ONE SIGNAL
ISN'T IDENTITY.
A device ID, a User-Agent string, an IP address — each is spoofable alone. NonaShield fuses ~22 independent signals into a fingerprint anchored in hardware, not software claims.
// Baseline Device Fields
The SDK's device fingerprint collector reads 13 baseline fields on every session — zero dangerous permissions required.
// Why Fields Alone Fail
- Every field above lives in software — readable and forgeable by a rooted device.
- Emulator farms fake all 13 fields in bulk, cheaply.
- A fingerprint is only as strong as its weakest anchor.
Beyond the Software Fields.
Hardware-Attested Device Key
The SDK generates an ECDSA P-256 key in the hardware keystore with StrongBox-first, TEE-fallback logic, and reports which hardware tier actually backed it.
Stable Device ID
Not a random UUID — the stable device ID is the SHA-256 hash of the device's own hardware-backed public key, formatted as a UUID. It changes only if the key material itself changes.
Device Anchor
Persistent SSAID (Android) / identifierForVendor (iOS) — flags factory-reset and device-swap attempts.
Wi-Fi Network Fingerprint
SHA-256-hashed SSID + BSSID — never raw network names — for "same network as before" comparison.
Emulator / Farm Fingerprint
Kernel device nodes, QEMU markers, build-property strings, and sensor-count anomalies fused into a HARD/SOFT evidence model.
The Verdict.
"Software fingerprints identify a claim. A hardware-attested fingerprint identifies a chip."