1

One fingerprinting element is the browser's user-agent string. If we consider one browser, Firefox, we can see that it has different strings across different OSes, distros, forks (Tor, IceCat) and versions. Some of these populations would be very small (say, Guix SD users running the latest version of IceCat) and therefore individuals within those populations would be more easily identified (in combination with other data).

Has there been any attempt to coordinate user-agent strings among these communities? (Or resistance to such an attempt.)

3 Answers 3

1

Existing user-agent strings for popular releases would be de facto coordinated standards. These could include (in assumed order of popularity):

  • Latest Windows Chrome release
  • Latest Windows Firefox release
  • Latest Ubuntu LTS Firefox release
  • Latest Ubuntu Firefox release
  • Latest Debian Tor release

...but for greatest effectiveness smaller communities would still need to coordinate around one of these, and pick an UA that has limited/no effect on usability (sites that still sniff for browser compatibility).

1
  • "...but for greatest effectiveness smaller communities would still need to coordinate around one of these..." - this is a claim without explanation. And so far I don't understand why communities need to agree which of the major UA strings they just reuse. Apart from that as @Dr_Bunsen said: the UA string is the least of the problem for fingerprinting. Sep 20, 2017 at 17:02
1

The user agent is the least of your worries. Since with JS enabled you can ask almost anything a browser gives access too. You can fingerprint by

  • Installed extensions
  • Fonts
  • render times of certain objects
  • cookies
  • http accept header
  • content encoding
  • platform
  • do not track header
  • time zone
  • resolution
  • canvas
  • ad blocker

I am forgetting a lot more, but merely changing the user agent is not stopping the other data from being leaked.

Check here for a fingerprint or eff fingerprinter.

EDIT:

Also blocking users based on their user agent would only block those who do not know how to change the user agent.

0

There is a new feature in development regarding fingerprint protection in Firefox:

https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting

Among other features, it alters the user agent to something like this:

Mozilla/5.0 (Windows NT 10.0; rv:110.0) Gecko/20100101 Firefox/110.0

Which is a lot more generic than my actual user agent string.

You can enable it in about:config by setting the flag privacy.resistFingerprinting to true.

In my case it made my fingerprint information a lot less unique according to this test: https://amiunique.org/fp

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .