PWA

1. What is PWA in Browser Fingerprinting

Progressive Web Apps (PWA) are web applications that utilize modern web capabilities to deliver an app-like experience to users. While the PWA specification itself is designed for usability and offline access, it also introduces an array of browser-based signals that can be used in fingerprinting.

PWA-related fingerprint indicators may include:

• Whether the site is running in standalone mode (matchMedia('(display-mode: standalone)').matches)
• Supported service worker and caching behaviors
• App manifest data (/manifest.json)
• PWA installation status and access to app-specific APIs like:
  • navigator.setAppBadge()
  • navigator.getInstalledRelatedApps()
  • Application install banners and prompts
• Offline behavior and cache consistency (e.g., localStorage, IndexedDB)

While often overlooked, the presence or absence of certain PWA behaviors along with installation indicators can uniquely identify a user session or browser instance. More advanced platforms now use PWA fingerprinting to detect session spoofing in multi-account environments.

2. How Platforms Detect PWA Fingerprints

PWA fingerprinting techniques are primarily based on web app capabilities and how the browser interacts with installation prompts and service workers. Some key detection methods include:

1. Display Mode Detection: By reading window.matchMedia('(display-mode: standalone)').matches, tracking scripts can infer how a user is interacting with the app — which may vary between installations.
2. App Badge & Notifications APIs: Testing access to navigator.setAppBadge() or push notifications is a signal of whether the app is installed and active.
3. Manifest Access and Caching: Platforms can control if a PWA is properly caching assets, loading from a manifest, or behaving like an installed app.
4. Installation Banners and Prompts: Monitoring whether installation prompts are being suppressed, dismissed, or accepted can reveal automation and spoofing footprints.
5. Service Worker Lifecycle: Detection services can evaluate service worker registration timestamps, update behavior, and message handling to infer abnormal browser usage patterns.

On environments where multiple accounts must be kept operationally discreet, these signals must be isolated per browser instance. Otherwise, the absence or presence of installation indicators may tip off tracking systems that multiple sessions are coming from the same origin.

3. How FlashID Handles PWA Fingerprints

FlashID treats PWA-related capabilities as isolatable browser features, ensuring that each profile behaves as if it is a fully distinct device in terms of installation and service worker handling.

You May Also Like