3

What would be the best way to salt a periodically changing useragent string, so as to avert browser fingerprinting?

For example, a useragent string like this:

Mozilla/5.0 (X11; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0

could be salted by appending some random digits, which would change every few minutes, to the revision number:

Mozilla/5.0 (X11; Linux x86_64; rv:50.0483) Gecko/20100101 Firefox/50.0

Would this be effective?

4
  • 3
    If someone is using just the useragent string for browser fingerprinting, they're doing it really badly...
    – Matthew
    Dec 21, 2016 at 16:21
  • @Matthew I've seen implementations adding together a number of things, and then just hashing it. So a small change in any property would be enough to give you a completely different fingerprint. But I guess a lot of implementations are smarter and meassure a "distance".
    – Anders
    Dec 21, 2016 at 16:23
  • Yes, perhaps a better way of avoiding fingerprinting is to not be unique, anyways.…
    – Geremia
    Dec 21, 2016 at 16:27
  • 1
    if you are the only one mucking up the userAgent, all your attempts will stick out in the logs...
    – dandavis
    Dec 22, 2016 at 3:13

2 Answers 2

2

Would this be effective?

No. The fact that you append random digits which may or may not be plausible version numbers makes you actually easier to detect.

If you want to use a forged user-agent string, you should choose from the most common ones. (E.g., from this list.) Any custom modifications will rather attract attention than enhance your privacy. And as @guest lined out, there are also a lot more vectors to identify you than just the UA.

Also, be aware that many pages rely on the user agent for their presentation. With the UA for a different OS and browser you will occasionally encounter broken websites because they serve the wrong scripts or stylesheets.

1

There are dozens of ways to fingerprint a browser. User agent fingerprinting is a very limited way and has fallen out of favor. Furthermore, changing your user agent can actually make you easier to fingerprint, because it will stand out as not matching other identifiers in your browser. You'd be among the only people who have the link preload behavior of Firefox version X, but with the user agent of Y, for example. Additionally, changing every few minutes would cause you to stand out in logs as the only person who's user agent changes. Instead, you'd want to use a common user agent, such as the one Tor Browser uses (the ESR, or stable, extended support release of Firefox).

But there are still countless other ways to fingerprint your browser. Just a few examples:

  • Audio context fingerprinting
  • GPU fingerprinting
  • CPU fingerprinting (architecture, cache size, etc) implemented via side-channels
  • Performance fingerprinting
  • TCP header fingerprinting (not unique to browsers, and even works through VPNs)
  • Canvas fingerprinting (both 2D canvas, and WebGL-accelerated)
  • Keystroke dynamics/mouse dynamics
  • Battery API fingerprinting
  • HTML5/CSS3 feature detection
  • System font fingerprinting
  • Math library fingerprinting through unique cos() and sin() values
  • Plugin fingerprinting
  • Timezone fingerprinting
  • Browser window size and browser border size
  • WebRTC fingerprinting
  • Clock skew fingerprinting
  • Accept headers (compression, language, etc)
  • DNT fingerprinting (yes, DNT can make you unique)
  • Cookie fingerprinting (yes, disabling cookies can make you more unique)
  • History fingerprinting via HSTS (and sometimes CSS, as those bugs are common)
  • Video, audio, and image decoder support

This is not by any means an exhaustive list, and it does not require an expert to implement such fingerprinting techniques. There are free and easy to use fingerprinting tools (and even that implements only a fraction of the known techniques). There are other tools and website out there which implement more techniques, or different techniques.

If you actually want to avoid fingerprinting, use Tor Browser. It mitigates a large subset of these, especially if JavaScript is disabled by setting the security slider to the highest setting. Any custom changes not through the slider (even changing the size of the browser window!) will make you easier to fingerprint. Using anything else will make you extremely easy to identify. Trying to modify your user agent will not just make you more easy to identify, but it will make you stand out as low-hanging fruit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .