0

Using Tor Browser Bundle, I noticed the latest versions I have (9x) did not show user agent in the general.userAgent.override entry in about:config. The browser was downloaded from the Tor Project and passed its GPG signature check.

User agent checkers shown on Wikipedia, and some I have found in online searching, continue to show the usual Windows 10 OS result when the browser is pointed at their webpage with java enabled.

However, Chrome downloads correctly shows a Linux OS when java is enabled (which as far as I know is required for user agent detection), but shows Windows 10 by default. This suggests Chrome's website scripts are able to bypass Tor's supposed user agent spoofing with ease.

https://www.google.co.uk/chrome/

Running Firefox with User Agent Switcher installed confirms this. UAS is able to fool the Chrome download page with java enabled, offering Windows 10 when Windows 10 is set as user agent, and 64bit .deb when Debian is set instead. Setting Android provides a link to the Play Store.

Inspecting about:config I noticed that general.useragent.override entry is no longer included. I forced it by adding it manually to the default profile user.js, and set one of the strings from UAS. This of course still fails. As I have asked after on superuser, simply setting this about:config entry does not actually change the detected UA for Firefox. I assume UAS alters the user agent packets outbound from Firefox, and wonder how this can be achieved using an about:config entry.

Either way, Tor Browser Bundle 9x does not fool any sites with regard to UA. While TCP/IP stack sniffing can be used to resolve OS, user agent detection is a well-established website methodology.

Past encounters with the browser included YouTube as default search engine (5x or so), and the irritating habit shared by Firefox to lesser effect of writing to dconf in /run which would mess up the GUI and bloat file browsers all the time (now blocked in Firejailing).

The version tested here is 9.02.

How can Tor Browser Bundle be failing at so basic a task as user agent obfuscation?

  • Are saying that if you go to a website like whatismybrowser.com/detect/what-is-my-user-agent and you use Tor Browser, you will see something other than: (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 – JSEvans Jul 23 at 20:29
  • I've already answered that in the above reference to some UA checkers online that will claim to detect, or will detect, the usual string Tor were known to use through whatever method. The Chrome site doesn't, it correctly fingerprints OS. – Kebam Jul 28 at 17:39
0

You don't need to change your user agent string on Tor as it's basically useless. Just leaving JavaScript on will give the website the power to detect the size of your scrollbar which got a size that is unique to every operating system.

Just turn off JavaScript altogether if you're paranoid about your user agent string.

| improve this answer | |
  • Sorry, vague. Why is UA 'useless on Tor'? As to the scrollbar detection, is this related to display size detection from TCP packet headers? The Tor Browser standardizes window size for this reason, so why bother if scrollbar is readable? – Kebam Jul 28 at 17:41
  • As TBB promises "tracking, surveillance, and censorship are widespread online. Take back the internet with Tor". The 'most 'users' behind 2million people using Tor are led to think their OS is not detected online, their system is masked, they are not identifiable on wifi if their MAC address is spoofed, and so on. The assumption of anonymity implies non-detectability. Javascript is widely known as a vector for metadata attacks that deobfuscate IPs anyway, which is why I remarked at the unchanged 'online behaviour' that made YouTube the default search engine in Tor 5x, or whichever one it was. – Kebam Jul 28 at 17:50
  • Perhaps also this is why people are expected to try to use Whonix or Qubes incorporating Whonix, about which I have asked elsewhere - to provide a metadata filtering methodology infront of a client by using a virtual machine (replete with virtual hardware). I have wondered why this requires an entire virtual OS, and can't be accomplished using some lightweight method. Even ip-personality shows it is possible to obfuscate TCP/IP stack remotely through packet manipulation in a special iptables table, but is only available for the Linux kernel 2x. – Kebam Jul 28 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.