Avoid using a User-Agent string with high specificity

[jeblad]

When creating a new type of browser they will be rather few, and the User-Agent string will carry a very high specificity. That makes it easy to track users through use of that string. I.e. the string together with an IP-address is a very good identification of the user. A common way to avoid that is to use a standard string that indicates the expected behaviour. It has become common to use one of the generic Mozilla User-Agent strings to refer to such browsers.

One of the more common such spoofed strings are still “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”. This one was used by IE 6.0. I would probably use something like “Mozilla/5.0 (linux)”, but this too has a high specificity.

• The Chromium Project: Technical analysis of client identification mechanisms – Browser level fingerprints

[hugolabe]

Wike only uses its own user-agent in calls to the Wikipedia API, as required by its use policies.

[jeblad]

That would effectively open up for full identification of anonymous IP-users.