543202 - Put less info in UserAgent for better privacy

Status: VERIFIED DUPLICATE of bug 572650

(Firefox :: General, defect)

Description

[Martin Seebach]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7

As the EFF "Panopticlick" site illustrates, the browser emits quite a bit of information, that might serve to create a unique fingerprint.

Even with noscript enabled, my browser is only one in 47.000, and I think we could do better by putting less information in the UserAgent string.

I suggest stripping the lest four digits of the build-number and the last number in the version, so my string would be:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-GB; rv:1.9.1.7) Gecko/2009 Firefox/3.5

That would decrease the uniqueness of the string greatly, and provide more privacy for Firefox users.

I'm aware that this is a bit subjective, but I think every little step towards better privacy is a step in the right direction.

Reproducible: Always

Steps to Reproduce:
1. disable javascript, eg. with no-script
2. go to http://panopticlick.eff.org/index.php?action=log
Actual Results:  
The browser leaves a significant fingerprint

Expected Results:  
The browser leaves an insignificant fingerprint

Comment 1

[Matthias Versen [:Matti]]

this is not new (you are 9 years too late), sites like browserspay.dk are for example several years old and browserspay.dk is from a Mozilla contributor.

Comment 3

[Dave Garrett]

v. dupe on main point, however...

(In reply to comment #0)
> I suggest stripping the lest four digits of the build-number and the last
> number in the version, so my string would be:
> 
> Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-GB; rv:1.9.1.7) Gecko/2009
> Firefox/3.5
> 
> That would decrease the uniqueness of the string greatly, and provide more
> privacy for Firefox users.

That wouldn't change anything substantive as you have it. The Gecko version ("rv:"), Gecko build date, and Firefox version are all directly correlated. You'd have to drop the minor revision for all three to have any true effect. This is bug 572659.