7

Going to https://panopticlick.eff.org/ this site knows your exact OS / platform and changing user agent doesn't help because JavaScript is used here.

Is there a way to change / fake it anyway?

I have found a script on this site but it doesn't seem to work

// ==UserScript==
// @name        Faker
// @namespace   x
// @version     1
// @grant       none
// @run-at document-start
// ==/UserScript==

var fake_navigator = {};

for(var i in navigator) {
  fake_navigator[i] = navigator[i];
}

fake_navigator.platform = 'Linux armv7l';

navigator = fake_navigator;

I have tried to run it on Firefox using Greasemonkey but I still keep getting Win32 as my platform (my original one..).

That code is outdated / I run it wrong? Any other ways maybe?

Improve this question
8
  • Does that script run before the detection scripts on the page?
    – Alexander O'Mara
    Commented Dec 31, 2016 at 21:57
  • As far as I know Greasemonkey will run it first on that / any other page. Or do I have to set it up in Greasemonkey? Couldn't find it :s
    – cnmesr
    Commented Dec 31, 2016 at 22:00
  • stackoverflow.com/questions/4978736/…
    – Alexander O'Mara
    Commented Dec 31, 2016 at 22:03
  • @AlexanderO'Mara thank you for this link. It's saying that I need to add "@run-at document-start". Do I just add this in the code above, first line?
    – cnmesr
    Commented Dec 31, 2016 at 22:07
  • In the meta data comments.
    – Alexander O'Mara
    Commented Dec 31, 2016 at 22:08

5 Answers 5

Reset to default
7

The navigator object is accessed via window.navigator which is in fact a read-only property.

Therefore navigator = fake_navigator; will not work.

However, it is possible to redefine the getter for platform:

navigator.__defineGetter__('platform', function(){
    return 'foo' // customized user agent
});

Querying the property will then return the value within the function.

window.navigator.platform
"foo"

This will fake your platform as far as the JavaScript property is concerned, but Panopticlick is about fingerprinting your browser as a whole, not just taking one property and identifying you through that. Therefore, if you are doing this for privacy reasons then I would not recommend this as an effective measure.

Improve this answer
4
  • 2
    Bear in mind that Object.getOwnPropertyDescriptor(navigator, 'platform') will reveal that you have overridden the getter, so you're playing in a sort of arms race against the developers. i.e. They might in future use this as part of their fingerprinting.
    – SilverlightFox
    Commented Jan 2, 2017 at 18:49
  • Interesting idea.
    – wogsland
    Commented Mar 2, 2017 at 16:20
  • Thats' code works pretty well this is Userscript JS file pastebin.com/raw/wR6k1GvD
    – Salem F
    Commented Jan 12, 2022 at 22:57
  • It can be easily detected by if( Object.getOwnPropertyNames(navigator)[0] ) alert('fake parameters detected');
    – Eugene
    Commented Jan 14 at 22:20
4

With the new technologies introduced in Chrome, Firefox, Edge, Opera... the last few years, you have no way to control your privacy. things was made to break your privacy and bring you better services than flash for example, which is worse.

For exemple, Webrtc: you can t spoof webrtc, you can only disable it. If you block webrtc then a server with 1000 normal users and you with the disabled webrtc! that's means you'r already identified.

This is only 1 thing of 1001 things you have to spoof, disable or you can t spoof nor disable :/ conclusion: you cannot trust what you know, and you know only what you already know, so the best way to hide your identity today is to not hide your identity. or to become an engineer of the field.

Improve this answer
1

You describe a method called fingerprinting. Using JavaScript or Flash, they get detailed info about various properties of your system and make a most likely unique hash that identifies you and your system. Note, that user agent spoofing for example does not help, as even empty user agents make your data more unique. Your goal here is, either to continuously change your identity by making as many options change per request as possible (there are plugins for that), or use the most common configuration in the world, so you don't get a unique fingerprint. I'm thinking about the most widely used subversion of the most used browser with no plugins and the most common operating system, color depth, screen / window size, etc. Some of these can actually be changed using plugins, some don't.

Improve this answer
0

You said you want to change it, but does it have to be Javascript only? If Javascript, you may want to visit StackOverflow as that would be beyond the scope of this site.

If Javascript code is not required, and you just want any way to do this, then yes, you can use Random Agent Spoofer. It's best used with NoScript, and uBlock Origin. This can become a micromanaging nightmare, though.

You will, however, need to configure the options for Random Agent Spoofer. You'll have to disable WebRTC, webGL, limit detectable fonts, etc. Configure this until you have an appropriately-tinfoiled setup.

Improve this answer
0

If all you want is to fake their OS detection, it is quite simple. Remember, as soon as it runs on your machine, remote can be abused. The key here is to deactivate javascript and manually send the query that the javascript code would have sent.

Depending on the complexity of the script, you may have to first use a javascript debugger such as the one included in Firefox to understand exactly what the script sends to the host, and then some code (Python or... local javascript!) to send a faked answer. Nice OS do send back are Windows12 (increase when time passes), DOS/2.10, CP/M, Amiga...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .