Is It Feasible to Detect Chrome? | Hacker News Reader

Is It Feasible to Detect Chrome?

5 pointsthejohnconway6 comments

Recently, there has been discussion on Google's FLoC trial, and what developers can do you combat it. A lot of discussion is on the opt-out HTTP header, Permissions-Policy: interest-cohort=(), which will disable FLoC for that website.

I think this is a weak response, and would be more interested in getting fewer people to use Chrome in the first place. I have seen people say they are either going to block Chrome entirely from their site, or put a banner up, encouraging people to try something else. I would consider the latter approach, and have done a small amount of research into reliably detecting Chrome, so that I could put a banner on my site. The results are not encouraging.

The problem is that Chrome-based browsers are very difficult to distinguish from Google Chrome itself. User agents are misleading (and Chrome is about to remove them anyway), and all the Javascript feature-detection methods I could find no longer work. Worse still, the situation is like this by design: Brave, for example, is deliberately indistinguishable from Chrome to minimise browser fingerprinting.

So, is there a reasonably reliable way to detect Google Chrome?

I think a nonintrusive banner can help if you want to, but you probably should not deliberately block anything.

Depending what features you need, your web page might work fine with Lynx, and/or with other browsers.

I personally prefer to encourage to disable JavaScripts, by adding a code such as:

  <script>document.write("<p>Note: JavaScripts is not needed for this web page.</p>");</script>

While you can disable FLoC using a header, I have no intention to specify such things in my server. My opinion is that it is up to the user to configure the features that they want, not the web developer. So, I am not disabling it in this way. It is helpful to educate the user about it, though.

(Many things cannot be controlled very well by the user, and some things are badly designed to support such a thing, so a better web browser should be needed to be written. With what my ideas are, using an existing engine probably is not suitable.)

This works for Brave, as Brave enabled user agent change for DDG: https://stackoverflow.com/a/56459333/1459669

Blocking seems a bit unbecoming. Kind of like Google's move.

Perhaps it would be possible to use FLoC against itself?

https://amifloced.org/

Nice idea, but I suspect that Brave and possibly other Chrome-based browsers will spoof a FLoC response to reduce fingerprinting.

Sure they will. Once FLoC is active across most Chrome browsers, so even a simple method should work during the critical transition period (need to stay on top of if, so as not to bother users with fake FLoC browsers).

If FLoC gets adopted, it provides information, so .. maybe it would be possible to guess which FLoCs are genuine with a good enough success rate?

This is a great idea and I would encourage EVERYONE to do this. Please try to push people to privacy respecting browsers like Safari or Firefox. The fewer people use chrome/chromium, and google products in general, the better.

Reply on news.ycombinator.com