Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply refresh the session token) if the thumbprint changes?
Is anyone aware of server side implementations (DLLs) that I can incorporate into my own project?
Ideally I'd like a C# ASP.NET MVC compatible version, but I'll keep it open ended so other platforms may benefit as well.
A lot of these answers describe issues with a particular aspect of the thumbprint (screen resolution, etc). These "unsafe" values can be omitted from the session thumbprint, or perhaps they are a non issue, depending how the session expiration / renewal works.
There may also be values not present in the panopticlick website, that may be beneficial to tie to the session as well.