4

I'm using a mobile browser. I found a program that can fake my User Agent (UA), so I changed to something else.

Is this good practice or bad practice in terms of preserving privacy?

  • 1
    It may in many cases reduce your fingerprint. Consider however the case were you visit a couple sites in a row that are all tracking you (e.g. for advertising purposes). If your spoofed useragent happens to be something exotic you are going to stick out like a sore thumb (e.g. some central ad server sees that a Solaris workstation accessed a couple sites in some period of time, it is pretty likely that that was the same user). – puzzlepalace Jul 22 '15 at 5:51
0

Tools allowing to change the User-Agent are merely debugging tools allowing webmasters to easily check how websites handles requests sent from some clients (for instance by simulating a Google bot or a mobile client).

There are however a very few instances were such tools usage may be somewhat linked to IT security, but hopefully they are merely (very poor) exceptions:

  • Some D-Link router authentication could be bypassed by using a specially crafted user-agent due to a backdoor present in the firmware,
  • Some poorly developed websites use the user-agent to authorize the access to some content. I remember of a website showing paid content to Google bots for referencing purposes but hiding it for normal unauthenticated users, another showing content limited to mobile phones and requiring a subscription fee for access from a desktop, etc.

At last some (also poorly developed) websites do not offer the user the choice between the mobile and the desktop version and rely the user-agent to automatically choose a version in place of the user. Faking the user-agent gives back control to the user to choose which version he wants to browse.

As per the malware, if some malware is included on a webpage you visit, it will be downloaded and try to execute itself no matter the user-agent you show. It is how you can end-up with a Firefox on Linux kindly asking you how to open this .exe file he just downloaded from some Chinese URL: the malware executed itself, the Firefox part worked and the payload was downloaded, but the payload was a Windows one which is just garbage on a Linux host ;).

The only last goal of user-agent switching could be tracking issue. Tracking is generally done more effectively using cookies and IP address, so unless you already addressed these two I would not even bother with this. Even if you do, as William rightly explained in its other answer, user-agent faking when not done correctly may also be counter-productive.

  • 1
    I already addressed far more than just IP Address and Cookies. Thanks for the answer, but from my experience, there are a lot of software that determine the UA first to pick the correct exploits. I'm simply making sure no adverse effects can be elicited by changing UA. – Mars Jul 22 '15 at 0:43
  • 1
    @Mars It should be OK. Years ago, when browsers from different providers were mostly incompatible the user-agent was used to select the correct style sheet and JavaScript files for your browser and spoofing the browser from another provider could result in unusable websites. Nowadays this should be an old and forgotten story, the only remaining use-case I know being distinguishing between a desktop browser, a mobile one and a search engine bot. In all case, apart from the potential tracking issue, the fact of spoofing the user-agent will certainly not open any weakness on your system. – WhiteWinterWolf Jul 22 '15 at 13:35
2

For most cases, exploits won't try to determine if a browser is exploitable before trying to run, so the added security from spoofing it is negligible at best. As far as privacy goes, spoofing the user agent may actually be harmful since it would make you almost 100% unique if it was an impossible combination, like a desktop web browser at some odd phone resolution. If you have a common web browser resolution and disable other things that can cause combinations that are usually impossible (fonts, etc.), you may be able to reduce the chances of sites tracking you based on a fingerprint, but otherwise you'll be making it really easy.

  • I never said it was usually impossible to fake any of that, I just said it was a combination that was usually impossible. If you see a log with an iPhone with a 5k resolution running Internet Explorer it's going to stand out. – william Jul 21 '15 at 19:31
  • Just keep sure you only spoof mobile browsers on a mobile phone and desktop browsers on a desktop and you should be OK, there are many legit reasons to one spoof it user Agent so i don't think you would "stand out" it will just be logged like the others – Freedo Jul 21 '15 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.