Manage Device fingerprint attributes
Device fingerprint attributes help IDaaS recognize a browser or device when Device Fingerprint Required is selected in the machine authenticator settings. When the collected values match the stored fingerprint closely enough, the sign-in attempt is treated as lower risk. When key values change, IDaaS can assign more risk or treat the device as unfamiliar.
Use this page to balance security and usability. A stricter fingerprint can help detect browser spoofing or device changes, but it can also increase the number of sign-ins that need additional verification after a browser update, a plug-in change, or a new device setting.
Changes made to the device fingerprint attributes are saved automatically.
The following device fingerprint attributes are read-only because they define how IDaaS interprets each collected value:
- Attribute name. Attribute names map to the browser or device property that IDaaS collects during authentication. The name identifies what the system is comparing against the stored fingerprint.
- Type. The type defines how the attribute can change over time and how IDaaS evaluates those changes:
- Constant Attributes do not change, or change very rarely. Examples include screen dimensions or an operating system name. A change here often indicates a different browser or device.
- List Attributes contain multiple values that can change by items being added or removed. Examples include installed fonts or supported languages.
- Variable Attributes are likely to change over time. Examples include installed applications, enabled device options, or a time zone setting on a laptop used for travel.
- Version Attributes are dotted values that can change frequently, such as browser versions or operating system versions. IDaaS compares the version parts individually instead of treating the value as a single string.
Set device fingerprint attributes
-
Click > Policies > Device Fingerprinting. The Device Fingerprint Attributes page appears.
-
Select the type of device fingerprint from the drop-down list. The options include:
- Web Browsers (the default)
- iOS Apps
- Android Apps
-
Click for the attribute you want to modify. The Device Fingerprint Attribute dialog box appears.
-
Modify the attributes as required.
-
Select Enabled to include the attribute in the device fingerprint. If Enabled, your application must collect this attribute from the browser or device for IDaaS to compare it during authentication.
-
Edit the Change Threshold as required. The change threshold defines how much the attribute can change from one user authentication attempt to the next without adding risk. Use lower values for attributes that rarely change and higher values for attributes that change often. Not all attributes have a change threshold.
Example: A Web browser might change from version 1 to version 3. If the change threshold is 2 or more in this example, the browser is not flagged as different.
How IDaaS evaluates each attribute type
- Constant. The change threshold should be very low.
Change to this type of attribute is rare and often indicates that a user is signing in from a different browser or device. For example, a computer with a new operating system is effectively a different device.
- List. The change threshold value represents the number of changes to the list through addition or deletion of items since the last time a user authenticated.
A change to the name of a list item would count as two changes (deletion of the item with its old name and addition of an item with its new name).
- Variable. The change threshold value is the number of characters that have changed.
To construct the previous value of an attribute from the current value, each addition, subtraction, or movement of a character counts as one change. If the number of required changes exceeds the change threshold, IDaaS adds risk.
- Version. The change threshold is a dotted numeric string like the attribute value itself.
For example, if the change threshold is 1.2, it means that if the major version of the software associated with the attribute increases by more than one and the minor version increases by more than two, IDaaS adds risk. With the 1.2 change threshold setting, the other numbers in the version string, such as a build number, are ignored.
- Constant. The change threshold should be very low.
-
Select Must Match to require that the attribute value from a new authentication attempt matches the value from the last successful authentication attempt.
When an attribute does not match, it incurs the risk points defined in its Non-Matching Risk Points setting. The risk points from all non-matching attributes are added together to produce a total risk score, which is applied to the resource rule for machine authentication.
The total risk score is scaled to a value between
0and100using the following formula:
Total Risk Score = (Total Risk Points of Failing Attributes / Maximum Risk Points of All Enabled Attributes) * 100
-
Assign a Non-Matching Risk Points value to each attribute. The default is
10. Increase the value for attributes you consider higher risk, such as stable device properties that change only when the user is likely on a different device. Keep the value lower for attributes that change frequently and are less useful on their own as a sign of risk.Example: Browser versions update frequently, so a change to that attribute carries little risk and can have a low Non-Matching Risk Points value. Operating system changes are rare and often indicate authentication from a different device, so that attribute should have a higher Non-Matching Risk Points value.
-
Click Save.
Validate your changes
After you save, verify the following:
- Updated attributes remain enabled or disabled as configured.
- Updated thresholds persist for the selected device type.
- A test sign-in from a known device produces the expected low-risk outcome.
- A test sign-in with intentional attribute changes produces the expected increase in risk.
- Resource rule behavior aligns with the resulting machine-authentication risk score.