security The last post ended at 'verify off to the side' and 'a day may come when a site says prove who you are.' That side is now a public endpoint — point a signed request at wba.cloudless.sh and it tells you, step by step, whether your signature verifies. Two independent checkers have already met over it.
Read more →User-agents are claims and fingerprints are inference. OpenAI, Cloudflare, and DuckDuckGo are already signing their requests — I captured them at the edge and verified the signatures against each signer's own published keys.
Read more →How to capture TLS fingerprints at the CloudFront edge, route them through a serverless pipeline, and query them in Athena — using a CloudFront Function, a bash Lambda, SNS, Firehose, and S3.
Read more →User-Agent strings are trivially forged. TLS handshakes are not. How JA4 fingerprinting combined with ASN classification exposes distributed scraper clusters that look exactly like real browsers.
Read more →