4 ms·

On this note, is it possible to completely remove my user agent entirely from all my browsers? I'd like to get to the point where the only identifying informat

On this note, is it possible to completely remove my user agent entirely from all my browsers? I'd like to get to the point where the only identifying information my computer gives out about me is information I give out about myself. At the end of the day I shouldn't even suffer as a user because of this because if sites are "doing things right" then they shouldn't be using the user agent for anything at all anymore. They should be using feature testing only. Since it's been such a useless feature for so long, I'm surprised no browser makers have gone as far as removing it entirely (I'm looking at you chrome and firefox)

SEMW 13y ago
If your goal is to eliminate information that can be used to identify and track you, being the only person on the internet with an empty useragent string may be somewhat less than ideal... https://panopticlick.eff.org/self-defense.php https://panopticlick.eff.org/self-defense.php has some strategies.
patejam 13y ago
It hasn't been removed because of exactly what you say; it would break a lot of sites. If it is a change that breaks a good portion of the web, they rightfully shouldn't make that change.
ryalfalpha 13y ago
You can fake it with a number of extensions, but there's a load of fingerprinting options that are sneakier than the user agent. The Tor Browser project has a document outlining changes they had to make to make things less fingerprintable.
lylepstein 13y ago
There's still a lot of differing behavior in modern browsers that a feature check doesn't expose. Bugs, quirks, performance characteristics (e.g. slow SVG animation in Firefox), and just plain divergences from the spec. HTML5 media is my favorite example of this: mobile devices will actually straight up lie to you when you call certain methods. If you're making even moderate use of any HTML5 features, you're going to end up doing user agent sniffing.
Spittie 13y ago
You probably don't want to send blank information for everything, this could make you more easily traceable. Just like disabling cookies/javascript might actually decrease your anonymity. If you use Firefox, you can install something like Blender (https://addons.mozilla.org/it/firefox/addon/blender-1/ https://addons.mozilla.org/it/firefox/addon/blender-1/) which fakes your data to some common data (to make you "blend" in the crowd). Now I digress, but I suggest disabling (or use click2play) plugins, as they leak a lot of informations about you. For cookies (which are used a lot for tracking), you can install something like Self-Distructing Cookies (https://addons.mozilla.org/it/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/it/firefox/addon/self-destructing...), which accept cookies (like most browsers do), but delete them when you close the tab. Don't forget something like RefControl (https://addons.mozilla.org/it/firefox/addon/refcontrol/)/ https://addons.mozilla.org/it/firefox/addon/refcontrol/)/ Smart Referer (https://addons.mozilla.org/it/firefox/addon/smart-referer/ https://addons.mozilla.org/it/firefox/addon/smart-referer/), as the referer can be used to track you. And the classic Disconnect.me (https://www.disconnect.me/ https://www.disconnect.me/) or AdBlock + EasyPrivacy (https://easylist.adblockplus.org/en/ https://easylist.adblockplus.org/en/). See, privacy/anonymity on the web requires a lot more than just disabling the useragent. There are several other ways to track you, and it might have some legit uses (for example, serve you the right software for your operative system, I don't think there's a javascript api to recognize your os). It might be a good start, but it wouldn't help a lot, and it would break a lot of legacy code.
JohnTHaller 13y ago
Disabling the useragent may break some stuff that many sites still do server-side. Disabling referer may break downloads and images on many sites. You'd think they'd all be able to support blank or non-existent referrers, but many large CDNs only support whitelisting specific REFERER strings (not blank ones). We'll be turning referrer blocking back on for one of my big sites shortly because we have other sites linking directly to file downloads (of 60MB and up) and hotlinking images.
- sdoering 13y ago
  Yes. For example, it disables graphs in Google Analytics. They do not work, if your useragent is empty or if it is Googlebot 2.1 ;-)
Daniel_Newby 13y ago
The user agent is useful for debugging. If users of a certain browser never submit a form, the site owner needs to know. Anyway, feature testing and benchmarking can be used to create a user agent fingerprint. Hiding the user agent header just keeps it "secret" for a few weeks until the big trackers all switch to fingerprinting. Just give up on hiding identifying information. The promiscuous model used by web technologies is not securable. For instance, timing analysis can be used to determine which sites you have recently visited.

