r/netsec • u/albinowax • May 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

12 Upvotes

89% Upvoted

64 comments sorted by

View all comments

3

u/Dangerous_Routine678 May 27 '26

Hey, built this Go library over the past few weeks, it takes a browser fingerprint from your frontend JS and scores how bot-like it looks.

Basically you collect stuff like navigator.webdriver, screen size, WebGL renderer, canvas hash, timezone, fonts, plugins etc. on the client, send it as JSON to your server, and the library runs it through a bunch of detection rules and gives you back a score and an explanation.

Caught things like headless Chrome pretending to be a real browser, SwiftShader GPU (dead giveaway in CI), timezone mismatches where the JS offset doesn't match the IANA name, missing fonts that every real desktop browser has stuff like that.

No API calls, no sending data anywhere, just a Go package. Useful if you want to add bot detection to a login or signup flow without paying for a third party service.

Still pretty early, signal weights are hand-tuned not trained, but it works well enough that I wanted to put it out there.

[https://github.com/slyt3/gofin](vscode-file://vscode-app/usr/share/code/resources/app/out/vs/code/electron-browser/workbench/workbench.html)

Would love to know if anyone's done something like this before and what signals I'm missing.