automa VS ja3

Automa open source tool to automate connection request on linkedin

I was able to make this happen by using a chrome extension called automa. Download Automa Here is a link to my workflow using that extension: Download

I use Automa for repetitive web searches. I'll use the integration with Google Sheets to pull whatever column I'm needing, loop through the data, run a script looking for specific anchor tags and save the href values into a table that can be read / exported once the automation is done running.

Automa [0] is just another no-code extension to automate browser. I used it to scrape excel files from the website of an open-end fund, which does not expose public API for its daily NAV historical data. This extension not only saved me time to manually point and click 1000s of url, but also give me a reason to procrastinate teaching myself selenium.

[0] https://www.automa.site/

Interesting, I don't know javascript though. In chrome I use the Automa extension, which is connecting lines with blocks (and you still have to pick up some js. I didn't even know what an 'element' was when I started). Even a beginner can do something useful after an hour of study or so. YMMV.

https://github.com/AutomaApp/automa

https://docs.automa.site/

There's a library of scripts you can copy from

https://www.automa.site/workflows

This paper is nice, but it goes over some finer technical things.

So, not about the great wall, but there's projects out there, like this one https://github.com/salesforce/ja3 , which talk about how you can fingerprint fully encrypted traffic. Would be surprising if the great wall doesn't do this, when some open source firewall will.

It's sufficient to identify you since there is still all other tracking data any browser supplies as part of the HTTPs connection handshake [1].

It's also not necessary to have Mozilla be the bad actor. Anyone who has access to the information in the future is a possible bad actor as they might be able to cross-reference the allegedly "innocuous" information with some future, more-pervasive data.

---

[1] - https://github.com/salesforce/ja3

You can, sort of, with JA3 hashes https://github.com/salesforce/ja3

ExtensionZ: ...

That becomes a string like "1-C,B,A-X,Y,Z", which gets hashed to a fingerprint like "ae76e4566b036882147de2f7feddad4a". That gives us a totally different unique id, with the same ciphers but in a different order.

(This is pseudocode of course - the actual fingerprints have a few more params and use the number ids for each cipher and extension instead of strings, but it's equivalent)

Here, with 3 ciphers in two different orders, we've seen two different fingerprints already. With those three ciphers alone, there's actually 6 (3 factorial) possible permutations - i.e. a client could order those ciphers any one of 6 different ways, and each ordering has a different fingerprint.

If you have 4 ciphers, there's 24 possible orderings, 6 gives 720, 10 gives 3.6 million, and this goes up very rapidly, so that for a more realistic set of 20 ciphers there's 2 * 10^18 possible orderings, each one of which gives a unique fingerprint, even before we start talking about extension order.

Does that make more sense? The full algorithm is here: https://github.com/salesforce/ja3#how-it-works

Not only that - enterprise bot management protections will run behavioral identification (e.g. how your mouse moves —> AI -> bot yes/no), TCP stack fingerprinting (and other devices if available e.g. gyroscope), TLS ClientHello fingerprinting (e.g. see https://github.com/salesforce/ja3), etc. Lots of very unique info in the Scraping Enthusiasts discord where lots of pro scrapers hang out.