muzuiget / user_agent_overrider

Firefox extension to override browser user agent string
https://addons.mozilla.org/firefox/addon/user-agent-overrider/
61 stars 19 forks source link

leaks os and browser through java on linux #18

Closed 3482818 closed 8 years ago

3482818 commented 8 years ago

http://i.imgur.com/TZwAjgC.png https://www.browserleaks.com/javascript

thorian93 commented 8 years ago

I can confirm that. I have similar output when testing my browser with the provided website.

muzuiget commented 8 years ago

This extension is just simple GUI editor for change UserAgent string, is not make Firefox to be a UserAgent emulator, so nothing can do .

Gitoffthelawn commented 8 years ago

@3482818 You can try also installing https://addons.mozilla.org/firefox/addon/user-agent-js-fixer/

It redefines the User-Agent for JavaScript code (navigator.userAgent) using the same string that was sent on the HTTP header.

If you try it, let us know if it works.

@muzuiget You could add something like that to this extension.

muzuiget commented 8 years ago

@Gitoffthelawn I was add the workaround code like user-agent-js-fixer, but I removed it later. Because Firefox 17 - 23 have a bug https://bugzilla.mozilla.org/show_bug.cgi?id=814379. Firefox 24+ fixed it , so I remove the workaround code https://github.com/muzuiget/user_agent_overrider/commit/2df57117dfdf0361d97fbc1eadd949fedc64fbd4

I test again the extension in http://httpbin.org/user-agent, and run navigator.userAgent in console, everything is fine.

Gitoffthelawn commented 8 years ago

@muzuiget If I am understanding you correctly, you are saying that additional code to change the User-Agent for JavaScript is not needed, because how this extension works already handles that case.

When I try https://www.browserleaks.com/javascript the User-Agent set by your extension seems to work correctly. This seems to confirm what you say.

@3482818 and @thorian93 Are you seeing different results? Are you seeing the browserleaks test show a different User-Agent than what you set in this extension?

thorian93 commented 8 years ago

Hope I am not getting something wrong but when I test it, I still get the same result: Platform Linux x86_64 OS CPU Linux x86_64 Was there already an update to the add-on?

muzuiget commented 8 years ago

Because this info is not return by the server, but your browser execute the Javascript, all the info get from https://developer.mozilla.org/en-US/docs/Web/API/Navigator, for example, you can type navigator.oscpu in DevTools console. If you need to change these values, you can use https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/

Gitoffthelawn commented 8 years ago

@thorian93 What you are seeing is not the User-Agent. You are seeing other information that is leaked by the browser.

As @muzuiget mentioned, this information is probably obtained from navigator.oscpu and similar browser API functions. IOW, that information can be leaked from multiple sources.

When you use this extension, you should see the User-Agent change. It does not seem to fix the leaks through the browser API.

@muzuiget Would you consider adding this functionality?

muzuiget commented 8 years ago

@Gitoffthelawn No, there are User Agent Switcher exists. Change UserAgent satisfied most user cases, this is just simple extension with simple GUI.

thorian93 commented 8 years ago

To get this clear: How critical is the leak for users? For me it is important, that companies don't see easily that I use Linux which makes my browser pretty unique. Would you say that this is no big problem regarding tracking technologies and fingerprinting? If it is no bigger issue I assume @muzuiget is right to leave it as is, to stick to the concept of simplicity.

Personally I don't like other user agent switchers, because I recall that the most popular add-on mentioned by @muzuiget before doesn't set the user agent persistent, so I have to switch it on every time I start my browser. Also the default user agents it ships are not enough for me. Thats why I chose this add-on: Its simple and covers my use case.