Posted by hazebooth 1 day ago
So they are basically collecting telemetry in the name of "free basic anti-bot" solution.
[0]: https://research.google/pubs/picasso-lightweight-device-clas...
Apple does this by sending an imposter user agent from Safari on iPads.
If only that was expanded to iPhones, too. And then send rotating, or randomized user agents.
Google does.
And while Mozilla does too because the vast majority of their funding comes from Google, it’s more pertinent that they don’t have the market share to pull this off. Firefox would just stop working on major websites if they did this.
For example, almost every major Japanese book/comic site uses canvas in their e-reader
You can fingerprint the originating TCP stack with some degree of confidence. If the request looks like it came from a Linux server but the user agent says Windows, that's a signal.
Likewise, the IP address making the request has geographic information associated with it. If my IP address says I'm in Romania but my browser is asking for the English language version of the page... That's a signal.
Similar to basic IP/Geo, you can do DNS and STUN based profiling, too. This helps you catch people that are behind proxies or VPNs.
To blur the line, you can use JavaScript to measure request timing. Proxies that are going to tamper with the request to hide its origins or change its fingerprint will add a measurable latency.
jesus christ don't give them ideas. it's annoying enough to have my country's language forced on me (i prefer english) when there's a perfectly good http header for that. now blocking me based on this?!