Mimicking a device is becoming almost impossible
Browser automation is an arms race between fraud detection and criminals, with users and some legitimate use cases (<i>cough</i> science) caught in between.<p>I find it's very useful to think of the problem not as governed by technical possibility, but rather by costs.<p>Good spoofing detection does not prevent fraud, it increases its costs to fraudsters (hoping to render fraud uneconomical).<p>Bad spoofing detection harms legitimate users and is inefficient against capable actors.<p>All of this gets much more interesting and complex when we consider privacy (and privacy compliance) to be part of the puzzle - now fraud prevention incurs a cost to the defender as well.<p>Finally, it's important to consider asymmetric risk/benefit counts. Are you defending against a single major heist, or against billions of tiny events (click fraud)? The trade-off will look different.