Re: Fingerprinting lessons from 'curl-impersonate'

Hi,

On Wed, Jan 01, 2025 at 04:16:58PM +0100, [email protected] wrote:
> Hi Rodrigo,
> 
> > I experienced problems with the user-agent being banned, and having to
> > impersonate Firefox to load some sites. I haven't found yet examples
> > of this deep fingerprinting for TLS or similar, you?
> 
> Here are a few example sites which seem to be doing something like that:
>
> https://www.spacecoastdaily.com

This one seems to be loading for me.

> https://www.lowes.com/

Fails with:

SSL_read() failed: SSL_ERROR_SYSCALL
Tls_close_by_key: Avoiding SSL shutdown for: https://www.lowes.com/

> https://elokata.santanderconsumer.pl

Fails with:

TLS ALERT on write: decode error
SSL_read() failed: error:0A000126:SSL routines::unexpected eof while reading
Tls_close_by_key: Avoiding SSL shutdown for: https://elokata.santanderconsumer.pl

Thanks for the list, I will check later each one in case we are doing 
something wrong.

> And of course washingtonpost.com, which you are already aware of. I'm
> sure there are more. 

Yeah, the case of washingtonpost.com is truly appaling. They were just 
banning right away anything that is not HTTP/2. When I complained with a 
curl reproducer so they allow Dillo via HTTP/1.1, they also banned 
curl...

Similar problem with ebay.com, due to Akamai (edgesuite). I also 
reported it, but so far no reply (this time, no curl reproducer).

I also contacted CloudFlare to see if there could be an option for 
non-JS browsers to solve a similar challenge so we are not excluded.

> PS. Mails from the list don't seem to be coming through to my email
> anymore... maybe my provider changed something recently, will have to
> investigate.

Hmm, I haven't touched anything in the settings... I'll CC you.

Best,
Rodrigo.
_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]