Can device fingerprinting stop exam bots that spoof their devices?
Why fingerprints are easy to fake
A fingerprint is a bundle of signals: canvas rendering quirks, installed fonts, screen size, timezone, TLS handshake details. Anti-detect browsers and cheap spoofing toolkits let an operator rotate or randomize every one of them. What used to take a skilled developer is now a checkbox in off-the-shelf software. A bot farm can present a thousand distinct, plausible devices before lunch, each one looking like a normal laptop.
Worse, a spoofed fingerprint can be more consistent than a real one. Real devices change: OS updates, new fonts, a second monitor. A farmed fingerprint stays frozen, which is its own tell if you look for it, but on a single check it passes without a blink.
Where fingerprinting still pulls its weight
The value is not in proving humanity. It is in linking accounts. One fingerprint behind forty test-taker accounts is a farm signature, even if every signal in the fingerprint looks legitimate. The same goes for fingerprints with no history at all: a device that has never appeared before, attached to an account created yesterday, sitting an exam today.
So treat fingerprinting as an identity-linking tool. Ask it "have I seen this device before, and attached to whom?" rather than "is this a human?" The first question catches farms. The second gets spoofed.
What to pair it with
Behavioral signals are harder to fake at scale. Read rate through a question bank, the rhythm of mouse movement, hesitation before answers, the gap between page render and first interaction: humans are noisy and inconsistent, bots are efficient and regular. Account signals matter too: creation date, IP and proxy reputation, answer-timing patterns across sittings.
Score them together and let no single signal convict. A spoofed fingerprint plus human-paced reading plus a two-year-old account is probably a person. A clean fingerprint plus machine-interval reading plus forty sibling accounts is a farm. The fingerprint did not make the call in either case. It was one vote among several.