Measurement study evaluates one-to-many browser fingerprint matching across mobile devices, indicating that population-scale ban-evasion detection is practically infeasible.
We report on an approximately two-week engineering and measurement effort to build a browser and device fingerprinting system, internally named Ninhydrin, intended to detect Discord ban-evasion (“alting”) by matching a rejoining account’s device fingerprint against the fingerprints of every other member or every previously banned member of a server. The system as specified requires a one-to-many (1:N) comparison at population scale: a new join is compared against N stored fingerprints, and the visitor is flagged if any single comparison clears a similarty threshold. We collected four waves of real-device ground-truth data using AWS Device Farm (up to 153 distinct physical devices across iOS and Android), built and calibrated a weighted per-field similarity scorer, integrated a third-party fingerprinting library (FingerprintJS) as an additional signal, and iteratively tuned scoring weights and decision thresholds against measured true-positive and false-positive rates.
No takes yet. Share an insight, caveat, or question.
Kelly-Aparicio Cian (2026) studied this question.