If two different users visit an website from two different browsers via HTTPS, can they be identified by the server to be from same origin (same client machine) using information available from TLS handshake (except just IP)?
As far as I can understand- since TLS is below application layer, so the Session ID (from Server Hello during TLS handshake) can be same for both requests from different browsers. Thus the server can determine both requests to be from same machine- is that correct?
And, as per the following statement from this article-
The connection will stay open while both sides send and receive encrypted data until either side sends out a “closure alert” message and then closes the connection. If we reconnect shortly after disconnecting, we can re-use the negotiated keys (if the server still has them cached) without using public key operations, otherwise we do a completely new full handshake.
The article quoted above implies that even after disconnection the same negotiated keys can be used to continue data exchange. Does it mean even after changing IP, the server can trace (just based on TLS) that the requests are coming from same machine?
Is there anything else commonly known that a server can use to confidently relate two different HTTPS requests to be originating from same machine (but different browser)?
Apologies if this is not the right place to ask OS specific question.