6

I am currently using a Firefox Add-on which generates a random user agent string from a large list of user agents.

I am trying to protect myself from organisations and governments with a lot of resources.

The reason I done this is that I thought if I used the default UA all the time my browser data would be static. My browser unique id would be persistent through my sessions, assuming they have methods of generating a unique id for each TOR Browser Bundle.

Is this practice safe?

Improve this question
1
  • 1
    What is the name of your plugin?
    – Jens Kubieziel ♦
    Jan 27, 2014 at 21:08

3 Answers 3

Reset to default
5

The developers of the Tor Project specifically recommend that you Don't enable or install browser plugins. Unless you're able to dig into the source code of the plugin yourself you'll never know what it's doing underneath.

This particular plugin could do any number of presumably innocent things which could still expose your identity, including:

  • It could report back to a central database each time you're given a new UA
  • It could check for updates using an identifiable serial number
  • It could have an unknown/accidental data leak which performs some action over a non-torified connection

Tin-foil-hat-zone: It could even be developed by a nefarious agent (government or otherwise) and masked as a "privacy tool" whilst ultimately existing for the purpose of tracking/identifying you. Unless the plugin has been vetted & installed by default by the Tor Project you're trusting your privacy in somebody else's hands.

Somebody else can probably comment further on the specific safety implications of rotating user agents like that, but keeping everything standard in the the Tor Browser helps align your fingerprint with every other Tor Browser. You're probably likely to stand out more by rotating your UA this way. See this question for more on plugin fingerprinting in general.

Improve this answer
2

Don't do this. Pick a single User-Agent string and stick to it. You aren't fooling the web sites you visit, and that's what counts here.

After years of running websites, I can tell you that it is trivially easy to spot a user agent which is rotating its User-Agent string. They usually get IP banned because they're almost always malicious.

So not only do you stand out, but you also look to the webmaster like a spambot. Until you load up the images, CSS and possibly JavaScript. Then you just look strange and memorable. Which, I think, is exactly the opposite of what you want.

Improve this answer
3
  • 1
    This is wrong, and is a common folly of people that think an IP address is a unique identifier (they're not). It's a common beginner mistake to look at logs and mentally segregate requests by IP, because it's easy. Since about the start of this decade, spam bots are most often built using PhantomJS (a headless webkit browser) and are distributed across botnets, making it much more difficult to spot a legitimate spam bot. Spam bots these days will look and act exactly like a real person behind a computer, and won't "rotate" user agents, and will almost always use a variety of IP addresses.
    – L0j1k
    Jan 2, 2016 at 20:15
  • 1
    With respect to changing your user agent, the advice in the other answer about not installing extensions in Tor browser is solid advice. If you are going to do it (for example if you have developed an extension on your own, and you know for sure it doesn't phone home or otherwise leak identifiable information), the best solution would be to switch user agents every session. So switch your user agents for example every time you fire up a new browser session, or between visits to the site.
    – L0j1k
    Jan 2, 2016 at 20:18
  • I am pretty sure it is easy to detect and group those users that came from exit nodes together in a "Tor" category. So by using Randomly switching User agent(UA) add-on or just sticking to different UA will make that Tor user stand out in comparison to the other Tor users with standardized UA.
    – m894v5n74v539nm8
    Sep 4, 2016 at 13:41
2

All Tor browsers has standardized user agent which helps to make Tor users to be less distinguishable from each other. By changing your user agent periodically, you are making yourself more unique from other Tor users with the standardized user agent. They always can group all the visits with abnormal user agents under a "Tor" category (because it's easy to check if a user came from an exit node). Thus giving adversaries an potentially easier time to pin down the identity of a Tor user and the sites that user visits on the internet.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .