Have Tor appear to be a different browser

Question

I was wondering is there a way to fool websites into thinking that I am using another browser instead of what I'm really using, Tor Browser. Say I wanted example.com to see me connecting to them using IE or Chrome instead of Tor Browser. Is this possible? Maybe using a plugin or something?

Answer 1

Every browser has a userAgent string that is sent to the remote server that tells it what browser and operating system is making the request.

Tor is built on top of Mozilla Firefox. Firefox, and other Mozilla browsers, allow users to modify the userAgent string.

• In the address bar of the Tor browser, go to about:config
• A warning appears about voiding the warranty. Just click "I'll be careful, I promise".
• In the search box, type "userAgent"

You'll now see a list of key/value pairs known as "preferences". Edit the value for the key "general.useragent.override" and put in the userAgent string for the platform you wish to send as your userAgent.

Visit Quirksmode's Browser Detection Page to confirm servers see your userAgent string.

You can find a list of userAgent strings for different platforms on the User Agent String.Com Website.

I should add that there are Firefox extensions that facilitate this userAgent string switching by modifying these preferences under the hood. However, The Tor Project does not recommend installing any add-ons, plugins, or making any such modifications to the Tor browser as it may compromise your security.

Disclaimer:

Since 99% of all Tor browser traffic is going to have similar userAgent strings, modifying your own version string could theoretically compromise your security. I do not know if the userAgent string is encrypted along with the other traffic. Also, if you put any personally identifying information in the userAgent string, that would surely compromise your identity. Just be careful, and do your research before modifying the userAgent string and then doing anything where you desire anonymity.

Answer 2

Whether you can fool the site you are connecting to into thinking you are using a different browser depends on the method that the site uses to identify your browser.

If the site identifies the browser by looking at the User-Agent string, then you can fool it by modifying the User-Agent string.

If the site detects Tor users by checking whether the IP address a request comes from is the address of a Tor exit node, then there is not much you can do to disguise the fact that you are using Tor.

If the site detects the browser you are using by inspecting certain identifying characteristics (the level of javascript/CSS support, the order in which it sends HTTP headers etc.) then it will be difficult to fool the site without making large scale modifications to the browser.

Note that modifying Tor Browser to spoof another browser can jeopardize your anonymity and make it possible for websites and exit node operators to track your behavior over time. By design, all Tor Browser instances send the same User-Agent string, thus if a site or exit nodes sees two requests with the same User-Agent string at two different times coming from the Tor network, then the probability of them coming from the same user is 1/n, where n = the total number of Tor users. If you are the only Tor user who has modified their user agent string to a particular value, then that probability increases to 1/1 = 100%, i.e. the site can link the two requests with certainty.

Therefore you should only change the User Agent string to spoof another browser in instances where it is absolutely necessary. For example, if you want to download a file from a site which only accepts requests from a particular User-Agent, then modify the User-Agent string, get the file and then immediately switch back to the standard User-Agent string used by Tor Browser.

Answer 3

During my research with Tor Browser and Tails version Fingerprinting I found out that there are many things that differ. You can for example request resource URL:s and check the error message returned. Since Tor button is included in the Tor Browser and includes CSS etc you can try them.

For demo, view https://tor.triop.se/ and Tor Browser and Tails Fingerprinting PoC Demo video

Answer 4

You can run but you can't hide.

Changing your user agent won't make you fool websites into thinking that you're using another browser. You really shouldn't do that, it will only make you stand out.

You can't detect the Tor browser based solely on user agent. The "official" way to detect Tor is to check the user's IP address and see if it's a Tor exit node.

Here's a list of user agents that have connected to my server via a tor exit node. Note that some of them claim to be on iOS or Android:

Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 YaBrowser/16.11.1.673 Yowser/2.5 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0
Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0
Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0
Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 YaBrowser/17.6.0.1633 Yowser/2.5 Safari/537.36
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36 OPR/43.0.2442.806 (Edition Yx)
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 YaBrowser/17.1.0.2034 Yowser/2.5 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 YaBrowser/16.11.1.673 Yowser/2.5 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 OPR/42.0.2393.94
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Mozilla/5.0 (Linux; Android 6.0; thl T9 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 6.0.1; SM-G925I Build/MMB29K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/56.0.2924.87 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 6.0.1; Redmi Note 3 Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 5.1; Micromax Q334 Build/LMY47I) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 5.0; PowerFive Build/LRX21M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 4.4.4; MFLogin3T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Safari/537.36
Mozilla/5.0 (Linux; Android 4.4.4; MFLogin3T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Mozilla/5.0 (Linux; Android 4.4.2; TZ707 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Safari/537.36
Mozilla/5.0 (Linux; Android 4.4.2; 9005X Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Mozilla/5.0 (Linux; Android 4.1.2; LG-E455 Build/JZO54K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 4.1.2; LG-E455 Build/JZO54K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 YaBrowser/16.10.2.1487.00 Mobile Safari/537.36
Mozilla/5.0 (iPad; CPU OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3
Mozilla/5.0 (Android 5.0; Mobile; rv:38.0) Gecko/20100101 Firefox/38.0
Mozilla/5.0 () AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393

Answer 5

Tor sends its own UserAgent Spoof for all websites visited.

All you need to do is go to the URL: https://whichbrowser.net/ in your Tor browser...

... And you will currently get the following information (that shows that Tor is currently using the following UserAgent Override):

You are using Firefox 60.0 on Windows 7 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0

This browser (version) is acceptable by virtually all websites so there should never be a problem as far as browser compatibility with any website using the Tor browser.

Tor should include this info in their FAQ.