Collecting Fingerprints on different devices

[sankaet]

Recently developers have asked us for suggestions about collecting fingerprints across devices (web, iOS & android). Here are some ideas:

Web Browsers

To collect fingerprints on the web, our suggestion is to use Valve's Fingerprint.js2.

Just import the JS file and do the following

new Fingerprint2().get(function(result){
  // this will use all available fingerprinting sources
  console.log('This is the fingerprint '+result);
});

iOS

For iOS we suggest using UIDevice currentDevice method. Its pretty straightforward. Here is an example

#pragma mark - get device ID
- (NSString *)deviceID{
    return [NSString stringWithFormat:@"%@-AAPL",[UIDevice currentDevice].identifierForVendor.UUIDString];
}

Android

For android we suggest using a logic like the following

public static String getDeviceID(Context activity) {
        String androidID = Settings.Secure.getString(activity.getContentResolver(),Settings.Secure.ANDROID_ID);
        StringBuilder stringBuilder = new StringBuilder();
        stringBuilder.append(Build.MANUFACTURER.toUpperCase()+"-");
        stringBuilder.append(Build.MODEL+"-");
        stringBuilder.append(androidID);
        stringBuilder.append("-GOOG");
        androidID = stringBuilder.toString();
        return androidID;
    }

Thats it. Please let us know if you have any questions.

[loren]

Does the web fingerprint change when the browser is updated to a new version?

[sankaet]

@loren Yes it does, so either you will have to do 2FA flow when fingerprint changes or store it in your DB.

Another alternative might be what we say here

If you are using synapsepay.min.js in background, no need to fingerprint the user device. Just pass along a fingerprint that you wish to. A good way to do so is pass hashed version of your client_id+client_secret. That way the value is still kind of secret, but you won't need to store this per user. You will be able to build fingerprints on the fly.

[loren]

If the purpose of the fingerprint is to prompt 2FA to prevent an attack from coming from a different browser/device, and if you're not worried about attackers who have access to the user's browser, then it seems like a good alternative "fingerprint" would be generating a random string and storing it in the browser's localStorage (which is only cleared on user request, which is rare)?

[sankaet]

@loren Fingerprint servers two purposes:

1) Prevents unauthorized access: The idea is even if the username/password (or refresh token) is compromised, they will still need the device to be able to access the account or else do 2FA flow to prove that its you signing in again.

2) Detect historically bad actors quickly: Detecting risky customers with bad existing history. This has been pretty interesting approach as well.

As a developer you can choose if you want us to handle the 2FA for you or not. If you do not want us to do 2FA, we ask you to add synapsepay.min.js in your application. This lets us still get the detailed user fingerprint & we can do the latter really well.

For unauthorized access, we still use detailed fingerprint collected by synapsepay.min.js to statistically predict if the access is authorized or unauthorized.

To answer the second portion of your question: using a random value is okay but derived values are more meaningful and always better. We are Crypto people, so we like derived values usually.

[notunderground]

Where is synapsepay.min.js ? can you add to https://github.com/SynapseFI ?