navigator.platform implies an OS that contradicts the UA platform
br.navplatform_vs_ua · convicts
What it catches
Engine-agnostic: works for Firefox-based anti-detect (no Client-Hints needed). v0.71.1: a real Android browser carries navigator.platform="Linux armv8l" under an Android UA — a coherent pairing (Android IS Linux) that this rule would read as a contradiction, false-firing on every real Android visitor. Fixed by resolving the platform to the device's OS family before comparison. (Surfaced while verifying the Intoli corpus; the headline ~73% there was mostly a dataset artifact — Intoli's platform field is a fixed "Linux x86_64" for 70% of records regardless of device — so the fix is grounded in real Android behavior, not that number. See docs/calibration.md.) Desktop OS impersonation (a Linux host claiming a Windows UA) still fires.
Signals it reads
browser.nav_platform_os browser.ua_platform
How it fires
not_equal
Evaders it caught 9
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.