HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
salesforce
ja3
Python2017–2023
salesforce / ja3 · Archived

ja3

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

Explore on GitHubRead Hacker News discussions
15Distinct people
15Mentions
0Explicit recommenders
3.1KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year15 dated mentions

Observed mentions: 2017-07-26 14:59:55 UTC to 2023-06-30 13:08:42 UTC.

012342017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 4 mentions; 3 submissions, 1 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2023

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC110
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC321
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC303
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC431
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC303

What Hacker News says

15 sources
maldev·Jun 30, 2023
This paper is nice, but it goes over some finer technical things. So, not about the great wall, but there's projects out there, like this one https://github.com/salesforce/ja3 , which talk about how you can fingerprint fully encrypted traffic(TLS/HTPS). There's a great section in the Readme "How it works" that goes over it. Would be surprising if the great wall doesn't do this, when some open source firewall will.
In How the great firewall of China detects and blocks fully encrypted traffic [pdf]
komuW·Jan 15, 2023
From the circleCI blogpost[1]: "Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location" I haven't seen much discussion on how this specific attacker entrypoint can be mitigated. So I'm going to make a naive attempt in this comment. How about storing the client's IP address in the session cookie. Then whenever the server recieves the cookie, it compares the client's IP address against the one stored in the session cookie. The server denies the login if there's a mismatch. The cookie would of-course have to be signed(hmac etc) so that it is tamper proof. One problem with this is that client IP addresses are easily spoofed[2]. So, instead of storing the client's IP address; how about we instead store the clients' SSL fingerprints[3][4]. I
Read the rest
haven't looked much into the literature, but I think those fingerprints are hard to spoof. 1. https://circleci.com/blog/jan-4-2023-incident-report/ 2. https://adam-p.ca/blog/2022/03/x-forwarded-for/ 3. https://github.com/salesforce/hassh 4. https://github.com/salesforce/ja3
In CircleCI says hackers stole encryption keys and customers’ source code
reset-password·Jan 7, 2023
They may be referring to JA3 [0] which can be used to fingerprint the connection by examining the order of the ciphers sent by client to server during the TLS handshake. It isn't useful to detect that the user is browsing on an iphone, but rather that the useragent says the user is using an iphone but the JA3 gives it away as something else. It can be defeated by the client sending a specific list of ciphers in a specific order during the TLS handshake but in practice this can be difficult to do as it's typically implemented at a low level. Alternatively, creating a browser extension can also be used to defeat it as the request is running through the browser's code in that case. [0] https://github.com/salesforce/ja3
In Devirtualizing nike.com's bot protection
zamubafoo·Oct 18, 2022
It's sufficient to identify you since there is still all other tracking data any browser supplies as part of the HTTPs connection handshake [1]. It's also not necessary to have Mozilla be the bad actor. Anyone who has access to the information in the future is a possible bad actor as they might be able to cross-reference the allegedly "innocuous" information with some future, more-pervasive data. --- [1] - https://github.com/salesforce/ja3
In Firefox Private Browsing mode upgrade
pimterry·Dec 8, 2021
There's one fingerprint per TLS session. It's clearer with a worked example. Let's say you send a client hello like this: TLS: 1 Ciphers: A, B, C Extensions: ExtensionX: ... ExtensionY: ... ExtensionZ: ... That gets converted into a string like "1-A,B,C-X,Y,Z", and then hashed with MD5 to get a value like "41b2054b6a0a7549fa963b232226f6ae". For every single server you talk to, those values will be the same, we'll get the same fingerprint, and so this distinctively identifies TLS connections made by this client. Another client might instead send: TLS: 1 Ciphers: C, B, A Extensions: ExtensionX: ... ExtensionY: ... ExtensionZ: ... That becomes a string like "1-C,B,A-X,Y,Z", which gets hashed to a fingerprint like "ae76e4566b036882147de2f7feddad4a". That gives us a totally differe
Read the rest
nt unique id, with the same ciphers but in a different order. (This is pseudocode of course - the actual fingerprints have a few more params and use the number ids for each cipher and extension instead of strings, but it's equivalent) Here, with 3 ciphers in two different orders, we've seen two different fingerprints already. With those three ciphers alone, there's actually 6 (3 factorial) possible permutations - i.e. a client could order those ciphers any one of 6 different ways, and each ordering has a different fingerprint. If you have 4 ciphers, there's 24 possible orderings, 6 gives 720, 10 gives 3.6 million, and this goes up very rapidly, so that for a more realistic set of 20 ciphers there's 2 * 10^18 possible orderings, each one of which gives a unique fingerprint, even before we start talking about extension order. Does that make more sense? The full algorithm is here: https://github.com/salesforce/ja3#how-it-works
In Fighting TLS Fingerprinting with Node.js
yabones·Apr 14, 2021
Fingerprinting something like this would be trivial, they've probably already done it. Using the ja3 library [1] you can make pretty good deterministic TLS connection fingerprints, and that works fine for traffic that you can't decrypt. IDS/IPS software has used similar methods to identify and block encrypted traffic for some time now. [1] https://github.com/salesforce/ja3
In Download the FCC Speed Test App
bsamuels·Nov 1, 2018
Unfortunately I don't have much reading material to provide. It's a bit of an arms war, so the latest and greatest countermeasures are typically kept secret/protected by NDA. The rabbit hole can go very deep and can differ from company to company. The most drastic example I can think of was an unverified rumor that a certain company would "fake" log users in when presented with valid credentials from a client they considered suspicious. They would then monitor what the client did - from the client's point of view it successfully logged in and would begin normal operation. If server observed the device was acting "correctly" with the fake login token, they would fully log it in. If the client deviated from expected behavior, it would present false data to the client & ban the client based on a bunch of fancy fingerprinting. Every once in a
Read the rest
while, someone will publish their methods/software; Salesforce and their SSL fingerprinting software comes to mind: https://github.com/salesforce/ja3
In JavaScript is now required to sign in to Google

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.