TLS Fingerprinting Explained: From Handshakes in TLS 1.2/1.3 to JA3, JA4, HTTP/2 Analysis and uTLS Evasion
The article opens by explaining why even carefully crafted HTTP headers often fail against modern website protections. Servers detect automated clients through TLS fingerprinting long before any application data is exchanged.
TLS handshakes expose a rich set of parameters including supported cipher suites, extension order, elliptic curve groups, and ALPN values. These values form a stable digital signature that distinguishes real browsers from scripts written in Python, Go, or curl.
Historical Evolution of TLS
The text recounts the development from Netscape SSL 1.0 through SSL 3.0 to the IETF-standardized TLS 1.0 in 1999. It describes how RSA key exchange gave way to ECC curves such as X25519 to reduce computational load on mobile devices while enabling perfect forward secrecy via ECDHE.
Examples of cipher suite strings like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 illustrate how each component specifies key exchange, authentication, encryption, and integrity algorithms.
TLS 1.2 versus TLS 1.3 Handshakes
In TLS 1.2 the full handshake requires two round trips. The Client Hello remains plaintext, revealing the full list of supported versions, ciphers, and extensions. TLS 1.3 reduces this to one round trip and encrypts the server certificate and subsequent messages, leaving only the initial Client Hello visible to passive observers.
Wireshark captures of connections to GitHub demonstrate the structure of a modern TLS 1.3 Client Hello, including the SNI extension and the list of AEAD-based cipher suites.
JA3 Fingerprinting and Its Limitations
The article details the JA3 algorithm created by Salesforce engineers in 2017. It extracts five fields, concatenates them with commas and dashes, and produces an MD5 hash. Real examples show how two consecutive page loads from the same browser generate completely different JA3 hashes because of GREASE (RFC 8701) random extensions.
This randomness renders static JA3 blacklists ineffective against sophisticated clients.
JA4+ Standard
The newer JA4 format addresses these shortcomings. It produces a human-readable string divided into three blocks: JA4_A for high-level connection properties (transport, TLS version, SNI presence, cipher and extension counts, ALPN), JA4_B for a sorted SHA-256 hash of cipher suites, and JA4_C for sorted extensions plus signature algorithms.
An example fingerprint t13d1518h2_8daaf6152771_e2d80978ab2e is dissected to show how each component remains stable despite GREASE noise.
Practical Tools and Evasion
The article concludes with guidance on using the uTLS library in Go to craft custom Client Hello messages that mimic specific browsers. It also introduces the Finch tool for capturing and filtering live traffic to analyze or replicate fingerprints.
These techniques allow security researchers and red-team operators to understand and evade detection mechanisms employed by Cloudflare, WAFs, and anti-fraud platforms.
Related articles
Centralized Secret Management: Comparing Eight Tools for DevOps and Spring Boot Applications
The article examines the challenges of managing secrets such as passwords, API tokens, and SSH keys across development, CI/CD pipelines, and production environments. It explains how centralized secret registries solve issues like scattered .env files, outdated credentials, and lack of audit trails while emphasizing that delivery mechanisms to applications must be chosen separately. Key concepts including static versus dynamic credentials, leases, rotation, and machine identities are defined to help teams implement least-privilege access. The review compares Infisical, HashiCorp Vault, OpenBao, Doppler, 1Password CLI, Bitwarden Secrets Manager, Passbolt, and Yandex Lockbox across deployment models, offline support, and integration options. Special attention is given to CLI run commands that avoid plaintext files, Spring Cloud Vault integration, and the trade-offs between SaaS convenience and self-hosted control. Practical recommendations focus on separating developer and machine access as well as development and production environments.
Opera Rolls Out Local AI Processing via WebAI Standard in Opera One Browser
Opera has introduced an early implementation of WebAI, a proposed web standard that enables websites and extensions to run AI models directly on the user's device instead of relying on remote servers. The feature debuts in Opera One and will later expand to Opera GX and Neon. Supported models include Google's Gemma as well as Apple's local foundational model on compatible Mac hardware, with no vendor lock-in. Key capabilities cover text generation, content classification, and analysis of relationships between information fragments. Developers gain the ability to add AI features without building server infrastructure or incurring per-query cloud costs, while users avoid subscriptions to external AI services. All processing occurs locally on an opt-in basis, keeping data off cloud providers, although performance depends on the device's hardware capabilities.
Russian Prosecutor's Office Withdraws Lawsuit Against Timur Turlov and Freedom Holding Corp.
The Tverskoy District Court in Moscow terminated proceedings after the Russian Prosecutor General's Office withdrew its administrative claim against Timur Turlov and several related entities. The court accepted the refusal on October 15, 2026, lifted all previously imposed asset restrictions, and ended the case without examining the merits. The original claim sought to seize hundreds of millions of dollars in assets, declare the defendants an extremist organization, and ban their activities in Russia. No reasons for the sudden withdrawal were provided during the preliminary hearing. The decision prevents the Prosecutor General's Office from refiling the same claim against the same parties on identical grounds under Russian administrative procedure rules. Freedom Holding Corp. stated it has no operations or assets in Russia and expressed surprise at the original filing. Timur Turlov, who holds Kazakh citizenship and serves as FIDE president, was listed among the defendants alongside Freedom Holding Corp., Freedom Finance Europe Ltd., and W-Empirical Holding Corp.
RWB Infra x Security Meetup Shares Recordings on GitLab Scaling, Kubernetes Bare Metal, Vault PKI and DevSecOps Platforms
On October 3 in Moscow, RWB held the Infra x Security Meetup that combined infrastructure and information security tracks. Infrastructure speakers covered scaling GitLab CE under growing load, trade-offs in developing the DCIM data center management product, building centralized PKI with Vault, and operational challenges of running Kubernetes on bare metal servers. Security speakers discussed scaling DevSecOps from pipeline scanning to an ASPM platform, vulnerability management tools that reduced remediation time, protecting data without a single perimeter using Identity × Data × Context × Policy, and automating access control across one thousand systems in under 90 seconds. All presentations were recorded and the videos plus slides are now publicly available on YouTube and VK. The event highlighted practical engineering decisions made by RWB teams while operating large-scale internal platforms.