How can a "webserver" know (or a sniffer between the srv<->and the client) that what browser i'm using besides the user-agent?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
What exactly do you mean by 'what browser I'm using' - like being able to find if you are using firefox or opera, or do you mean something else?
In any case three projects come to mind
EFF's Panopticlick (paper here): This method is not about finding out what browser are you using but more about identifying who you are among others, by correlating information about you leaking from your browser when visiting a site. Information collected by Panopticlick includes:
Evercookie project There are many different kinds of cookies, like flash cookies, silverlight cookies, html5 databases and DOM globalstorage. More information on the provided link.
BrowserRecon project: This is an older project, similar to panopticlick but older (and not very well known). This is aimed towards finding which browser a user is used, not identifying him among others. It uses large databases that contain observed values (fingerprints) of several http fields (like the user-agent field, the header-order field, the accept field, the keep-alive field and many more). By matching the values of all these different fields when a request comes to a server, the specific browser and it's version can be determined with a high degree of certainty.
On mitigation measures: The last technique can be defeated by using a proxy, which can potentially alter the values of many http fields and so alter the fingerprinting results.
NoScript is of great help for the other techniques, and disabling all unnecessary functionality or only enabling it on whitelisted sites.
You can test your browser against EFF's Panopticlick. The site has quite a lot of information on browser identification.
nmap). This way identifies not only the browser but also the OS, and possibly intermediate network infrastructure (in particular caches).
Hiding what web browser u are using can be really hard as there is usually many ways of discovering what browser you use besides using the user-agent.
For example you can guess what kind of browser you are using by checking in which sequence the HTTP headers values are presented in the header.
This question is very similar to some other questions here:
To try answer how you can hide anyone from knowing what browser you are using I would atleast do the following to throw them off: