# Fingerprint, proxy and cookies: why they must agree > Fingerprint, proxy and cookies consistency: sites compare the three, and each can look fine alone while together they describe nobody. Source: https://mosaicbrowser.com/blog/parts-of-a-profile-agree ## Why the parts of a profile have to agree Fingerprint, proxy and cookies consistency: sites compare the three, and each can look fine alone while together they describe nobody. ![A fingerprint, a proxy and a cookie jar that agree](https://mosaicbrowser.com/covers/parts-of-a-profile-agree.webp) Fingerprint, proxy and cookies consistency is what a site is really checking when it reads a browser profile. It reads all three, the fingerprint, the proxy exit and the cookie jar, and it doesn't grade them one at a time. It holds them up against each other. Each can pass alone while the three together describe somebody who doesn't exist, and Mosaic's job, put in one line, is that they agree and go on agreeing. ## Who reads which part - The fingerprint, read by the page: the WebGL renderer string that names the GPU, `screen.width` and `screen.height`, `navigator.hardwareConcurrency`, `navigator.deviceMemory`, the font list, a canvas hash, an audio hash, the timezone and `navigator.languages`. - The proxy exit, read by the server: one address, and with it a country, a city and an ISP. - The cookie jar, read by the site that wrote it: last week's session cookie, which says this browser has been here before. None of it is secret. The timezone is one call, `Intl.DateTimeFormat().resolvedOptions()`. The address arrives with every request, and cookies come back on their own. Most of what [how websites detect multiple accounts](https://mosaicbrowser.com/guides/how-do-websites-detect-multiple-accounts) describes is a site joining those three readings up. ## Three comparisons a site makes 1. Exit against clock and language. A Berlin exit with `America/New_York` in `Intl` fails one comparison; a German exit with only `en-US` in `navigator.languages` fails the same one. For an ordinary Chrome, [a timezone that does not match the IP](https://mosaicbrowser.com/guides/browser-timezone-does-not-match-ip) has the fix by hand. 2. Fingerprint against itself. A page asks the same question in the page, in an iframe and in a worker. A value changed in one of them and not the others is two answers about one machine, and no real computer gives two. 3. Cookie against everything else. A session cookie set in March comes back in April. If April's request comes from another country, with a different WebGL renderer and a different screen, the site has one reading that says returning visitor and a dozen that say new computer. Pasting a logged-in session into a fresh browser produces exactly that. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Matched to the exit](https://mosaicbrowser.com/features/exit-matching) ## Two of our own bugs For profiles with no proxy, Mosaic called `refreshExitGeo()` once at app start to find where the computer was, and never again. When that one lookup failed, nothing retried, and every no-proxy profile was drawn from a share-weighted country table that leans American. A Mac in Austria made profiles claiming New York, each with `exitMatch: { matched: true }`. Those profiles browse from the operator's own Austrian address, so the IP and the clock were six hours apart on the first thing a scanner compares. [A profile in Austria claimed New York](https://mosaicbrowser.com/blog/austria-claimed-new-york) has the whole story. The lookup now runs at the point of use and retries a failure on its own interval, and when it still has no answer it uses the machine's own timezone, never a table. The second hid in launch order. Mosaic passed the `--user-agent` flag only when a profile's string differed from the engine's, and the engine's came from a cache that was empty at every app start. So the first profile you opened each session wore a different identity from every profile opened after it. From outside that reads as "sometimes it gets detected". From inside, it was one profile disagreeing with itself across launches. ## Fingerprint, proxy and cookies consistency in Mosaic Most of the work is about when things get measured, not what they get set to. 1. Create a profile with a proxy and Mosaic measures the exit through that proxy first, then draws the timezone, language and geolocation for the place it found. Over the API, every create call reports whether that worked in an `exitMatch` field, with the reason if it didn't. 2. Before every launch the proxy is checked, and a profile won't open behind one that hasn't answered and tunnelled. The exit gets resolved again at the same moment, because residential exits move. 3. Timezone and geolocation follow the new exit. Language follows only on a profile that has never run and has no cookies. A session that spoke `de-AT` to a site for a month and then switched to `en-US` has told the site something true, so for a profile with history Mosaic leaves the language alone and reports the mismatch. 