4 ms·

This echoes the user agent checking that was prevalent in past times. Websites would limit features and sometimes refuse to render for the "wrong" browser, even

• ZeWaka 2y ago
  > if perhaps it's sophisticated enough to get past the user agent spoofing As a part of some browser fingerprinting I have access to at work, there's both commercial and free solutions to determine the actual browser being used. It's quite easy even if you're just going off of the browser-exposed properties. You just check the values against a prepopulated table. You can see some of such values here: https://amiunique.org/fingerprint https://amiunique.org/fingerprint Edit: To follow up, one of the leading fingerprinting libraries just ignores useragent and uses functionality testing as well: https://github.com/fingerprintjs/fingerprintjs/blob/master/src/utils/browser.ts https://github.com/fingerprintjs/fingerprintjs/blob/master/s...
• radlad 2y ago
  As a counterpoint, I asked Claude to write a script to fetch Claude usage and expose it as a Prometheus metric. As no public API exists, Claude suggested I grab the request from the Network tab. I copied it as cURL, and attempted to run it, and was denied with a 403 from CF. I forgot the script open, polling for about 20 minutes, and suddenly it started working. So even sending all the same headers as Firefox, but with cURL, CF seemed to detect automated access, and then eventually allowed it through anyway after it saw I was only polling once a minute. I found this rather impressive. Are they using subtle timings? Does cURL have an easy-to-spot fingerprint outside of its headers? Reminded me of this attack, where they can detect when a script is running under "curl | sh" and serve alternate code versus when it is read in the browser: https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032
  • schroeding 2y ago
    > Does cURL have an easy-to-spot fingerprint outside of its headers? If it's a https URL: Yes, the TLS handshake. There are curl builds[1] which try (and succeed) to imitate the TLS handshake (and settings for HTTP/2) of a normal browser, though. [1] https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate
    • bennyg 2y ago
      To echo further, they may be leaning on something like the [ja4 fingerprint](https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://github.com/FoxIO-LLC/ja4&ved=2ahUKEwiXyJuy1a2LAxXyJkQIHbDYIsUQFnoECAgQAQ&usg=AOvVaw3wX8T9Oh7e_lhGP-l5sgpQ https://www.google.com/url?sa=t&source=web&rct=j&opi=8997844...) (which you'd need to rebuild curl to emulate that chromium version to try and trick).
      • ghxst 2y ago
        Curl-impersonate does this https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate
  • areyourllySorry 2y ago
    it's possible there was an attack that stopped which led to more lenient antibot
• wongarsu 2y ago
  They are pretending to be an ancient Mozilla version from the time after Netscape but before Firefox, KHTML (which was forked to webkit), Firefox (Gecko engine), Chrome and Safari. The only piece of browser history it's missing is somehow pretending to be IE.
  • mh- 2y ago
    > The only piece of browser history it's missing is somehow pretending to be IE. They're kinda covered because IE also sent Mozilla/5.0 (or 4.0, 2.0, [..]).
  • tibbar 2y ago
    Amusingly, I also just realized that even the operating system is spoofed here! I'm on macOS 14, yet the user agent claims "Mac OS X" 10.15. It's a pretty funny situation, and clearly for the sole benefit of very old websites and libraries performing dubious checks.
    • zerocrates 2y ago
      I don't know if they still do it, but the Apple Silicon Macs also lied about their architecture and said they're Intel. Truth is not the guiding principle of the User-Agent (or all the JS navigator properties, or anything else easy to use to check this kind of thing).
• gloosx 2y ago
  I'm still using Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 on my desktop. The internet is so much better like this! There is a 2010 lightweight mobile version of Google, and m.youtube with obviously cleaner and better UI and not a single ad (apparently it's not worth to show you ads if you still appear to be using iphone 6)
  • leafmeal 2y ago
    I tried this just for fun and youtube said to update my browser :(
    • gloosx 2y ago
      When you click OK it lets you in regardless ;)
  • hexagonwin 2y ago
    This is iOS 6 and not iPhone 6, btw.
    • gloosx 2y ago
      Whoa, really. So it is even back to 3GS/4 days then.
  • anticensor 2y ago
    > (apparently it's not worth to show you ads if you still appear to be using iphone 6) Why not adwall the user instead, showing only ads until they upgrade the device or buy premium?
• christophilus 2y ago
  Slack was doing this with their huddle feature for the longest time (still were last I checked). Drives me crazy.
  • 6031769 2y ago
    Doesn't drive me crazy - gives me a "Get Out of Huddles Free" card.
• Avamander 2y ago
  > I don't know what features Cloudflare uses to determine what browser you're on, or if perhaps it's sophisticated enough to get past the user agent spoofing, but it's all rather funny and reminiscent just the same. Yes, it is, both your TLS and TCP stacks are unique enough that such spoofing can be detected. But there are a lot of other things that can be fingerprinted as well.
• createaccount99 2y ago
  > That means my browser is pretending to be Firefox AND Safari on an Intel chip. That's not the case, that ua is Chrome on MacOS. The rest is backward compatibility garbage
  • tibbar 2y ago
    This is the user agent on Chrome, but the reason for all the references to other browsers (and an old OS and architecture), the backward compatibility garbage, is to pretend to be those browsers for the sake of old websites that are doing string matching on the user agents.