1

I'm trying to understand how can recaptcha__en.js detect fake User-Agent, for the test you can try the demo here with addon User-Agent switcher installed, for logged in user it will get score 0.9 no matter what is The UA but here here Score I get without logged in:

  1. Fresh Old firefox 46, Original UA: 0.3 - 0.7
  2. Updated browser with Original UA: 0.3 - 0.7
  3. Updated browser with spoofed UA: 0.1

As you can see even with updated browser but If I change the UA it will get score 0.1 or marked as bot/spam, so is there other way to detect user-agent other than javascript variable navigator or how can recaptcha detect fake UA?

4

Certain browsers have certain features. The service runs JavaScript they provide you, so they can run a lot of feature tests in the actual browser. This can be used to validate your userAgent string.

For example (purely hypothetical), if everyone knows that Chrome after v50 supports CSS variables, and any Chrome after v40 no longer support the old vibration API, but your browser claims to be v55 and seems to support both features, you're busted. A quick visit to https://caniuse.com/ offers numerous "smoking guns" one could use to detect such version/feature correlation.

There's also a lot of web APIs that only one or another browser supports, like -ms-browse CSS and microsoft browsers. This is basically the reverse of the web developer advice "don't browser detect, feature detect for forward compatibility". By doing both, recaptha can spot liars, unless you're so good at spoofing (altering JS and DOM internals along the way) that you might as well be using the browser you are pretending to be, and at that point it can't/won't care.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.