Re: [SCRIPT] Run Dillo with a random user agent

Hi Rodrigo,

On Sat, 13 Jul 2024 09:54:11 +0200
Rodrigo Arias <[email protected]> wrote:

> Thanks!, I think is a good idea to reduce fingerprinting in Dillo.
> Have you considered also removing the user agent header completely?

Yes, I ran with no user agent for quite a while in the past, but found
that certain sites refused to serve content without it. 

> I work under the assumption that each Dillo user is uniquely 
> identifiable based on non-JS enabled, other HTTP headers, TLS
> behavior, TCP and network timing leaked details, unless I have
> evidence that suggests otherwise.

Probably a good assumption, however I suspect that many sites aren't so
advanced and mainly use JS, headers, and IP address for fingerprinting.
Randomizing some of the headers may still be valuable. 

> >Just to add to this, have you considered the idea of a user agent
> >switcher in Dillo? It would be neat to be able to choose from
> >different profiles and have them applied in real-time without having
> >to restart the browser. For example, the profiles could be something
> >like:
> >
> >'Default', 'Desktop', 'Mobile', 'Random'  
> 
> I thought about something like this but for the CSS media selector,
> not so much for the user agent. I'm not sure if switching the user
> agent among desktop/mobile would have a measurable effect on the page
> content.

I don't know about recently, but in the past certain sites would serve
a more Dillo-friendly page if you used a mobile agent like:

http_user_agent="Opera/9.60 (J2ME/MIDP; Opera Mini/4.2.13337/458; U;
en) Presto/2.2.0"

or 

http_user_agent="Mozilla/5.0 (PSP (PlayStation Portable); 2.00)"

Of course those are VERY outdated examples, and are probably no longer
effective. I still think that a mobile user agent could cause certain
sites to work better, but this would take further study to prove value.

> If you want to reduce information leaked by Dillo that can identify a 
> user, I think a good strategy is first to make a service that can 
> measure this information among Dillo users and show the differences
> it can find among users, much like the EFF does[1]. Maybe we can work
> with the EFF to improve the support for non-JS browsers, so we can
> benefit from their pool of users to estimate uniqueness.
> 
> [1]: https://coveryourtracks.eff.org/
> 
> We can also make it cooperate with a Dillo plugin that can have
> access to network TCP packets and timing information on both ends to
> emulate an state actor, so we can estimate how much information is
> being leaked and how much we are reducing it.
> 
> This is probably something that we may want to bring up to the Tor
> team to see which strategies the did for the Tor Browser and which
> ones we can apply to Dillo.

I like the idea of emulating the Tor Browser fingerprint, however there
could be scenerios where this is undesireable, and may actually draw
more attention. 


Regards,
Alex
_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]