16

I am currently trying to mask the OS system I am using from the websites I visit. I'm doing this for an added layer of security. How would I go about hiding the OS from websites?

  • That depends. Usually, the exact Linux distribution cannot be pinpointed; a server can make predictions based on the TTLs set by the TCP stack of the operating system though. – Tobi Nary Nov 10 '17 at 20:47
  • Not a comprehensive answer: start by making sure that you change your user agent: howtogeek.com/113439/… – Conor Mancone Nov 10 '17 at 21:28
  • Thank you @ConorMancone that's exactly the kind of thing I was looking for. Is there any way to do this for my OS system? – Berrik Nov 10 '17 at 21:37
  • how your DNS queries are done may be a factor in revealing what OS you probably are using. i once saw a site reveal back to me what my OS was in just a TXT record without ever connecting to the web site. – Skaperen Nov 14 '17 at 6:51
15
+150

It is not currently possible to hide the type of OS from a website

A solution against general fingerprinting and obtaining more specific information about your system is to use Tor Browser with the security slider set to high (in order to disable JavaScript). It is designed with fingerprint resistance in mind, attempting to look identical to all other instances of the browser. It provides resistance in several ways:

  • Unlike a regular connection or a VPN, Tor exposes the network stack of the exit node, not of your own computer, so you do not have to mess with advanced TCP option mangling firewalls or modify low-level networking code in your operating system.

  • With JavaScript disabled, system-specific behavior like high resolution math libraries (certain trigonometry functions give unique results for each operating system) and data formatting functions (which format the data in an OS-specific way).

  • The user agent is standardized. There is no way to know what the underlying system is from just the user agent itself. Changing the user agent randomly makes you stand out as one of the few people doing it, so using a standard one is preferred.

  • The default window size is standardized, so CSS and JS functions which obtain the window size cannot guess your operating system based on things like the size of your task bar.

However, the task of preventing the general type of operating system from being known is currently impossible, even on Tor Browser. A list of whitelisted fonts is provided in order to prevent font rendering exploitation or font fingerprinting, but the whitelist is different for Linux, OSX, and Windows due to needing to use system fonts. There is currently no way around this. Until you find a way to provide system fonts without revealing what type of operating system you are using, you'll have no lock.

Also note that EFF's Panopticlick is only meant to bring awareness to the issue of fingerprinting. It is extremely limited in what signatures it looks for, and does not analyze a representative sample. You should instead look into https://amiunique.org/, which was designed from the current most extensive research into browser fingerprinting.

How does fingerprinting work in general?

While it is not possible to hide the general class of operating system you are running, you can make it so that you blend in with the so-called "anonymity set". A list of ways you can fingerprint a browser, with some notes, in case it is helpful:

  • TCP/IP stack fingerprinting - The TCP protocol provides some extra extensions changing its behavior such as window size (unrelated to browser window size), max segment size (MSS), time-to-live (TTL), and others. It is also padded by a nop option which does nothing but make sure the size of the options are consistent. Different classes of operating systems use different values. Linux for example sets the TTL to 64, whereas Windows uses 255. Additionally, the order of these options and where the nops are inserted differs from OS to OS.

  • Generic settings exposed by the browser - Certain things like the order of headers and the headers themselves can uniquely identify a browser. This includes thing like the system locale, DNT status, cookie status, etc. This is effectively all EFF's Panopticlick looks for, and a small subset at that.

  • WebGL fingerprinting - When certain types of hardware acceleration are enabled, the browser gets low-level access to your GPU. By telling the GPU to generate certain 3D shapes with special graphical properties (textures, light, transparency, etc) and applying various transforms to it and then hashing the resulting pixmap, quirks unique to your specific GPU can be identified. This allows a browser to be identified regardless of the operating system it is run as.

  • Audiocontext fingerprinting - Similar to WebGL fingerprinting, the browser can be told to generate triangle wave audio, then compress it, then increase gain and hash the resulting audio buffer. This hash will be unique to your system, regardless of what you have booted into. There is no need for the audio to actually be played for this to work.

  • Timezone fingerprinting - The system's timezone as set in environmental variables is available via JavaScript.

  • Math library fingerprinting* - When certain trigonometry functions are used, such as calculating the sin of the value 10, the system's math library is called, and this differs for each OS. It will likely be the same among classes of operating systems.

  • Canvas fingerprinting** - By generating a visual canvas element and hashing it, results unique to your browser can be obtained.

  • Window size fingerprinting** - The CSS @media elements can be used to selectively load resources based on the (often unique) size of the browser window. A website can create a large number of resources and see which ones your browser loads to tell the window size.

  • Font list fingerprinting - Your font list is often fairly unique, and differs between different OSes. As mentioned earlier, there is no practical way to avoid this. Keeping a list of whitelisted system fonts reduces the fingerprinting accuracy to the general class of OS you are running.

  • Date format fingerprinting* - If you call Date().toLocaleFormat() in the browser, the output string will depend on the operating system you are using. The output on Linux, OSX, and Windows 7 respectively is "Thu 26 Mar 2015 03:43:35 PM EDT", "Thu Mar 26 15:38:55 2015", and "Thursday, March 26, 2015 3:45:01 PM".

  • Virtual core fingerprinting* - The hardwareConcurrency JavaScript feature can be used to automatically spawn a number of threads for performance. By starting with one and increasing it gradually, while giving the browser a CPU-heavy workload, the number of virtual cores can be guessed based on the point at which more threads no longer improve performance.

* Tor Browser only mitigates these if JavaScript is disabled.

