Hacker News Reader

Comment by pde3 | Hacker News Reader

Spoofing your user agent on your own typically makes you easier to fingerprint, not harder. See footnote 3 of the Panopticlick 1.0 paper: https://panopticlick.eff.org/static/browser-uniqueness.pdf

It's more plausible for a large population of browsers to share a single spoofed user agent; all of the Tor Browsers pretend to be a single specific version of Firefox for Windows.

View on HN

I used to spoof user agents, randomly mutating. Then last month I started to run into sites that refused to load/render for incorrect strings. It appears the Google and other large companies are now sending customized versions of their page based on the user agent which I can only speculate is an attempt to save bandwidth. By taking advantage of implementation specific features, they not only eliminate all of the extra JS and browser workarounds, but they also can take shortcuts.

I've been known to do something like this (rejecting unusual UAs) to avoid the added load of rogue scrapers.

How about we get together and decide on a common string that all of us can use? We can set our browsers to use that, and our friends' as well. Theoretically, the more people that use the same string, the harder we'll be to track, correct?

That's right, though it's a bit more difficult. Lots of sites use the User-Agent header to determine how to render a page, and may not render it at all if it's an unexpected value. Pages that allow you to install addons to your browsers also use this string to figure out if you're really running the target browser.

Tor Browser does that:

https://www.torproject.org/projects/torbrowser/design/

Yes! How would you say "I'm a generic modern browser that can interpret HTML5. Do not send me flash."

Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25

Won't that make some websites send you to the mobile version?

What's the desktop equivalent?

JonDo has done exactly that: “Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0”. It hasn’t changed things much, thanks to its relative obscurity and the network effect involved. You should try it out!

Okay, has someone made an extension that lets me pretend to have the most common set of plugins on the most common version of firefox?

Yes, everyone knows you can change the user agent string, but how do you change the list of plugins returned by the browser? Do you have to actually patch the binary?!

navigator.__defineGetter__('plugins', function(){ return new Object(); });

Of course, you'd actually have to do a bit more work to make it bulletproof (otherwise fingerprinters could use the fact that you modified your default navigator object as a way to uniquely identify you !)

I imagine ultimately it's almost impossible to defeat fingerprinters in JS, as they could do tricky stuff like timing attacks to get you.

Use NoScript if you're concerned.

You can set plugins.enumerable_names to the empty string, or to the plugins you want returned. Unfortunately, this was recently removed.[1]

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1169945

This kind of works. Set a UA for all sites.

https://addons.mozilla.org/en-US/firefox/addon/uacontrol/

https://addons.mozilla.org/en-us/firefox/addon/user-agent-js...

String...

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0

Update the string every now and then?

https://techblog.willshouse.com/2012/01/03/most-common-user-...

Disable all plugins.

Best I got, sorry.

You can just use about:config if you're going to update it manually. But that's not nearly the worst part of fingerprinting, with plugins and fonts and apparently webgl, etc.

Is there a way to pretend plugins are disabled when they're on click to play?

I don't think so.

Also, being able to toggle the UA and setup lists to dynamically set it is helpful in my usecase.

What plugins do you have installed? Given Chrome doesn't support NPAPI plugins anymore I'd think nearly all Chrome users would have the exact same plugin list. Firefox is also planning to remove NPAPI plugin support so I except the situation to be similar there in the near-ish future

Reply on news.ycombinator.com