Why not to whitelist operating system user agents • Hacker News Board

Re: Why not to whitelist operating system user agents

#31

Post by joshuaissac » Mon, Nov 15, 2021, 8:22 AM UTC

kafkaIncarnate wrote: post #21

number6 wrote: post #11

Earlier quoted context omitted.

This gave me the idea to ban all non-free systems: "You are using a non-free Operation System and thus signing away you fundamental rightsas a user. Please use a free Operationsystem like GNU/Linux to access this website."

But then you run into the issue of half of websites blocking free operating systems and half (haha) of websites blocking non-free operating systems. At that point we'll need a user-agent switcher that is website aware to know which sites need which user-agents. Like secret hand signals to get into your secret clubs. I'll just pass and not use any of it at that point.

> At that point we'll need a user-agent switcher that is website aware to know which sites need which user-agents.

Microsoft Edge already has something like this built in to get around Google's user agent checks.

Re: Why not to whitelist operating system user agents

#32

Post by encryptluks2 » Mon, Nov 15, 2021, 8:26 AM UTC

I once got denied for a credit card app with a different company even though they pulled my credit because according to the company, quote, my user agent (Chrome on Linux) was suspicious activity.

Re: Why not to whitelist operating system user agents

#33

Post by Closi » Mon, Nov 15, 2021, 8:27 AM UTC

chaps wrote: post #8

geocrasher wrote: post #6

Earlier quoted context omitted.

Unless one was to claim that Tux is their emotional support animal, I doubt it. Linux on the desktop has usability issues for able bodied people. I strongly doubt it has any edge on MacOS or Windows when it comes to accessibility.

Sure, but usability issues aren't necessarily issues under ADA.

Unless we have more details about this claim we can’t be sure, but it seems like the ADA claim is probably well-intentioned but also not correct.

Chase does not have to implement a specific solution to a users problem, they have to make a reasonable adjustment - I.e. you can install a small ramp if someone asked for a lift.

Depending on the issue raised, chase may feel they have a reasonable way of providing the services - for instance if the user is blind and uses some specific Linux screen reader then telephone banking may also be a reasonable adjustment rather than Linux support.

Chase may see supporting Linux for all users because of one persons disability as an ‘unreasonable’ adjustment (I don’t see the issue, but this is approximately how the claim would work). To be open I’m not exactly sure how ADA works as I’m more familiar with UK legislation.

Re: Why not to whitelist operating system user agents

#34

Post by encryptluks2 » Mon, Nov 15, 2021, 8:32 AM UTC

GoblinSlayer wrote: post #26

jijji wrote: post #5

Dude, all I know is that I was using chase for one of my businesses for 3 years, millions of dollars coming in via Intuit payments -- no problems, then I switched from Intuit for ACH to using Seamlesschex.com, and then after the first batch, they locked up my business bank account, and then after a few months talking to a call center in india, with the bank manager sitting there (there is nothing they can do when the…

Biggest banks routinely do such things simply because they can.

And like most things if you're not wealthy enough to afford a good attorney, and they usually can just draw out a case until you run out of money, the only people capable of protecting you are legislators who have failed time and time again to adequately take on big business abusing their positions.

Re: Why not to whitelist operating system user agents

#35

Post by amelius » Mon, Nov 15, 2021, 8:34 AM UTC

So instead of moving their business elsewhere, they installed a user agent switcher?

Re: Why not to whitelist operating system user agents

#36

Post by raxxorrax » Mon, Nov 15, 2021, 8:48 AM UTC

roobs wrote: post #14

Try Japanese business banking - where you have to pick an OS and stick with it when registering (with a paper form), and must use either the ESR release of Firefox or Internet Explorer. If you don't have a user agent of either of those it won't even let you sign in.

Basically security done wrong because it will only affect users and won't stop attackers.

Re: Why not to whitelist operating system user agents

#37

Post by Closi » Mon, Nov 15, 2021, 8:53 AM UTC

R0b0t1 wrote: post #9

geocrasher wrote: post #6

Earlier quoted context omitted.

Unless one was to claim that Tux is their emotional support animal, I doubt it. Linux on the desktop has usability issues for able bodied people. I strongly doubt it has any edge on MacOS or Windows when it comes to accessibility.

For an ADA claim it shouldn't matter. You're usually not asked to demonstrate your disability. There are people who only use Linux in textmode.

You will need to state what the specific issue is for yourself/someone else though, rather than just what you want the solution to be.

Re: Why not to whitelist operating system user agents

#38

Post by zeorin » Mon, Nov 15, 2021, 9:08 AM UTC

rzzzt wrote: post #13

rocqua wrote: post #10

Earlier quoted context omitted.

A popup "your OS browser combination is not supported, some things may not work" is a much less nuclear option.

If you know which parts will not work in advance. What if the "Send $$$" button does not appear due to a CSS misfire?

eslint-plugin-compat [0] and stylelint-no-unsupported-browser-features [1] can help you know when you're using an unsupported browser feature.

[0] https://github.com/amilajack/eslint-plugin-compat

[1] https://github.com/ismay/stylelint-no-unsupported-browser-fe...

Re: Why not to whitelist operating system user agents

#39

Post by alias_neo » Mon, Nov 15, 2021, 9:25 AM UTC

kafkaIncarnate wrote: post #16

danachow wrote: post #12

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I can confirm this is 100% false. Been using Linux to login to Chase for years, never had any problems (other than weird ad-blocker issues which are cross-platform). Just tested again just to confirm that I can log in just fine. No User-Agent switcher required.

Small nit-pick, but OP isn't running Linux, they're running FreeBSD.

They too mention Linux so it's possible they aren't aware of the difference.

It's possible "Linux" is allowed, but not *nix/Unix?

Re: Why not to whitelist operating system user agents

#40

Post by alias_neo » Mon, Nov 15, 2021, 9:29 AM UTC

hmrr wrote: post #22

All the UK banks used to do this about 12 ish years ago. No longer. What they do try and do is shove Rapport down your throat instead.

Ugh, I remember when HSBC pushed Rapport. Is it still a thing? I run Linux exclusively and haven't seen them try to push it for a long time so not sure if it's still a thing.

They still prevent you from running their app on a rooted Android, which is nice considering I can do much more dangerous things with my money from the web site.