5 ms·

> What if you set your user agent to chrome instead of firefox and that grants you access to a website? The website is at fault. This is no different than lyin

by a1369209993 5y ago

> What if you set your user agent to chrome instead of firefox and that grants you access to a website? The website is at fault. This is no different than lying about your religion to bypass a discriminatory shop owner.

haswell 5y ago
But where do you draw the line re: which type of "lie" matters? A naive generalization might say that "lying" by setting a header = illegal. But clearly there is a difference between setting the Authorization header and setting the User-Agent header. But what about headers that are not so well-defined? What about custom headers? I'm not disagreeing with you, but these are the first questions that come to mind. It seems that a judge would have to carefully consider the design of the system, and whether the vector that granted access was something that was clearly negligent on the part of the site owner, or was truly an attack vector and deemed illegal. But it seems difficult to formulate a universal test for this.
- a1369209993 5y ago
  > But clearly there is a difference between setting the Authorization header and setting the User-Agent header. No. If you falsify information indicating that you have authorization to access the site, it doesn't matter what header it's in. Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in. You are either authorized to access the site (or URL, or whatever) or you are not. What tools you use to do so are only relevant if they cause you to generate accesses (eg network requests) that you are not authorized to make. By construction, configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized.
  - haswell 5y ago
    > Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in. Ahh, but here's where things get tricky. Who decides that the information has no bearing on whether you have authorization to access the site? Imagine a situation where a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents. This is obviously a horrible design, but if the intent of the developer was to authorize access to a specific set of internal clients, identified by a unique/non-standard user-agent, how would you classify the act of changing one's browser settings to send the accepted agent? User Agent is a great example of something that has a pretty well-defined purpose (and that purpose has nothing to do with authorization), but has also been misused by naive or lazy developers to control access to sites.
    - hunter2_ 5y ago
      I think the tail end of GP's comment answers your question: > configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized. Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent. On the other hand, is it really a secret if the agent tells it to every server that the agent connects to? At some point it's not a secret if little care is taken to protect it (and the name of the header has some bearing on what care is taken, for example whether it ends up stored in clear text in access logs...).
      - a1369209993 5y ago
        > Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent. "it is authorized if and only if you were also authorized", but otherwise yes, exactly.
agency 5y ago
I would not say “no different.” Religion is a protected class[1], web browser preference is not. The law does not treat all kinds of discrimination equivalently. [1] https://en.m.wikipedia.org/wiki/Protected_group https://en.m.wikipedia.org/wiki/Protected_group
- yissp 5y ago
  I don't know... some people are pretty fanatical about their web browser preferences.

haswell 5y ago

But where do you draw the line re: which type of "lie" matters? A naive generalization might say that "lying" by setting a header = illegal. But clearly there is a difference between setting the Authorization header and setting the User-Agent header. But what about headers that are not so well-defined? What about custom headers? I'm not disagreeing with you, but these are the first questions that come to mind. It seems that a judge would have to carefully consider the design of the system, and whether the vector that granted access was something that was clearly negligent on the part of the site owner, or was truly an attack vector and deemed illegal. But it seems difficult to formulate a universal test for this.

a1369209993 5y ago
> But clearly there is a difference between setting the Authorization header and setting the User-Agent header. No. If you falsify information indicating that you have authorization to access the site, it doesn't matter what header it's in. Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in. You are either authorized to access the site (or URL, or whatever) or you are not. What tools you use to do so are only relevant if they cause you to generate accesses (eg network requests) that you are not authorized to make. By construction, configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized.
- haswell 5y ago
  > Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in. Ahh, but here's where things get tricky. Who decides that the information has no bearing on whether you have authorization to access the site? Imagine a situation where a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents. This is obviously a horrible design, but if the intent of the developer was to authorize access to a specific set of internal clients, identified by a unique/non-standard user-agent, how would you classify the act of changing one's browser settings to send the accepted agent? User Agent is a great example of something that has a pretty well-defined purpose (and that purpose has nothing to do with authorization), but has also been misused by naive or lazy developers to control access to sites.
  - hunter2_ 5y ago
    I think the tail end of GP's comment answers your question: > configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized. Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent. On the other hand, is it really a secret if the agent tells it to every server that the agent connects to? At some point it's not a secret if little care is taken to protect it (and the name of the header has some bearing on what care is taken, for example whether it ends up stored in clear text in access logs...).
    - a1369209993 5y ago
      > Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent. "it is authorized if and only if you were also authorized", but otherwise yes, exactly.

agency 5y ago

I would not say “no different.” Religion is a protected class[1], web browser preference is not. The law does not treat all kinds of discrimination equivalently. [1] https://en.m.wikipedia.org/wiki/Protected_group https://en.m.wikipedia.org/wiki/Protected_group

yissp 5y ago
I don't know... some people are pretty fanatical about their web browser preferences.