1918009 - privacy.resistfingerprinting using unique user agent

Status: VERIFIED FIXED

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[gamer191]

Steps to reproduce:

1. enable privacy.resistFingerprinting
   2.. visit https://useragents.io/parse/my-user-agent

Actual results:

The user-agent was Mozilla/5.0 (Windows NT 10.0; rv:128.0) Gecko/20100101 Firefox/128.0

Expected results:

The user-agent should have been Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0, which is Firefox's current Windows ESR user-agent (source: https://www.whatismybrowser.com/guides/the-latest-user-agent/firefox)

Comment 1

[Tim Huang[:timhuang]]

Tom, do we want to align the RFP user agent with the user agent of the ESR version to reduce the uniqueness?

Comment 2

[Tom Ritter [:tjr]]

We decided in the past not to spoof the version of the browser back to the ESR version; but yes, I think the rest of the UA string should generally match the form of the regular non-RFP mode....

Comment 3

[Thorin [:thorin]]

This is the HTTP header, not JS. Note: we want to remove the HTTP header spoofing as windows on linux and mac upstrteam (dropped in Mullvad Browser last cycle), and aligned in Tor Browser 14 - also note cloudflare notified (so I expect mismatched headers to become more of an issue?) - see Bug 1826098

RFP on examples (windows 11: note version is hardcoded capped at 10)
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - JS/navigator
- `Mozilla/5.0 (Windows NT 10.0; rv:130.0) Gecko/20100101 Firefox/130.0` - HTTP header

RFP off
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - JS/navigator
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - HTTP header

So...

1. drop spoofing as two OSes and only limit to 4 results in HTTP headers (we still protect values in the string)
2. align the HTTP header and JS navigator to be the same

ni :morgan for input

edit: test page that compares the two: https://canvasblocker.kkapsner.de/test/navigatorTest.php

Comment 4

[Pier Angelo Vendrame]

Attachment: Bug 1918009 - Fix the RFP-spoofed User-Agent header. r?tjr

The spoofed value of the HTTP user-agent header is not consistent with
the value of navigator.userAgent on Windows, and this can lead to
compatibility issues.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/df6098347ad9
Fix the RFP-spoofed User-Agent header. r=tjr

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/df6098347ad9

Comment 7

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

Reproducible on a 2024-09-10 Nightly build on Windows 10.
Issue is verified as fixed on Firefox 132.0b2 and Firefox Nightly 133.0a1 on Windows 10, Ubuntu 22, macOS 14.