Live data from Hacker News

Why not to whitelist operating system user agents

neelc.org

81–90 of 122 posts

Re: Why not to whitelist operating system user agents

#81
post #9

Earlier quoted context omitted.

For an ADA claim it shouldn't matter. You're usually not asked to demonstrate your disability. There are people who only use Linux in textmode.

Sure, but I'd be surprised if any modern web app worked in TUI browsers.

A lot of them do if the text is scraped. Lack of scrapable text is an ADA issue.

Re: Why not to whitelist operating system user agents

#82

Earlier quoted context omitted.

It is to a point, but then it just becomes painful. If you want to keep a good user experience for modern browsers while supporting ancient ones, you'll probably be writing at least all your layouts twice.

You guys are getting a good user experience from your banks?

I am since reverse engineering their mobile app protocol and developing a Python library for it :)

Re: Why not to whitelist operating system user agents

#83
post #81

Earlier quoted context omitted.

Sure, but I'd be surprised if any modern web app worked in TUI browsers.

A lot of them do if the text is scraped. Lack of scrapable text is an ADA issue.

A JS app can be perfectly accessible (if written correctly), despite giving a CLI browser nothing but a "please turn on JS" page.

Both Firefox and Google Chrome support powerful screen readers and other accessibility features based on an open standard. A site using these would surely be ADA-compliant

Re: Why not to whitelist operating system user agents

#84

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I use it almost every day. I'm thinking The user is using a weird user agent/browser and misdiagnosed the problem. It looks like Firefox but there's just so many small browsers these days. Honestly I'd need to see the offending code. If it's user agent testing, those strings should still be readable even in a compressed js unless they run it through an obfuscator

The article is 100% correct, I've experienced the exact same thing. For a while I thought it was blocking me due to uBlock or something, took me a while to figure out it was just the user agent.

Re: Why not to whitelist operating system user agents

#85

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I can confirm this is 100% false. Been using Linux to login to Chase for years, never had any problems (other than weird ad-blocker issues which are cross-platform). Just tested again just to confirm that I can log in just fine. No User-Agent switcher required.

I have seen the same thing, the article is correct.

Re: Why not to whitelist operating system user agents

#86

Earlier quoted context omitted.

I can confirm this is 100% false. Been using Linux to login to Chase for years, never had any problems (other than weird ad-blocker issues which are cross-platform). Just tested again just to confirm that I can log in just fine. No User-Agent switcher required.

Small nit-pick, but OP isn't running Linux, they're running FreeBSD. They too mention Linux so it's possible they aren't aware of the difference. It's possible "Linux" is allowed, but not *nix/Unix?

Quite likely.

Re: Why not to whitelist operating system user agents

#87

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I can confirm this is 100% false. Been using Linux to login to Chase for years, never had any problems (other than weird ad-blocker issues which are cross-platform). Just tested again just to confirm that I can log in just fine. No User-Agent switcher required.

Take a look at their evidence that chase "openly admits to hating linux and freebsd". It's a reddit post with 3 votes about a CS response saying not supporting linux doesn't constitute an ADA violation.

Everything in this article and it's supporting evidence is a stretch and should be evaluated very carefully.

Re: Why not to whitelist operating system user agents

#88

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…

The reaponse to that is to play dumb and repeatedly report yhar the website is failing, but don't try to diagnose it for them. Just focus on your problem, and keep annoying them so that it's their problem too (write a script to email occasionally, and share it with your friends). Eventually they and other customers will complain to the website vendor to make it their problem too.

Re: Why not to whitelist operating system user agents

#89
Downloading, installing and running kernel mode software to prevent cheating is already required for a number of online games.

I wonder if/when banks will extend this idea to banking to prevent fraud?

Perhaps it'll be merely an optional thing at first, like 2FA.

Later it could become something that while optional, does get you a better price of some kind, much like the driving trackers that some auto insurance companies offer.

Before long, it could even become mandatory or there could be a penalty or higher price or fee to pay if you don't do it.

Just a random idea or conspiracy theory of what's possible I suppose, but it feels like something that could be possible in the not too distant future.

Re: Why not to whitelist operating system user agents

#90
post #73

Banks do stuff like this all the time - they are always the long tail of security - could be a topic in itself. I contemplated this for a very long time and decided that JP Morgan would rather take the hit for bad security then pay wages and benefits to support people to deal with password resets, lost yubikeys, etc. No other answer makes sense. My advise to OP is to dump Chase, Citibank, Bank Of America, ASAP. Move…

Unfortunately can’t change loan providers, as my auto loan when was financed through the dealer ended up at Jp Morgan & Chase.

Why do you use a website for your loan? Autopay and never talk to them again until closeout.
Post reply on HN