Except websites can tell what base OS you run using browser fingerprinting. It os impossible to lie aboit your OS because of the differences in platforms.
That isnt a great defense against malware “imho”. Security through assuming the threat actor is lazy is just not security. It doesnt take like any effort on their part to just use some off-the-shelf OS fingerprinting code. It isnt worth it either because it contributes to your overall fingerprint, since normal RFP users have a standardized useragent for Windows and Linux separately.
It really isnt any defense. All a website can do is initiate a download, websites are sandboxed by default. You still have to run the executable, which doesnt really apply to Linux because the file will have no executable permission.
Security is layers, i utilize apparmor and firejail personally. And in fact 90% of widespread malware specifically relies on lazy people. Often targets default passwords etc
You can lie, but that doesnt mean that a website cant still tell your base OS if they use JS platform fingerprinting. Arkenfox, the base config which Librewolf is based off of says the exact same thing. Go to CreepJS and see it get your platform regardless.
Secondly, do you block all JS? NoScript is not a silver bullet and doesnt stop fingerprinting, it is itself identified by the CreepJS test site. It may in this case reduce the chance of OS fingerprinting, but pure CSS methods exist as well.
Additionally, NoScript is laregly redundant with uBlock Origin since you can do everything that it offers, such as blocking 3rd party scripts/iframes/all, block fonts, block JS, and it is very granular.
Generally browser fingerprinting is used to identify individual browser sessions across IP addresses. This mostly takes into account reported features and capabilities of the browser and OS to the website. Fingerprinting isn’t looking for specific info your browser reports, it’s taking it all and hashing it to get a unique id specific to the browser. Because it’s hashed, it can’t be reversed to identify the OS from the hash.
Sure a malicious website could Ignore the user agent and probe for some hardware capabilities that are specific to Linux, but that would be a lot of effort to probe various things which are set differently across all different browsers. I can’t speak for bad actors, but I wouldn’t spend the effort to check if the user agent is spoofed, if 95% of the time it’s accurate to get the OS type.
It is trivial to identify OS platform because browser work differently on each platform. Wjat Librewolf does with useragent on Linux actually is makes users stand out more because it isn’t what privacy.resistFingerprinting (RFP) reports on normally.
Hackers (like the comment scenario i was responding to) are substantially more likely to employ platform fingerprint than trust a fale useragent. And loads general websites employ fingerprinting, meaning deviation from default RFP behaviour makes you stand out (more than you already do by using RFP since it is a small pool already).
Agreed, I’m not saying it’s impossible to detect the OS, but it’s even more trivial for an adversary to regex the User Agent and serve the malware for that OS. The average user doesn’t even know what a User Agent is, and that’s who the drive by malware websites are counting on to infect because they’re easy targets.
Just like a real fingerprint, that will only identify the fingerprint to a person, not tell you that the fingerprint is from someone who is European. Fingerprints are used to track you across different websites, and build a profile of you for advertising.
My logic was that it is much more likely that someone will spoof there useragent already if they are on Linux. If threat actor is targeting not just Windows but also Linux, they probably would understand the very real likelyhood of platform spoofing.
Twitch.TV will tell you that you need to use a supported browser if you connect with Linux in your user agent no matter what browser you use. Changing Linux to Windows in your agent with no other changes resolves this issue.
Why suspicious? I have genuinely never read a news story about a virus sending different versions of itself to different OSs. I’m sure it happens, but it doesn’t seem common at all, and you are claiming it very matter-of-factly so I am interested to know more.
If you haven’t come across them yet, then i might be a pioneer! Dibs on the patent!
But your words confuse me. Either it’s not true at all or it happens. You’re sure they exist, though rare.
As i said before, suspicious. You might just be one of those rare occurrences after all…
You wish to be the first acknowledged one, no? It’s alright, you can have the honour. I’ll keep mum about it for you.
But your words confuse me. Either it’s not true at all or it happens.
The idea is pretty simple, so it would be surprising if it wasn’t happening at all. But there is a huge difference between “there probably exist some examples that do that” and a sweeping statement about all of them in general.
Modern viruses check the os before deciding which type of file to send your way.
This is why you use a user agent switcher to lie about being windows. It’s a form of anti malware!
Except websites can tell what base OS you run using browser fingerprinting. It os impossible to lie aboit your OS because of the differences in platforms.
Sure, if they put in the effort. Most don’t even when Distributing malware
That isnt a great defense against malware “imho”. Security through assuming the threat actor is lazy is just not security. It doesnt take like any effort on their part to just use some off-the-shelf OS fingerprinting code. It isnt worth it either because it contributes to your overall fingerprint, since normal RFP users have a standardized useragent for Windows and Linux separately.
