navigator.webdriver

A fingerprint is an argument assembled from many answers. This one is not an argument at all, because the browser is replying to a direct question about itself.

• The reading costs a site nothing

  One property, no permission prompt, and an answer before the page has finished loading.

• It is not a matter of rarity

  Other readings say how unusual you are. This one says whether a person is at the keyboard.

• It never travels alone

  A build running without a window names itself in the string it reports and often carries an empty plugin list, so all three are read together.

These values are read in your browser on this page and nothing leaves it. The first row is what a bot check asks for before anything else.

The browser raises it by itself whenever a control channel it recognises is open. Page code neither sets it nor takes it back down.

1. 1

   A driver attaches

   The familiar case: a testing framework takes the browser over, and the browser says so.

2. 2

   A debugging port is opened

   The open port alone is enough, even before any program has attached to it.

3. 3

   A window-less build starts

   A build started without a window renames the browser in the string it reports, in the newer mode too.

Automation here runs over a channel bound to your own machine, and that is how a flow and the window synchronizer drive a profile. The launch line carries a switch that keeps the automation reading down while that channel is open.

On the acceptance run of the build shipping today the value came back negative, and the property behind it still read as part of the browser rather than as page code.

• The value is read from a real page

  The stand starts the engine with the arguments the app uses and asks the page, instead of trusting the launch line.

  false

• The property still reads as the browser's own

  The self-test prints the source behind the value, and page code cannot produce that source.

  native code

• The reported name carries no mark

  The string the browser uses for itself names no window-less build.

  no mark

The value can be overwritten from page code, and the overwrite leaves traces. The property stops reading as the browser's own, and the same question asked inside a frame or a background thread comes back untouched.

• The source gives it away

  Print the property behind the value: a hand-written one shows its own code where a browser shows none.

• Other realms get asked

  A frame and a background thread carry their own copy of the browser interface, and a page may ask either of them.

• Removal is worse than answering

  A browser missing the property entirely is rarer than one that answers, so deleting it draws the attention it was meant to avoid.

The panel above answers for the browser you are reading this in. Inside the app the self-test runs in a profile, against the engine that profile launched.

It asks for the value and for the source of the property behind it, in the page the profile opened. A frame and a background thread are asked separately, and what is compared there is the machine the profile claims.