4. Canvas, screen and GPU never move with the exit. Redraw them and the cookie jar has a different machine to come back from. ![Creating a profile in Mosaic: a checked proxy, and the hardware and locale drawn to match its exit](https://mosaicbrowser.com/shots/profile-editor.png) *The exit is measured before the locale is drawn* Where a value gets changed decides whether the fingerprint agrees with itself. Tesseract Chrome, our engine, changes values in C++, so the page, its frames and its workers all read the same number. Hardware is drawn as a set from real device records rather than field by field; [machines that exist](https://mosaicbrowser.com/features/real-fingerprints) covers that part. The proxy half has one more trap. Two profiles on one session id share an exit. A [provider](https://mosaicbrowser.com/features/proxy-providers) in Mosaic is a single gateway line pasted from your proxy seller, and Mosaic mints a separate session from it for each profile, so no two profiles share an exit unless you pin them to one. ![A proxy provider in Mosaic: one gateway line that mints a separate session for every profile](https://mosaicbrowser.com/shots/provider-mint.png) *One gateway line, a session per profile* Each profile keeps its own cookie jar, encrypted on disk. Purging the profile from the trash deletes the jar with it. ## The card, the phone number and the fonts A site also keeps records no browser touches. Two accounts paid with the same card, or verified with the same phone number, sit next to each other in the site's own database, and two profiles pinned to one exit share an IP in every log line. A platform that allows one account per person still allows one. Mosaic keeps accounts you are entitled to run apart; it does not change what a platform allows. The last limit is the hardware under the profile. On a Mac, Mosaic will draw a Windows profile with a Windows GPU, screen and thread count, but the font files, their metrics and how they are rasterised still come from macOS, and no switch reaches them. On one Mac we put both through IPHey: claiming macOS scored 100/100 Trustworthy, claiming Windows 80/100 Unreliable. So the profile editor shows a caution when you pick an OS other than the one your computer runs. ## Questions ### What does fingerprint, proxy and cookie consistency mean? It means the three parts of a browser profile describe the same person in the same place. The exit's country fits the timezone and language, the hardware fits itself in every frame and worker, and the cookies only ever come back from that one machine. ### Which mismatch do sites check first? Usually the IP address against the browser's timezone and language. The server gets the address with every request, and a page reads the other two with one line of JavaScript. A Berlin exit with a New York clock is caught before anything subtler is read. ### Can I move cookies from one profile to another? Mosaic imports and exports cookie jars, but a session that suddenly returns from a different machine and a different exit has told the site something. Keep a jar with the profile it was made in. ### Does Mosaic redraw the fingerprint when a proxy's exit moves? Only the parts that should move. Timezone and geolocation follow the exit at every launch. Language follows only on a profile that has never run. Canvas, screen and GPU never move, because changing them would make a different machine. ## Related [Match browser timezone to proxy exits, automatically](https://mosaicbrowser.com/features/exit-matching): No need to match browser timezone to proxy by hand: Mosaic sets each profile's timezone, language and location from the measured exit, before every launch. [How do websites detect multiple accounts?](https://mosaicbrowser.com/guides/how-do-websites-detect-multiple-accounts): Websites detect multiple accounts by what two accounts share: cookies, the IP address, the browser fingerprint, payment and phone details, and habits. [A profile in Austria claimed New York](https://mosaicbrowser.com/blog/austria-claimed-new-york): Browser location does not match IP: a no-proxy profile made in Austria claimed New York. One failed lookup was never retried, and a table filled the gap. [Browser timezone does not match IP: what it means and the fix](https://mosaicbrowser.com/guides/browser-timezone-does-not-match-ip): Browser timezone does not match IP? Your browser reads the computer's clock, and a proxy or VPN moves only the address. Match the zone to the exit. [Provider accounts: one gateway line, one exit per profile](https://mosaicbrowser.com/features/proxy-providers): Paste your proxy seller's gateway line once and Mosaic mints a separate session for every profile, so each one browses from its own exit address.    ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.