News for hackers. Stuff that matters.

A comment on Browser Fingerprinting: A Survey. Parent comment

Re:Browser Fingerprinting: A Survey by Ajedi32 on Monday May 06, 2019 @10:14AM (#19839568)
Is there any reason why we couldn't have all browsers on all platforms use the same user agent header? I realize some sites use the user agent as a crude form of feature detection, but it's my understanding that that's generally considered to be bad practice.
[ Parent | on HN ]
Re:Browser Fingerprinting: A Survey by dumbmatter on Monday May 06, 2019 @11:42AM (#19840410)
Sometimes there are browser bugs that are impossible to do feature detection for, in which case have no better option than looking at the user agent.

For instance, several versions of Firefox had a serious bug in shared workers, which appeared intermittently when users opened your site in multiple tabs https://stackoverflow.com/questions/51092596/feature-detecti... - I had to use the user agent to work around this.

[ Parent | on HN ]
Re:Browser Fingerprinting: A Survey by EastSmith on Monday May 06, 2019 @12:58PM (#19841322)
Sure, this is a fair use case. But then can't the browser tell the end user that someone wants to read this browser data so the user has a chance to say "no"?
[ Parent | on HN ]
Re:Browser Fingerprinting: A Survey by dredmorbius on Tuesday May 07, 2019 @07:35AM (#19848459)
Changing user-agent is virtually always possible, though a vanishingly small fraction of users will do so.

Bundling into adblockers or browsers directly would help.

[ Parent | on HN ]
Re:Browser Fingerprinting: A Survey by wongarsu on Monday May 06, 2019 @10:49AM (#19839908)
Apart from the difficulty of obscuring this information from JavaScript, it's politically impossible.

Chrome could change its header to the header of a competitor or a neural one, but has no reason to (Google's main business is delivering ads). For other big browsers like Firefox and Safari it would be a huge loss to change the header: they would vanish from browser market share statistics, and with that the business case to make websites work well with their browser dwindles. That in turn would reduce their actual market share. That only leaves the browser with a market share so tiny they are ignored by developers, and those browsers do often spoof the user agent header (or at least make it very convenient to do so).

[ Parent | on HN ]