HN user
Kind reminder Google broke almost all TCP fingerprints (i.e. JA3) when introducing grease values and other stuff such as random order in the ciphers in Chromium. I work in a bot detection company and we put a lot effort on it, currently have an advanced implementation that ignores some extensions, order the fields, remove the grease values etc.
As someone working in the ad fraud detection space, Google has been hostile for quite a while. Making things extra difficult just to get more ad spend quota on their platforms. First User-Agent reduction (I agree with some points). Later making a perfect Headless automated browser that shows no difference against a real browser (making bot detection nearly impossible without captcha's). Last weeks by removing any kind of WebView signal in the browser so it makes impossible to detect between in-app traffic/fraud/Chrome Mobile. Could write a lot more about other stuff and the implications but the whole picture is not looking great.