2_8daaf6152771_e2d80978ab2e is dissected to show how each component remains stable despite GREASE noise.
Practical Tools and Evasion
The article concludes with guidance on using the uTLS library in Go to craft custom Client Hello messages that mimic specific browsers. It also introduces the Finch tool for capturing and filtering live traffic to analyze or replicate fingerprints.
These techniques allow security researchers and red-team operators to understand and evade detection mechanisms employed by Cloudflare, WAFs, and anti-fraud platforms.
Related articles
Rostelecom Refactors InfoSec Careers: Matching Employee Skills to Evolving Business Priorities
Rostelecom's information security block developed a systematic approach to reassess employee expertise and redirect talent to new roles when business structures change rapidly. In one case, an architect hired for a specific team was reassigned after the unit was disbanded, initially moving to a similar position that did not fully align with his broader competencies. HR-business partner Olga Lapshina examined the specialist's full background, including prior work in audits, methodology development, regulatory documentation, university teaching, and scientific research, plus strong mentoring abilities with younger staff. These skills matched the needs of the methodology department, leading to a transfer supported by an individual development plan and a mentor via the internal Tochka Rosta platform. Within two months the employee contributed improvements that accelerated preliminary InfoSec audits by 30 percent and risk assessments by 20 percent while expanding threat scenario coverage by 10 percent. The initiative demonstrates Rostelecom's emphasis on horizontal career movement and retention of experienced professionals through structured career tracks.
How to Avoid Becoming the Hero of 'My Program Deleted 800 GB': Safe Recursive Deletion in Bash and Python
A recent Habr article examines dangerous patterns in recursive file deletion scripts that have caused massive data loss incidents, including an 800 GB wipe triggered by Telegram Desktop on Windows. The piece analyzes classic mistakes such as empty variables in rm commands and extra spaces that turned single paths into multiple destructive arguments, referencing the 2015 Steam Linux bug and the 2011 Bumblebee installer error. It provides hardened Bash templates using set -euo pipefail, ${VAR:?} checks, realpath validation, and --one-file-system flags to prevent deletion of forbidden directories or symlinked targets. The Python section introduces a safe_rmtree wrapper that enforces root boundaries, rejects symlinks, uses resolve(strict=True), and checks shutil.rmtree.avoids_symlink_attacks before proceeding. Additional recommendations include dry-run modes, marker files, temporary directory usage, and logging to make deletion operations auditable and reversible where possible.
Hackers tamper with refrigeration units in European supermarkets, setting temperatures to +50 °C
Attackers gained unauthorized access to refrigeration and freezer control systems in supermarkets across several European countries, including Sweden, Belgium, Luxembourg, and Estonia. In multiple locations they altered temperature settings to +50 °C, risking widespread spoilage of perishable goods. The incidents primarily affected older, unpatched Danfoss controllers that had been connected to networks for remote maintenance. Estonian manufacturer Kitman Coldtech reported that one attack on a legacy Danfoss system was detected and stopped within approximately ten minutes, preventing any damage. Similar intrusions were confirmed by Swedish chains ICA and Coop, following earlier incidents in French supermarkets in October that resulted in product losses. Experts note that legacy industrial controllers remain attractive targets because they are often left exposed once placed online for convenience.
AmneziaWG Container for MikroTik Routers Delivers Top Performance Six Months After Launch
A developer released an AmneziaWG container for MikroTik devices in February 2026 and has since added major improvements in speed, protocol support, and stability. The lightweight container leverages the router's native WireGuard implementation for cryptography while handling AmneziaWG obfuscation in software. Performance now reaches 250-350 Mbit/s on models such as Hap Ax3 and RB5009B after switching to C code and increasing buffer sizes with RouterOS 7.24. New features include server mode for connecting multiple MikroTik devices, random port hopping, IPv6 support, dynamic DNS, and offline configuration. The project survived an early GitHub ban caused by test scripts and has grown to over 370 stars while remaining fully offline and privacy-focused.