> The default TLS Client Hello has been modified. If your app or website communicates with servers configured with strict bot-detection or security policies that only allow traffic with known TLS fingerprints, then users might be unable to login or perform other actions.
Wonder if that's what they do on their own services? Seems a little odd they'd have an outage a few days before release and then this shows up in their release notes.
GREASE already randomizes the handshake to an extent, and I think whatever TLS stack chrome uses also shuffles the cipher order. In response newer TLS fingerprinting algorithms (ja4?) sort the cipher list first to mitigate this.
Wonder if that's what they do on their own services? Seems a little odd they'd have an outage a few days before release and then this shows up in their release notes.
reply