SEMW 13y ago

If your goal is to eliminate information that can be used to identify and track you, being the only person on the internet with an empty useragent string may be somewhat less than ideal... https://panopticlick.eff.org/self-defense.php https://panopticlick.eff.org/self-defense.php has some strategies.

patejam 13y ago

It hasn't been removed because of exactly what you say; it would break a lot of sites. If it is a change that breaks a good portion of the web, they rightfully shouldn't make that change.

ryalfalpha 13y ago

You can fake it with a number of extensions, but there's a load of fingerprinting options that are sneakier than the user agent. The Tor Browser project has a document outlining changes they had to make to make things less fingerprintable.

lylepstein 13y ago

There's still a lot of differing behavior in modern browsers that a feature check doesn't expose. Bugs, quirks, performance characteristics (e.g. slow SVG animation in Firefox), and just plain divergences from the spec. HTML5 media is my favorite example of this: mobile devices will actually straight up lie to you when you call certain methods. If you're making even moderate use of any HTML5 features, you're going to end up doing user agent sniffing.

Spittie 13y ago

You probably don't want to send blank information for everything, this could make you more easily traceable. Just like disabling cookies/javascript might actually decrease your anonymity. If you use Firefox, you can install something like Blender (https://addons.mozilla.org/it/firefox/addon/blender-1/ https://addons.mozilla.org/it/firefox/addon/blender-1/) which fakes your data to some common data (to make you "blend" in the crowd). Now I digress, but I suggest disabling (or use click2play) plugins, as they leak a lot of informations about you. For cookies (which are used a lot for tracking), you can install something like Self-Distructing Cookies (https://addons.mozilla.org/it/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/it/firefox/addon/self-destructing...), which accept cookies (like most browsers do), but delete them when you close the tab. Don't forget something like RefControl (https://addons.mozilla.org/it/firefox/addon/refcontrol/)/ https://addons.mozilla.org/it/firefox/addon/refcontrol/)/ Smart Referer (https://addons.mozilla.org/it/firefox/addon/smart-referer/ https://addons.mozilla.org/it/firefox/addon/smart-referer/), as the referer can be used to track you. And the classic Disconnect.me (https://www.disconnect.me/ https://www.disconnect.me/) or AdBlock + EasyPrivacy (https://easylist.adblockplus.org/en/ https://easylist.adblockplus.org/en/). See, privacy/anonymity on the web requires a lot more than just disabling the useragent. There are several other ways to track you, and it might have some legit uses (for example, serve you the right software for your operative system, I don't think there's a javascript api to recognize your os). It might be a good start, but it wouldn't help a lot, and it would break a lot of legacy code.

JohnTHaller 13y ago

Disabling the useragent may break some stuff that many sites still do server-side. Disabling referer may break downloads and images on many sites. You'd think they'd all be able to support blank or non-existent referrers, but many large CDNs only support whitelisting specific REFERER strings (not blank ones). We'll be turning referrer blocking back on for one of my big sites shortly because we have other sites linking directly to file downloads (of 60MB and up) and hotlinking images.

sdoering 13y ago
Yes. For example, it disables graphs in Google Analytics. They do not work, if your useragent is empty or if it is Googlebot 2.1 ;-)

Daniel_Newby 13y ago

The user agent is useful for debugging. If users of a certain browser never submit a form, the site owner needs to know. Anyway, feature testing and benchmarking can be used to create a user agent fingerprint. Hiding the user agent header just keeps it "secret" for a few weeks until the big trackers all switch to fingerprinting. Just give up on hiding identifying information. The promiscuous model used by web technologies is not securable. For instance, timing analysis can be used to determine which sites you have recently visited.