News for hackers. Stuff that matters.
Re:Your user agent by malandrew on Sunday November 03, 2013 @07:00PM (#6665754)
On this note, is it possible to completely remove my user agent entirely from all my browsers?

I'd like to get to the point where the only identifying information my computer gives out about me is information I give out about myself.

At the end of the day I shouldn't even suffer as a user because of this because if sites are "doing things right" then they shouldn't be using the user agent for anything at all anymore. They should be using feature testing only.

Since it's been such a useless feature for so long, I'm surprised no browser makers have gone as far as removing it entirely (I'm looking at you chrome and firefox)

Re:Your user agent by Spittie on Sunday November 03, 2013 @07:17PM (#6665850)
You probably don't want to send blank information for everything, this could make you more easily traceable. Just like disabling cookies/javascript might actually decrease your anonymity.

If you use Firefox, you can install something like Blender (https://addons.mozilla.org/it/firefox/addon/blender-1/) which fakes your data to some common data (to make you "blend" in the crowd).

Now I digress, but I suggest disabling (or use click2play) plugins, as they leak a lot of informations about you.

For cookies (which are used a lot for tracking), you can install something like Self-Distructing Cookies (https://addons.mozilla.org/it/firefox/addon/self-destructing...), which accept cookies (like most browsers do), but delete them when you close the tab.

Don't forget something like RefControl (https://addons.mozilla.org/it/firefox/addon/refcontrol/)/ Smart Referer (https://addons.mozilla.org/it/firefox/addon/smart-referer/), as the referer can be used to track you.

And the classic Disconnect.me (https://www.disconnect.me/) or AdBlock + EasyPrivacy (https://easylist.adblockplus.org/en/).

See, privacy/anonymity on the web requires a lot more than just disabling the useragent. There are several other ways to track you, and it might have some legit uses (for example, serve you the right software for your operative system, I don't think there's a javascript api to recognize your os). It might be a good start, but it wouldn't help a lot, and it would break a lot of legacy code.

Re:Your user agent by SEMW on Sunday November 03, 2013 @07:05PM (#6665786)
If your goal is to eliminate information that can be used to identify and track you, being the only person on the internet with an empty useragent string may be somewhat less than ideal...

https://panopticlick.eff.org/self-defense.php has some strategies.

Re:Your user agent by ryalfalpha on Sunday November 03, 2013 @07:09PM (#6665818)
You can fake it with a number of extensions, but there's a load of fingerprinting options that are sneakier than the user agent. The Tor Browser project has a document outlining changes they had to make to make things less fingerprintable.
Re:Your user agent by JohnTHaller on Sunday November 03, 2013 @07:28PM (#6665886)
Disabling the useragent may break some stuff that many sites still do server-side.

Disabling referer may break downloads and images on many sites. You'd think they'd all be able to support blank or non-existent referrers, but many large CDNs only support whitelisting specific REFERER strings (not blank ones). We'll be turning referrer blocking back on for one of my big sites shortly because we have other sites linking directly to file downloads (of 60MB and up) and hotlinking images.

Re:Your user agent by sdoering on Monday November 04, 2013 @05:34AM (#6667852)
Yes. For example, it disables graphs in Google Analytics. They do not work, if your useragent is empty or if it is Googlebot 2.1 ;-)
Re:Your user agent by lylepstein on Sunday November 03, 2013 @07:13PM (#6665840)
There's still a lot of differing behavior in modern browsers that a feature check doesn't expose. Bugs, quirks, performance characteristics (e.g. slow SVG animation in Firefox), and just plain divergences from the spec.

HTML5 media is my favorite example of this: mobile devices will actually straight up lie to you when you call certain methods.

If you're making even moderate use of any HTML5 features, you're going to end up doing user agent sniffing.

Re:Your user agent by patejam on Sunday November 03, 2013 @07:06PM (#6665797)
It hasn't been removed because of exactly what you say; it would break a lot of sites. If it is a change that breaks a good portion of the web, they rightfully shouldn't make that change.
Re:Your user agent by Daniel_Newby on Sunday November 03, 2013 @09:53PM (#6666476)
The user agent is useful for debugging. If users of a certain browser never submit a form, the site owner needs to know.

Anyway, feature testing and benchmarking can be used to create a user agent fingerprint. Hiding the user agent header just keeps it "secret" for a few weeks until the big trackers all switch to fingerprinting.

Just give up on hiding identifying information. The promiscuous model used by web technologies is not securable. For instance, timing analysis can be used to determine which sites you have recently visited.