Fingerprints and User-Agents in BAS

A fingerprint is everything a website can learn about your browser without you logging in — and modern anti-bot systems lean on it heavily. BAS’s big advantage is that it drives a real browser with a real, coherent fingerprint, but you still have to manage that identity correctly per account.

What a fingerprint actually includes

The user-agent string is the part people know, but it’s a small piece. A full fingerprint includes:

• User-agent — browser, version, OS.
• Screen and window — resolution, color depth, device pixel ratio.
• Canvas and WebGL — how your hardware renders graphics, which varies subtly per machine.
• Fonts — the set installed on the system.
• Timezone and language — and whether they match the IP’s location.
• Hardware hints — CPU cores, memory, touch support.

Sites combine these into a near-unique ID. Changing one in isolation just creates contradictions.

Why BAS uses real fingerprints

Naive automation either leaks “I’m a bot” signals or sets a few properties that don’t agree with each other. BAS instead applies complete, internally consistent fingerprints taken from real browsers, so the dozens of values line up the way they would on a genuine device. This coherence is the whole point — detectors look for contradictions, not for any single value.

The user-agent is only one signal

Setting a fancy user-agent while leaving the rest default is worse than doing nothing: now the claimed browser disagrees with the canvas, fonts and screen. Treat the user-agent as one field inside a fingerprint, never as a standalone disguise.

One fingerprint per account, kept stable

The rule that mirrors cookies and proxies: each account gets one fingerprint and keeps it. A returning user has a stable device. If an account that always looked like a Windows/Chrome desktop suddenly looks like an Android phone, that inconsistency is a strong bot signal. Store the fingerprint with the account and reuse it every run.

Align fingerprint, proxy and timezone

The three identity layers must agree:

• A US residential proxy with a Moscow timezone and Russian language is a contradiction.
• Match timezone and locale to the proxy’s region.
• Keep the fingerprint, the cookies and the proxy bound together as one persistent identity.

Get this trio aligned and your accounts read as ordinary returning users — fewer captchas, fewer bans. With identity handled, the last core browser skill is running several of these in parallel across tabs and threads, covered next.