Why not to whitelist operating system user agents • Hacker News Board

Re: Why not to whitelist operating system user agents

#21

Post by kafkaIncarnate » Mon, Nov 15, 2021, 7:47 AM UTC

number6 wrote: post #11

tapland wrote: post #7

Earlier quoted context omitted.

It shouldn't be allowed to ban web access from all free operating systems ;)

This gave me the idea to ban all non-free systems: "You are using a non-free Operation System and thus signing away you fundamental rightsas a user. Please use a free Operationsystem like GNU/Linux to access this website."

But then you run into the issue of half of websites blocking free operating systems and half (haha) of websites blocking non-free operating systems.

At that point we'll need a user-agent switcher that is website aware to know which sites need which user-agents. Like secret hand signals to get into your secret clubs.

I'll just pass and not use any of it at that point.

Re: Why not to whitelist operating system user agents

#22

Post by hmrr » Mon, Nov 15, 2021, 7:51 AM UTC

All the UK banks used to do this about 12 ish years ago. No longer. What they do try and do is shove Rapport down your throat instead.

Re: Why not to whitelist operating system user agents

#23

Post by franga2000 » Mon, Nov 15, 2021, 7:51 AM UTC

z3t4 wrote: post #3

The fun part in web dev is to make sure everything works on the 0.5% non mainstream browser/platforms. Only supporting 99.5% is boring.

It is to a point, but then it just becomes painful. If you want to keep a good user experience for modern browsers while supporting ancient ones, you'll probably be writing at least all your layouts twice.

Re: Why not to whitelist operating system user agents

#24

Post by zone411 » Mon, Nov 15, 2021, 7:51 AM UTC

jijji wrote: post #5

Dude, all I know is that I was using chase for one of my businesses for 3 years, millions of dollars coming in via Intuit payments -- no problems, then I switched from Intuit for ACH to using Seamlesschex.com, and then after the first batch, they locked up my business bank account, and then after a few months talking to a call center in india, with the bank manager sitting there (there is nothing they can do when the…

Chase closed my 10-year-old+ personal account without a warning or an explanation. I recommend avoiding them.

Re: Why not to whitelist operating system user agents

#25

Post by silon42 » Mon, Nov 15, 2021, 7:52 AM UTC

roobs wrote: post #14

Try Japanese business banking - where you have to pick an OS and stick with it when registering (with a paper form), and must use either the ESR release of Firefox or Internet Explorer. If you don't have a user agent of either of those it won't even let you sign in.

For a while Firefox ESR was the only one still supporting digital certificate request/generation (KEYGEN). My (not in Japan) and other banks used this as one securiy mechanism. With new EU rules they've now downgraded their security to a Phone app + some SMS verification.

Re: Why not to whitelist operating system user agents

#26

Post by GoblinSlayer » Mon, Nov 15, 2021, 7:53 AM UTC

jijji wrote: post #5

Dude, all I know is that I was using chase for one of my businesses for 3 years, millions of dollars coming in via Intuit payments -- no problems, then I switched from Intuit for ACH to using Seamlesschex.com, and then after the first batch, they locked up my business bank account, and then after a few months talking to a call center in india, with the bank manager sitting there (there is nothing they can do when the…

Biggest banks routinely do such things simply because they can.

Re: Why not to whitelist operating system user agents

#27

Post by kafkaIncarnate » Mon, Nov 15, 2021, 7:54 AM UTC

kristopolous wrote: post #20

kafkaIncarnate wrote: post #18

Earlier quoted context omitted.

The small browsers thing sounds about right. Check the link he posted about the email someone received on Reddit. It's posted like it's a screenshot from Mutt or some other terminal mail editor. Looks more like they are flexing their email terminal usage not just copy/pasting the message (png for text? come'on!). Probably using qutebrowser or something else like that.

platform.js 1.3.1 is in there ( https://github.com/bestiejs/platform.js/ ) I see this from the pretty-printed version function a() { return /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent) ? "Device" : "Desktop" } So let's try to just say I'm say, Opera Mini, still no dice. I tried a bunhch of these to no avail. I don't know how the OP got this.

Well that kind of matches the message he received from the website. It looks like they are just trying to notify you that there is a Chase Mobile App available (which for the average phone user, would be 99.9999% better than using a browser). Personally I wouldn't use a phone for banking but some people don't have laptops/desktops.

Re: Why not to whitelist operating system user agents

#28

Post by GoblinSlayer » Mon, Nov 15, 2021, 8:04 AM UTC

roobs wrote: post #14

Try Japanese business banking - where you have to pick an OS and stick with it when registering (with a paper form), and must use either the ESR release of Firefox or Internet Explorer. If you don't have a user agent of either of those it won't even let you sign in.

Always spoof your user agent string, for firefox the setting is general.useragent.override

Re: Why not to whitelist operating system user agents

#29

Post by evanfarrar » Mon, Nov 15, 2021, 8:06 AM UTC

danachow wrote: post #12

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I’ve certainly been blocked by chase on linux with firefox, but I was only using their auto loans at the time. It was super annoying, because I first tried to get a payoff quote on the iOS app, then the mobile website, then on a linux laptop, before resigning and using my work Macbook. Perhaps other lines of business support linux better?

Re: Why not to whitelist operating system user agents

#30

Post by spicybright » Mon, Nov 15, 2021, 8:07 AM UTC

Can confirm it works fine for me under linux firefox. OP, just adjust your user agent string if you're using a weird browser and proceed at your own risk.

(I say this because you're dealing with actual money, so incompatibilities from your browser might cause major problems if you're not careful)