I'm using a mobile browser. I found a program that can fake my User Agent (UA), so I changed to something else.
Is this good practice or bad practice in terms of preserving privacy?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Tools allowing to change the User-Agent are merely debugging tools allowing webmasters to easily check how websites handles requests sent from some clients (for instance by simulating a Google bot or a mobile client).
There are however a very few instances were such tools usage may be somewhat linked to IT security, but hopefully they are merely (very poor) exceptions:
At last some (also poorly developed) websites do not offer the user the choice between the mobile and the desktop version and rely the user-agent to automatically choose a version in place of the user. Faking the user-agent gives back control to the user to choose which version he wants to browse.
As per the malware, if some malware is included on a webpage you visit, it will be downloaded and try to execute itself no matter the user-agent you show. It is how you can end-up with a Firefox on Linux kindly asking you how to open this .exe file he just downloaded from some Chinese URL: the malware executed itself, the Firefox part worked and the payload was downloaded, but the payload was a Windows one which is just garbage on a Linux host ;).
The only last goal of user-agent switching could be tracking issue. Tracking is generally done more effectively using cookies and IP address, so unless you already addressed these two I would not even bother with this. Even if you do, as William rightly explained in its other answer, user-agent faking when not done correctly may also be counter-productive.
For most cases, exploits won't try to determine if a browser is exploitable before trying to run, so the added security from spoofing it is negligible at best. As far as privacy goes, spoofing the user agent may actually be harmful since it would make you almost 100% unique if it was an impossible combination, like a desktop web browser at some odd phone resolution. If you have a common web browser resolution and disable other things that can cause combinations that are usually impossible (fonts, etc.), you may be able to reduce the chances of sites tracking you based on a fingerprint, but otherwise you'll be making it really easy.