3 ms·
And it’s possible to pretend not to be Chrome headless too. https://intoli.com/blog/making-chrome-headless-undetectable/ https://intoli.com/blog/making-chrome-
by kondro 9y ago
And it’s possible to pretend not to be Chrome headless too.
https://intoli.com/blog/making-chrome-headless-undetectable/ https://intoli.com/blog/making-chrome-headless-undetectable/
- nailer 9y agoHah, this didn't cover window.webdriver, and I was about to post that you can still use that (since I assumed window properties weren't deletable) but... window properties are deletable. Cool.
- masklinn 9y agoHow do you ensure that your deletion code runs in the context of the hosted page but before that page can run any of its own code?
- dragonwriter 9y agoFrom the original article, you put a proxy in front of Chrome headless and inject the deletion code into the HTML of each page before any JS loaded by the page.
- jevinskie 9y agoSo now the page needs to checksum itself once loaded to detect tampering.
- masklinn 9y agoYou'd get false positives from e.g. extensions modifying the page.
- TeMPOraL 9y agoWhich, for 99% of extension-equipped users, will be just an ad blocker, i.e. something the websites don't want to deal with either. The arms race goes on.
- kondro 9y agoOr you could just rewrite the JS that does the checksumming to return true.