5 ms·
Sadly, touching the user-agent header more or less instantly makes you uniquely identifiable. Browser fingerprinting works best against people with unique head
by johnecheck 1y ago
Sadly, touching the user-agent header more or less instantly makes you uniquely identifiable.
Browser fingerprinting works best against people with unique headers. There's probably millions of people using an untouched safari on iPhone. Once you touch your user-agent header, you're likely the only person in the world with that fingerprint.
- jagged-chisel 1y agoI wouldn’t think the intention is to s/Mozilla// but to select another well-known UA string.
- Arnavion 1y agoThe string I use in my extension is "anubis is crap". I took it from a different FF extension that had been posted in a /g/ thread about Anubis, which is where I got the idea from in the first place. I don't use other people's extensions if I can help it (because of the obvious risk), but I figured I'd use the same string in my own extension so as to be combined with users of that extension for the sake of user-agent statistics.
- CursedSilicon 1y agoIt's a bit telling that you "don't use extensions if you can help it" but trust advice from a 4chan board
- Arnavion 1y agoIt's also a bit telling that you read the phrase "I took it from a different FF extension that had been posted" and interpreted it as taking advice instead of reading source code.
- username135 1y ago4chan, the worlds greatest hacker
- account42 1y agoIt's telling that he understands the difference between taking something he can't fully verify and taking simple hints that improve his understanding?
- deleted 1y ago[deleted]
- soulofmischief 1y agoThe UA will be compared to other data points such as screen resolution, fonts, plugins, etc. which means that you are definitely more identifiable if you change just the UA vs changing your entire browser or operating system.
- throwawayffffas 1y agoI don't think there are any. Because servers would serve different content based on user agent virtually all browsers start with Mozilla/5.0...
- extraduder_ire 1y agocurl, wget, lynx, and elinks all don't by default (I checked). Mainstream web browsers likely all do, and will forever.
- userbinator 1y agoAnubis will let curl through, while blocking any non-mainstream browser which will likely say "Mozilla" in its UA just for best compatibility and call that a "bot"? WTF.
- NoMoreNicksLeft 1y agoI'll set mine to "null" if the rest of you will set yours...
- gabeio 1y agoThe string “null” or actually null? I have recently seen a huge amount of bot traffic which has actually no UA and just outright block it. It’s almost entirely (microsoft cloud) Azure script attacks.
- NoMoreNicksLeft 1y agoI was thinking the string "null". But if you have a better idea.
- account42 1y agoUser-Agent: '; DROP TABLE blocked_bots;
- Arnavion 1y agoUA fingerprinting isn't a problem for me. As I said I only modify the UA for the handful of sites that use Anubis that I visit. I trust those sites enough that them fingerprinting me is unlikely, and won't be a problem even if they did.
- codedokode 1y agoIf your headers are new every time then it is very difficult to figure out who is who.
- kelseydh 1y agoIt is very easy unless the IP address is also switching up.
- spoaceman7777 1y agoyes, but it puts you in the incredibly small bucket of "users that has weird headers that don't mesh well", and makes using the rest of the (many) other fingerprinting techniques all the more accurate.
- JoshTriplett 1y ago> If your headers are new every time then it is very difficult to figure out who is who. https://xkcd.com/1105/ https://xkcd.com/1105/
- heavyset_go 1y agoIt's very easy to train a model to identify anomalies like that.
- johnecheck 1y agoWhile it's definitely possible to train a model for that, 'very easy' is nonsense. Unless you've got some superintelligence hidden somewhere, you'd choose a neural net. To train, you need a large supply of LABELED data. Seems like a challenge to build that dataset; after all, we have no scalable method for classifying as of yet.
- deleted 1y ago[deleted]
- andrewmcwatters 1y agoYes, but you can take the bet, and win more often than not, that your adversary is most likely not tracking visitor probabilities if you can detect that they aren't using a major fingerprinting provider.
- sillywabbit 1y agoIf someone's out to uniquely identify your activity on the internet, your User-Agent string is going to be the least of your problems.
- _def 1y agoNot sure what you mean, as exactly this is happening currently on 99% of the web. Brought to you by: ads
- deleted 1y ago[deleted]
- amusingimpala75 1y agoI think what they meant is: there’s already so many other ways to fingerprint (say, canvas) that a common user agent doesn’t significantly help you
- johnecheck 1y ago'There's so many cliffs around that not jumping off that one barely helps you'. I meeeeeannn... sure? I know that browser fingerprinting works quite well without, but custom headers are actually a game over in terms of not getting tracked.
- MathMonkeyMan 1y agoIf you're browsing with a browser, then there are 1000 ways to identify you. If you're browsing without a browser, then there is at least one way to identify you.
- deleted 1y ago[deleted]