- The mod then compares the information in the fingerprint, determining if both users have been using the same browser on the same machine.
This is tedious, unnecessary, and a violation of privacy.
Have you looked at the results over there? I (like many users) am a developer, and I'm currently on an old Windows XP image that's seen hundreds of apps installed (and thus I have some 230 fonts) and I've used plenty of browser extensions (278 semicolons in the list, though most of those seem to come with Chrome by default - I've only got some 20 that I've installed personally). The list is dizzying. Please don't make mods sort out whether those fingerprints are identical.
All that's necessary is a simple boolean "Yes" or "No", these users have/have not demonstrated identical fingerprints. You might consider displaying this for each of the rows in the table; I expect that some users run incognito windows or different browsers to avoid having to log in and out, which would produce negative results on several fields (Time zone, monitor size, and system fonts should not change, though).
Violation of Privacy
Most importantly, as Mark Trapp noted, you're missing the point of the site: This is a privacy issue.
Stack Exchange also collects potentially personally-identifying information like Internet Protocol (IP) addresses. Stack Exchange does not use such information to identify its visitors, however, and does not disclose such information, other than under the same circumstances that it uses and discloses personally-identifying information, as described below.
Certain visitors to the Network choose to interact with the Network in ways that require Stack Exchange gather personally-identifying information. The amount and type of information that We gather depends on the nature of the interaction. [snip examples] In each case, Stack Exchange collects such information only insofar as is necessary or appropriate to fulfill the purpose of the visitor’s interaction with the Service. Stack Exchange does not disclose personally-identifying information other than as described below. And visitors can always refuse to supply personally-identifying information, with the caveat that it may prevent them from engaging in certain Network-related activities.
Stack Exchange discloses potentially personally-identifying and personally-identifying information only to those of its employees, contractors and affiliated organizations that (i) need to know that information in order to process it on Our behalf or to provide services available at the Network, and (ii) that have agreed not to disclose it to others. Some of those employees, contractors and affiliated organizations may be located outside of your home country; by using the Network, you consent to the transfer of such information to them.
I'm not a lawyer, so I'm not going to try to analyze whether or not this sort of data revelation is allowable under that policy. Nonetheless, I will say that (1) I, as a user, don't want any information revealed unnecessarily and (2) I, as a moderator, want to respect user privacy whenever possible.
The mod agreement
Sure, the mod agreement says:
- I acknowledge that I may have access to potentially personally-identifying information about Site users and that in connection with such access
- I will not disclose this information to anyone,
- I will not store or copy this information and
- I will only use such information in connection with performance as a Site moderator for the benefit of the Site.
Panopticlick's information is globally unique stuff; heavier than the current tools available to mods. It's one thing to state that two Stack Exchange users are socks, but it's another to state that this visitor to a different site is this Stack Exchange user.
In which I make a hyperbolic analogy
You could also study whether two users are the same by comparing their credit card numbers or passwords, but that's completely unnecessary and probably illegal, the above disclaimer notwithstanding. You wouldn't do this. I hope.
The current tools available to a mod aren't always sufficient to discern well-meaning friends or small businesses sharing an internet connection from malicious vote rings and abusive socks. I'd be OK with adding another tool to the current arsenal, but don't throw panopticlick results back at me. If you do use them,
diff them first, and just tell me whether they match or not.