User.js: [Improvement] general.useragent.vendor

[Anyon3]

Hello,

Nice idea this git repo.

Using it, I have spotted the following preference in about:config

general.useragent.vendor

This contain the OS name (for Linux, the name of the distribution), I did not look more far to known if this pref is active or already disabled using the latest user.js

I changed it by a common value "Windows". Hope this information is useful (if not just close this issue)

Thanks

[pyllyukko]

Hi.

Related issue: #193

The whole user-agent issue is something that needs careful consideration. I'm planning on changing it a bit, but haven't done so yet.

Currently, only the build ID and locale are set by our user.js.

[Atavic]

The string isn't always present. I checked Palemoon, K-Meleon, Mantra and the string isn't there on default.

[Thorin-Oakenpants]

I would have said something when @Anyon3 started the issue, but TBH I'm kinda disillusioned

general.productSub.override, general.useragent.vendor, general.useragent.vendorSub - these prefs are all deprecated, gone, removed, toast, they are no more, they are pining for the fjords

https://bugzilla.mozilla.org/show_bug.cgi?id=1333933#c14 - take Tim Huang's word for it

[Anyon3]

Thanks a lot for ur sharing Thorin, according Tim Huang at : https://bugzilla.mozilla.org/user_profile?user_id=547199 the following pref

general.useragent.override
general.appname.override
general.platform.override
general.oscpu.override

Will override all other pref regarding the useragent info, to see if the change are made it can be done here

https://browserleaks.com/javascript

(My version : Firefox 53.0)

// PREF: Spoof User-agent (disabled) <---- Any reason for having comment the pref here ? It's seem a good idea to uncomment thoses options

About the vendor pref, the following are indeed deprecated

general.useragent.vendorSub
general.useragent.vendor
general.productSub.override (not sure on this one, but probably dead)

It return, using browserleaks

vendor empty
vendorSub empty

[Atavic]

general.useragent.override
general.appname.override
general.platform.override
general.oscpu.override

Will override real values if general.useragent.enable_overrides is set to True.
Moreover, some browsers have a boolean general.useragent.site_specific_overrides and entries as general.useragent.override.youtube.com with String Type content the desired UAstring for that site, so you won't see the crappy info "Your browser is no longer supported".

Palemoon uses the override to appear as FF for compatibility.

[pyllyukko]

// PREF: Spoof User-agent (disabled) <---- Any reason for having comment the pref here ? It's seem a good idea to uncomment thoses options

Well I guess it's a matter of two things:

1. Coming up with which values to use
2. Making the decision of spoofing the UA

[Thorin-Oakenpants]

This will all be done for you by the time FF55 lands (fingers crossed) under resistFingerprinting. There is a suggestion to round the version to the nearest recent value of 10 (then it needs no maintenance and is a smaller set of numbers to use but then may cause compatibility issues) vs ESR (more compatible since major changes happen with these, but then needs to be maintained).

Some of the other values are up for debate (32 vs 64 since 64 will get a push), concurrency (I know its not UA) is also in the same boat. They have the pref at 2 (landing in 55) but the dom spoof at a suggested 1. Etc.

I still HIGHLY recommend this is left until the experts do it. They still have to patch leaks over http header vs JS, and JS leaking navigator items overs iframes, and some navigator items returning different values via JS. I hope all these leaks get addressed when this is turned on.

Also: FYI: Timezone will be spoofed as UTC 0 when FF55 lands

PS: all the links to the tickets - closed with FF landing versions, and pending - are in the sticky topics in ghacks repo

[Anyon3]

I took a little time today to read more about the fingerprint browser, using the most common useragent won't help since it change for every update, or depending on the system, the useragent will be a bit different...

Great news that firefox will focus on the fingerprinting, I will follow this closely thanks for sharing those valuable information Thorin

That's said I'm doing every day (sometime 2 times a day) a clean of the firefox files blablaidprofile.Default (rm -rf ~/.mozilla/firefox/profile.Default/). I do not store anything more than for the current session (Firefox don't not retain any previous use when I close it) however I'm not sure if some information could be written in the profile directory. It is a useful or useless thing do to (rm -rf ~/.mozilla/firefox/profile.Default/) daily ?

A fast idea, in case Firefox do not work / solve the fingerprinting UA or make harder... Or even using this idea on every browser, It can sound a little ambitious (or stupid) but instead to change on each update of the client browser or round the UA value for make harder to be fingerprinted: What about using a default UA general value ? If everyone wishing to override the useragent of his browser in a matter of privacy, using a defined "standard" UA value by at least 50 k peoples (or more...) is a better solution than putting a round on different UA ?

I will add this, for the incoming question that's have high chance to be asked. How to make the users using the UA defined ? Who gonna choice the value of the UA ? How to get people using it ? ...

I haven't those answer but if the idea is good, we could start on this repo

Thanks for your help/informatio pyllyukko, Torin, Atavic

[Atavic]

using the most common useragent won't help since it change for every update

Linux 64-bit and 32-bit

Mozilla/5.0 (X11; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0
Mozilla/5.0 (X11; Linux i686; rv:53.0) Gecko/20100101 Firefox/53.0

or, depending on the system, the useragent will be a bit different...

Be generic.

[Anyon3]

Atavic yes that the thing I pointed out on my previous message. The most common useragent is used, at this date by 6.5%, that is too low, be generic is indeed one of the best alternative. Disabling the useragent could be a good idea if it was done by at least 10 % of the browser...

[Atavic]

Do you mean leaving the string value empty? You'll encounter problems on sites like youtube that check your User Agent.

[Anyon3]

Yes it was I meant. It's ok about website like youtube and co, I just want to know if leaving the string empty is somehow, more difficult to fingerprint ?

If the most common useragent is used around 7 %, leaving empty could make easier the browser to be fingerprinted (if the average of empty useragent is less than 7%...). I'm a right ?

[Atavic]

I think that an empty string rises your uniqueness a lot.

[Anyon3]

Ok thanks for Atavic, I haven't more to add regarding this subject.

[pyllyukko]

I think that an empty string rises your uniqueness a lot.

I agree.

[Atavic]

The complete customization needs:
general.useragent.site_specific_overrides true

Plus an entry for every site you want the UA String to be spoofed, as:

general.useragent.override.youtube.com Mozilla/5.0 (X11; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0

[psycho23]

I changed general.oscpu.override to 'i686' string and my useragent still had 'x86_64'

[Atavic]

If you have JS enabled, that's easily bypassed as the browser leak test sites.

https://github.com/ghacksuserjs/ghacks-user.js/issues/23#issuecomment-282004352

[psycho23]

No. I was using an apache2 server's $_SERVER['HTTP_USER_AGENT'] PHP variable. No JavaScript was used to extract this information across the form-submission/POST.

[Atavic]

PHP queries follow browscap.ini queries. The full list has, among others, these queries:

Platform_Bits