Nobody said it was a great defense.
It really isnt any defense. All a website can do is initiate a download, websites are sandboxed by default. You still have to run the executable, which doesnt really apply to Linux because the file will have no executable permission.
Security is layers, i utilize apparmor and firejail personally. And in fact 90% of widespread malware specifically relies on lazy people. Often targets default passwords etc
You can lie about your fingerprint very much in fact it is the default on librewolf
You can lie, but that doesnt mean that a website cant still tell your base OS if they use JS platform fingerprinting. Arkenfox, the base config which Librewolf is based off of says the exact same thing. Go to CreepJS and see it get your platform regardless.
You sweet summer child I use noscript
Firstly there is no need to be condescending.
Secondly, do you block all JS? NoScript is not a silver bullet and doesnt stop fingerprinting, it is itself identified by the CreepJS test site. It may in this case reduce the chance of OS fingerprinting, but pure CSS methods exist as well.
Additionally, NoScript is laregly redundant with uBlock Origin since you can do everything that it offers, such as blocking 3rd party scripts/iframes/all, block fonts, block JS, and it is very granular.
Bottom line, you are fingerpintable.
Generally browser fingerprinting is used to identify individual browser sessions across IP addresses. This mostly takes into account reported features and capabilities of the browser and OS to the website. Fingerprinting isn’t looking for specific info your browser reports, it’s taking it all and hashing it to get a unique id specific to the browser. Because it’s hashed, it can’t be reversed to identify the OS from the hash.
Sure a malicious website could Ignore the user agent and probe for some hardware capabilities that are specific to Linux, but that would be a lot of effort to probe various things which are set differently across all different browsers. I can’t speak for bad actors, but I wouldn’t spend the effort to check if the user agent is spoofed, if 95% of the time it’s accurate to get the OS type.
It is trivial to identify OS platform because browser work differently on each platform. Wjat Librewolf does with useragent on Linux actually is makes users stand out more because it isn’t what privacy.resistFingerprinting (RFP) reports on normally.
Hackers (like the comment scenario i was responding to) are substantially more likely to employ platform fingerprint than trust a fale useragent. And loads general websites employ fingerprinting, meaning deviation from default RFP behaviour makes you stand out (more than you already do by using RFP since it is a small pool already).
Agreed, I’m not saying it’s impossible to detect the OS, but it’s even more trivial for an adversary to regex the User Agent and serve the malware for that OS. The average user doesn’t even know what a User Agent is, and that’s who the drive by malware websites are counting on to infect because they’re easy targets.
Just like a real fingerprint, that will only identify the fingerprint to a person, not tell you that the fingerprint is from someone who is European. Fingerprints are used to track you across different websites, and build a profile of you for advertising.
Yeah okay.
My logic was that it is much more likely that someone will spoof there useragent already if they are on Linux. If threat actor is targeting not just Windows but also Linux, they probably would understand the very real likelyhood of platform spoofing.
Twitch.TV will tell you that you need to use a supported browser if you connect with Linux in your user agent no matter what browser you use. Changing Linux to Windows in your agent with no other changes resolves this issue.
Worked on my machine last I checked, and I don’t have a useragent spoofer
Do you have any data to back up that claim? I don’t think that’s true at all, it would be very rare.
None whatsoever.
Suspicious words. You have one, don’t you? Don’t worry, I won’t tell.
Why suspicious? I have genuinely never read a news story about a virus sending different versions of itself to different OSs. I’m sure it happens, but it doesn’t seem common at all, and you are claiming it very matter-of-factly so I am interested to know more.
If you haven’t come across them yet, then i might be a pioneer! Dibs on the patent!
But your words confuse me. Either it’s not true at all or it happens. You’re sure they exist, though rare. As i said before, suspicious. You might just be one of those rare occurrences after all…
You wish to be the first acknowledged one, no? It’s alright, you can have the honour. I’ll keep mum about it for you.
The idea is pretty simple, so it would be surprising if it wasn’t happening at all. But there is a huge difference between “there probably exist some examples that do that” and a sweeping statement about all of them in general.
Or, hear me out here, the ones that don’t aren’t modern… Get it? Wink, wink. Nudge, nudge.
One could think so, but no cybersecurity experts share such opinion to my knowledge.
Hmm… Being too much in the know can at times be as troublesome as being too little.
Pick the least POSIX shell, or roll your own! <taps head>
Rename all the coreutils. Confuse yourself and the hackers!
Download libc.so and receive free bitcoin.