Is it a good Idea to identify if the user logging in is the actual user who created the account by using Browser fingerprinting?
Basically do a bunch of checks just as they click sign in and if it doesn't match like 80% of all of the data then ask for some 2FA stuff.
I'm assuming this is similar to what Google does, they legally collect this data from you and update it whenever you're signed in.
Wondering if it's secure enough or is there a better way to identify users when they login? Because doing it via IP address isn't safe enough, same goes for user agent too, I got referred to browser fingerprinting but know little about it's security and want to know from experts.