5 ms·

Perhaps I misunderstand you but I think you're placing too much trust in changing the user agent. The method they are using doesn't depend on the user agent st

Perhaps I misunderstand you but I think you're placing too much trust in changing the user agent. The method they are using doesn't depend on the user agent string and ignoring the user agent could even improve its performance. Further, I think it should be relatively easy to detect spoofing of user agent strings. For instance, if your user agent says your using a Linux browser but your fonts include nothing but the standard fonts on OSX, it's pretty clear then that your spoofing your user agent.

kakarot 10y ago
I'm okay with the spoofing being detectable. The important thing is obfuscating myself to ad agencies. It's OK if I have a unique fingerprint, if that unique fingerprint is morphing every few minutes. What is interesting is that my unspoofed user agent is 3x more rare than the spoofed one, even though the spoofed one usually throws browser versions that are out of date. Unfortunately, my browser is still unique to the set of 25k whether spoofed or not. Enabling javascript helps a little, but then I can be audio fingerprinted which defeats the purpose. I definitely have an exotic configuration. KVM / Firefox / No 3rd Party Cookies / Blacklisted social media sites / Addons (including NoScript) that take various steps to lock down information leaks and prevent loading of blocked resources. I don't allow web fonts which is probably fairly exotic as well. If more would use script blockers and ad blockers maybe I wouldn't be unique, but it seems to be a trade-off between privacy and security. And I just kind of assume that privacy is off the table for now, so at least I can work towards having security. If I have to choose between the two, I'm more concerned with malware and being tracked through 3rd party resources like Google Fonts, Google APIs (I cache them and prevent subsequent resource loading) than I am being fingerprinted.
- Gaelan 10y ago
  https://xkcd.com/1105/ https://xkcd.com/1105/
  - kakarot 10y ago
    Haha I love that one, and of course it's very relevant.
- greglindahl 10y ago
  The point of this project is to not use the user-agent for fingerprinting.
  - kakarot 10y ago
    Are you saying it isn't worth spoofing your user agent?
    - greglindahl 10y ago
      I'm saying that user agents are a completely separate issue from what Browserprint is measuring and using for fingerprinting. Browserprint's fingerprint of your browser doesn't change when you change your user agent. tmalsburg2 appears to have tried to make the same point.
      - kakarot 10y ago
        I think we're all misunderstanding each other. I'm aware Browserprint isn't using user agents as their main source of information. It very clearly outlines the information they are using in the results. I was just remarking about the uniqueness of my spoofed user agent vs a non-spoofed agent. After my initial post I went back and found I was still unique even without a spoofed agent. That's really all there was to my comment, I'm not insinuating that I was surprised to find I was uniquely fingerprinted by other means like font and plugin enumeration.

kakarot 10y ago

I'm okay with the spoofing being detectable. The important thing is obfuscating myself to ad agencies. It's OK if I have a unique fingerprint, if that unique fingerprint is morphing every few minutes. What is interesting is that my unspoofed user agent is 3x more rare than the spoofed one, even though the spoofed one usually throws browser versions that are out of date. Unfortunately, my browser is still unique to the set of 25k whether spoofed or not. Enabling javascript helps a little, but then I can be audio fingerprinted which defeats the purpose. I definitely have an exotic configuration. KVM / Firefox / No 3rd Party Cookies / Blacklisted social media sites / Addons (including NoScript) that take various steps to lock down information leaks and prevent loading of blocked resources. I don't allow web fonts which is probably fairly exotic as well. If more would use script blockers and ad blockers maybe I wouldn't be unique, but it seems to be a trade-off between privacy and security. And I just kind of assume that privacy is off the table for now, so at least I can work towards having security. If I have to choose between the two, I'm more concerned with malware and being tracked through 3rd party resources like Google Fonts, Google APIs (I cache them and prevent subsequent resource loading) than I am being fingerprinted.

Gaelan 10y ago
https://xkcd.com/1105/ https://xkcd.com/1105/
- kakarot 10y ago
  Haha I love that one, and of course it's very relevant.
greglindahl 10y ago
The point of this project is to not use the user-agent for fingerprinting.
- kakarot 10y ago
  Are you saying it isn't worth spoofing your user agent?
  - greglindahl 10y ago
    I'm saying that user agents are a completely separate issue from what Browserprint is measuring and using for fingerprinting. Browserprint's fingerprint of your browser doesn't change when you change your user agent. tmalsburg2 appears to have tried to make the same point.
    - kakarot 10y ago
      I think we're all misunderstanding each other. I'm aware Browserprint isn't using user agents as their main source of information. It very clearly outlines the information they are using in the results. I was just remarking about the uniqueness of my spoofed user agent vs a non-spoofed agent. After my initial post I went back and found I was still unique even without a spoofed agent. That's really all there was to my comment, I'm not insinuating that I was surprised to find I was uniquely fingerprinted by other means like font and plugin enumeration.