** Tor browser mitigates these with help from the user, so the user must follow its recommendations.

  • Ahh so font permissions give away the OS. Interesting stuff! Is there a work around in Ubuntu to spoof a different systems fonts? (like installing Ubuntu restricted extras) – Berrik Nov 13 '17 at 10:14
  • I don't believe so. You'd have to include all the proprietary fonts from Windows, and only those fonts. Restricted extras just adds a few new ones that have questionable licenses. – user163629 Nov 13 '17 at 10:54
  • 2
    Wow. I had no idea browser fingerprinting had so many different avenues. I wonder how many websites/applications (probably primarily advertising related ones) go to the trouble of diving to this level of detail to track users. Are these the sorts of techniques used to, for instance, track people if they enter incognito mode? I've heard that such things are possible, but I'm not familiar with the details. Are you aware of any third-party tools that can be used for the opposite side of this problem: handling these details to aid in identifying/tracking users? – Conor Mancone Nov 13 '17 at 13:03
  • Yes, this can be used for tracking people in incognito/private mode. Some advertising companies do this. As for tools to identify users, there are a few PoCs here and there on github. Not sure off the top of my head if there are any complete "solutions" that are available to the public. – forest Dec 13 '17 at 6:18
11

So, there is different information leaking when requesting a website (from the user agent, the source port of your TCP connection to the TTL on your TCP packets.

A few good steps in the right direction are:

  • Changing your user-agent string that is sent with every request with your browser,
  • disable JavaScript and other script languages,
  • use a multi-platform browser,
  • use a TCP stack that does not allow to identify the operating system.

While the last point is hard to do without changing the operating system, the others are “just” reducing usability.

The biggest impact might be cause by the change of the user-agent string, because that is often logged by web servers, yet disabling scripting languages will have a big impact as well.

As the comments point out, hiding your operating system is not the same as gaining privacy; the opposite is the case. While a proxy server might fix most of this, there is no good way to gain privacy without losing a lot of comfort. Cookies and JavaScript make it easy to identify you and to disable them renders the web a pretty useless place.

  • I've been surfing without JavaScript for forever now, and if you delete cookies after closing tabs and disable third-party cookies, identification via cookies shouldn't be as easy. Yes, usability is a bit constrained. But when I see that list of blocked content and trackers, I know why I do this. And: you can always use another browser if you really want to visit that website that just needs JavaScript. – Tom K. Nov 13 '17 at 10:53
  • -1 for "Changing your user-agent string". This increases your fingerprint, sometimes dramatically, by creating a quite visible disconnect between the claimed browser identity and the actual behavior of the browser. The AmIUnique PoC tests are able to demonstrate this. – forest Apr 29 '18 at 11:49
  • @forest thank you for your input. This only is true for some changes. – Tobi Nary Apr 29 '18 at 11:51
  • Changing it on your own rather than using a standard user agent (such as what Tor browser does) will cause this discrepancy. HTML5 feature detection for example gives away your actual user agent even without you explicitly sending it, so changing your user agent (no matter how random you make it) will add another fingerprinting signature. This signature is significantly bigger if you change your UA with every request, rather than keeping it constant. – forest Apr 29 '18 at 11:52
4

The EFF (Electronic Freedom Frontier) have produced a "how unique is my web configuration" page for several years, https://panopticlick.eff.org

You can see just how unique you are. The results will be quite worrying I suspect.

A Web Server will usually try and attempt to understand which OS you are using by using a browser fingerprint.

They possibly can use some Javascript code that exploits known issues with say Windows 7 and html, or Mac and some other html calls.

The Web server could also - use a cookie that identifies you from an earlier session, or could try and IP range guess (although that seems a little unlikely as NAT for clients is much more widespread).

This issue has been around for at least the past 3 years, and there have been quite a few reports suggesting some commercial websites do this to alter the pricing.

Please see https://www.cnet.com/news/mac-users-pay-more-than-pc-users-says-orbitz/

It suggests, Mac users are charged more (aprox $30), than Windows users; I am guessing that the cost of Mac hardware indicates more disposable income.

Finally if you want to download and confuse Web Servers, the wonderful wget command line utility will allow you to fake your connection.

You can get more on this at http://www.danielmayor.com/how-to-fake-a-browser-connection-with-wget

  • 1
    Hi Tim, thanks for the additional information. For some reason the link to Daniel Mayor's site doesn't work. Not too sure why. – Berrik Nov 11 '17 at 15:27
  • Bernik - I just opened the link danielmayor.com/how-to-fake-a-browser-connection-with-wget now .... However you can google the wget "http header" stuff there is plenty of info around. If you are truly paranoid - I suggest you use wireshark, and look at the headers that are being exchanged - as there still could be something that identifies your OS. – Tim Seed Nov 12 '17 at 4:15
  • I think it was the browser type that I was using. Changed browser and it worked. Thanks again for the help! – Berrik Nov 13 '17 at 10:12
0

If you want another extra layer of privacy to TOR or your VPN, you can try a project called Tails.

It's a Debian-based OS, it fits on a USB stick, and aims at:

It aims at preserving your privacy and anonymity, and helps you to:

  • use the Internet anonymously and circumvent censorship; all connections to the Internet are forced to go through the Tor network;
  • leave no trace on the computer you are using unless you ask it explicitly;
  • use state-of-the-art cryptographic tools to encrypt your files, emails and instant messaging.

N.B

This OS won't hide you from a fingerprint check on the Internet. However, it will hide some information, like MAC address vendor, in other cases: a Local network scan. Tails MAC address spoofing

Here is a SO question regarding Tails and fingerprints How does tails Linux protect your device fingerprint?

Here is a list of other privacy focused OSs.

  • While this might leave a small footprint on the internet it doesn't completely hide the OS system that will likely show up as "Debian-based OS". Completely hiding the OS type is what I am looking for! – Berrik May 31 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.