4 ms·

Spoofing your user agent on your own typically makes you easier to fingerprint, not harder. See footnote 3 of the Panopticlick 1.0 paper: https://panopticlick.

by pde3 11y ago

Spoofing your user agent on your own typically makes you easier to fingerprint, not harder. See footnote 3 of the Panopticlick 1.0 paper: https://panopticlick.eff.org/static/browser-uniqueness.pdf https://panopticlick.eff.org/static/browser-uniqueness.pdf It's more plausible for a large population of browsers to share a single spoofed user agent; all of the Tor Browsers pretend to be a single specific version of Firefox for Windows.

relkor 11y ago
I used to spoof user agents, randomly mutating. Then last month I started to run into sites that refused to load/render for incorrect strings. It appears the Google and other large companies are now sending customized versions of their page based on the user agent which I can only speculate is an attempt to save bandwidth. By taking advantage of implementation specific features, they not only eliminate all of the extra JS and browser workarounds, but they also can take shortcuts.
- brokentone 11y ago
  I've been known to do something like this (rejecting unusual UAs) to avoid the added load of rogue scrapers.
  - deleted 11y ago
    [deleted]
rocky1138 11y ago
How about we get together and decide on a common string that all of us can use? We can set our browsers to use that, and our friends' as well. Theoretically, the more people that use the same string, the harder we'll be to track, correct?
- legind 11y ago
  That's right, though it's a bit more difficult. Lots of sites use the User-Agent header to determine how to render a page, and may not render it at all if it's an unexpected value. Pages that allow you to install addons to your browsers also use this string to figure out if you're really running the target browser.
- schoen 11y ago
  Tor Browser does that: https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/
- redwards510 11y ago
  Yes! How would you say "I'm a generic modern browser that can interpret HTML5. Do not send me flash."
  - StavrosK 11y ago
    Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25
    - rocky1138 11y ago
      Won't that make some websites send you to the mobile version? What's the desktop equivalent?
- r-w 11y ago
  JonDo has done exactly that: “Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0”. It hasn’t changed things much, thanks to its relative obscurity and the network effect involved. You should try it out!
Dylan16807 11y ago
Okay, has someone made an extension that lets me pretend to have the most common set of plugins on the most common version of firefox?
- redwards510 11y ago
  Yes, everyone knows you can change the user agent string, but how do you change the list of plugins returned by the browser? Do you have to actually patch the binary?!
  - mpeg 11y ago
    navigator.__defineGetter__('plugins', function(){ return new Object(); }); Of course, you'd actually have to do a bit more work to make it bulletproof (otherwise fingerprinters could use the fact that you modified your default navigator object as a way to uniquely identify you !) I imagine ultimately it's almost impossible to defeat fingerprinters in JS, as they could do tricky stuff like timing attacks to get you. Use NoScript if you're concerned.
  - throwaway252525 11y ago
    You can set plugins.enumerable_names to the empty string, or to the plugins you want returned. Unfortunately, this was recently removed.[1] [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1169945 https://bugzilla.mozilla.org/show_bug.cgi?id=1169945
- verusfossa 11y ago
  This kind of works. Set a UA for all sites. https://addons.mozilla.org/en-US/firefox/addon/uacontrol/ https://addons.mozilla.org/en-US/firefox/addon/uacontrol/ https://addons.mozilla.org/en-us/firefox/addon/user-agent-js-fixer/ https://addons.mozilla.org/en-us/firefox/addon/user-agent-js... String... Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0 Update the string every now and then? https://techblog.willshouse.com/2012/01/03/most-common-user-agents/ https://techblog.willshouse.com/2012/01/03/most-common-user-... Disable all plugins. Best I got, sorry.

by pde3 11y ago

relkor 11y ago

I used to spoof user agents, randomly mutating. Then last month I started to run into sites that refused to load/render for incorrect strings. It appears the Google and other large companies are now sending customized versions of their page based on the user agent which I can only speculate is an attempt to save bandwidth. By taking advantage of implementation specific features, they not only eliminate all of the extra JS and browser workarounds, but they also can take shortcuts.

brokentone 11y ago
I've been known to do something like this (rejecting unusual UAs) to avoid the added load of rogue scrapers.
- deleted 11y ago
  [deleted]

rocky1138 11y ago

How about we get together and decide on a common string that all of us can use? We can set our browsers to use that, and our friends' as well. Theoretically, the more people that use the same string, the harder we'll be to track, correct?

legind 11y ago
That's right, though it's a bit more difficult. Lots of sites use the User-Agent header to determine how to render a page, and may not render it at all if it's an unexpected value. Pages that allow you to install addons to your browsers also use this string to figure out if you're really running the target browser.
schoen 11y ago
Tor Browser does that: https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/
redwards510 11y ago
Yes! How would you say "I'm a generic modern browser that can interpret HTML5. Do not send me flash."
- StavrosK 11y ago
  Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25
  - rocky1138 11y ago
    Won't that make some websites send you to the mobile version? What's the desktop equivalent?
r-w 11y ago
JonDo has done exactly that: “Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0”. It hasn’t changed things much, thanks to its relative obscurity and the network effect involved. You should try it out!

Dylan16807 11y ago

Okay, has someone made an extension that lets me pretend to have the most common set of plugins on the most common version of firefox?

redwards510 11y ago
Yes, everyone knows you can change the user agent string, but how do you change the list of plugins returned by the browser? Do you have to actually patch the binary?!
- mpeg 11y ago
  navigator.__defineGetter__('plugins', function(){ return new Object(); }); Of course, you'd actually have to do a bit more work to make it bulletproof (otherwise fingerprinters could use the fact that you modified your default navigator object as a way to uniquely identify you !) I imagine ultimately it's almost impossible to defeat fingerprinters in JS, as they could do tricky stuff like timing attacks to get you. Use NoScript if you're concerned.
- throwaway252525 11y ago
  You can set plugins.enumerable_names to the empty string, or to the plugins you want returned. Unfortunately, this was recently removed.[1] [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1169945 https://bugzilla.mozilla.org/show_bug.cgi?id=1169945
verusfossa 11y ago
This kind of works. Set a UA for all sites. https://addons.mozilla.org/en-US/firefox/addon/uacontrol/ https://addons.mozilla.org/en-US/firefox/addon/uacontrol/ https://addons.mozilla.org/en-us/firefox/addon/user-agent-js-fixer/ https://addons.mozilla.org/en-us/firefox/addon/user-agent-js... String... Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0 Update the string every now and then? https://techblog.willshouse.com/2012/01/03/most-common-user-agents/ https://techblog.willshouse.com/2012/01/03/most-common-user-... Disable all plugins. Best I got, sorry.