4

Going to https://panopticlick.eff.org/ this site knows your exact OS / platform and changing user agent doesn't help because JavaScript is used here.

Is there a way to change / fake it anyway?

I have found a script on this site but it doesn't seem to work

// ==UserScript==
// @name        Faker
// @namespace   x
// @version     1
// @grant       none
// @run-at document-start
// ==/UserScript==

var fake_navigator = {};

for(var i in navigator) {
  fake_navigator[i] = navigator[i];
}

fake_navigator.platform = 'Linux armv7l';

navigator = fake_navigator;

I have tried to run it on Firefox using Greasemonkey but I still keep getting Win32 as my platform (my original one..).

That code is outdated / I run it wrong? Any other ways maybe?

  • Does that script run before the detection scripts on the page? – Alexander O'Mara Dec 31 '16 at 21:57
  • As far as I know Greasemonkey will run it first on that / any other page. Or do I have to set it up in Greasemonkey? Couldn't find it :s – cnmesr Dec 31 '16 at 22:00
  • @AlexanderO'Mara thank you for this link. It's saying that I need to add "@run-at document-start". Do I just add this in the code above, first line? – cnmesr Dec 31 '16 at 22:07
  • In the meta data comments. – Alexander O'Mara Dec 31 '16 at 22:08
3

The navigator object is accessed via window.navigator which is in fact a read-only property.

Therefore navigator = fake_navigator; will not work.

However, it is possible to redefine the getter for platform:

navigator.__defineGetter__('platform', function(){
    return 'foo' // customized user agent
});

Querying the property will then return the value within the function.

window.navigator.platform
"foo"

This will fake your platform as far as the JavaScript property is concerned, but Panopticlick is about fingerprinting your browser as a whole, not just taking one property and identifying you through that. Therefore, if you are doing this for privacy reasons then I would not recommend this as an effective measure.

  • 1
    Bear in mind that Object.getOwnPropertyDescriptor(navigator, 'platform') will reveal that you have overridden the getter, so you're playing in a sort of arms race against the developers. i.e. They might in future use this as part of their fingerprinting. – SilverlightFox Jan 2 '17 at 18:49
  • Interesting idea. – wogsland Mar 2 '17 at 16:20
3

With the new technologies introduced in Chrome, Firefox, Edge, Opera... the last few years, you have no way to control your privacy. things was made to break your privacy and bring you better services than flash for example, which is worse.

For exemple, Webrtc: you can t spoof webrtc, you can only disable it. If you block webrtc then a server with 1000 normal users and you with the disabled webrtc! that's means you'r already identified.

This is only 1 thing of 1001 things you have to spoof, disable or you can t spoof nor disable :/ conclusion: you cannot trust what you know, and you know only what you already know, so the best way to hide your identity today is to not hide your identity. or to become an engineer of the field.

1

You describe a method called fingerprinting. Using JavaScript or Flash, they get detailed info about various properties of your system and make a most likely unique hash that identifies you and your system. Note, that user agent spoofing for example does not help, as even empty user agents make your data more unique. Your goal here is, either to continuously change your identity by making as many options change per request as possible (there are plugins for that), or use the most common configuration in the world, so you don't get a unique fingerprint. I'm thinking about the most widely used subversion of the most used browser with no plugins and the most common operating system, color depth, screen / window size, etc. Some of these can actually be changed using plugins, some don't.

0

You said you want to change it, but does it have to be Javascript only? If Javascript, you may want to visit StackOverflow as that would be beyond the scope of this site.

If Javascript code is not required, and you just want any way to do this, then yes, you can use Random Agent Spoofer. It's best used with NoScript, and uBlock Origin. This can become a micromanaging nightmare, though.

You will, however, need to configure the options for Random Agent Spoofer. You'll have to disable WebRTC, webGL, limit detectable fonts, etc. Configure this until you have an appropriately-tinfoiled setup.

0

If all you want is to fake their OS detection, it is quite simple. Remember, as soon as it runs on your machine, remote can be abused. The key here is to deactivate javascript and manually send the query that the javascript code would have sent.

Depending on the complexity of the script, you may have to first use a javascript debugger such as the one included in Firefox to understand exactly what the script sends to the host, and then some code (Python or... local javascript!) to send a faked answer. Nice OS do send back are Windows12 (increase when time passes), DOS/2.10, CP/M, Amiga...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.