Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why not to whitelist operating system user agents

neelc.org

Post reply on HN
Print view View original

91–100 of 122 posts

Re: Why not to whitelist operating system user agents

#91

Post by zinekeller »

GoblinSlayer wrote: post #28
roobs wrote: post #14

Try Japanese business banking - where you have to pick an OS and stick with it when registering (with a paper form), and must use either the ESR release of Firefox or Internet Explorer. If you don't have a user agent of either of those it won't even let you sign in.

Always spoof your user agent string, for firefox the setting is general.useragent.override

You think that's that easy?

Maybe now, not really sure if there are now changes (hopefully, since Microsoft is dropping IE), but in a time where browser plugins are abound you can't place an ActiveX plugin inside Firefox (or vice versa).

Re: Why not to whitelist operating system user agents

#92

Post by makeitdouble »

lmilcin wrote: post #52
Freak_NL wrote: post #51

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…

> After I saw the same error with some other websites for businesses in my town I started seeing a pattern. The company that hosts/builds this website apparently copy/pastes their basic server set up, and so every website they host works everywhere, except when using Firefox on Linux. So maybe one in a thousand users gets this. Haha! Never attribute malice when a simple incompetence would explain it!

This is not straight incompetence though, as that config is not there by accident. It’s more in line with “screw that 1 per 1000 users”, for whatever reason.

Malice might be too strong of a word, disdain could be closer to what we are seeing.

Re: Why not to whitelist operating system user agents

#93

Post by enobrev »

flyinghamster wrote: post #71

Blue Cross and Blue Shield of Illinois (I can't vouch for any of the other Blue Cross affiliates) recently redid their website. I was wondering why the hell it was kicking me out after logging in, with a "did you forget your password?" message. Multiple password reset attempts later, I called their tech support and asked what was up. I use Firefox on Linux as my daily driver. What was up was that on their new site, I…

I have similar issues. I couldn't get to the billing site for BCBSIL from any browser on my system for the past year.

Unfortunately there are no decent alternatives for a PPO, where I am. If it's browser issues vs an HMO, I'll begrudgingly accept developer incompetence.

Re: Why not to whitelist operating system user agents

#94

Post by R0b0t1 »

franga2000 wrote: post #83
R0b0t1 wrote: post #81

Earlier quoted context omitted.

A lot of them do if the text is scraped. Lack of scrapable text is an ADA issue.

A JS app can be perfectly accessible (if written correctly), despite giving a CLI browser nothing but a "please turn on JS" page. Both Firefox and Google Chrome support powerful screen readers and other accessibility features based on an open standard. A site using these would surely be ADA-compliant

You can't dictate a specific solution. It probably hasn't happened yet but someone who exclusively uses the FOSS software probably has grounds to request flat text. Flat text may be better with current hardware, who knows.

A business is going to have a hard time arguing that providing text is unreasonable.

Re: Why not to whitelist operating system user agents

#95

Post by voakbasda »

JshWright wrote: post #77
c-swa wrote: post #73

Earlier quoted context omitted.

Unfortunately can’t change loan providers, as my auto loan when was financed through the dealer ended up at Jp Morgan & Chase.

You definitely can do that, if you want to. Refinancing a loan is not especially complicated.

And pay all those expenses to have the note bought up by one of the same large banks? Selling debt is a very common practice.

Re: Why not to whitelist operating system user agents

#96

Post by JshWright »

voakbasda wrote: post #95
JshWright wrote: post #77

Earlier quoted context omitted.

You definitely can do that, if you want to. Refinancing a loan is not especially complicated.

And pay all those expenses to have the note bought up by one of the same large banks? Selling debt is a very common practice.

Personally, I use a local credit union that doesn't sell their loans (there are several CU's and regional banks in my area that make that commitment).

Re: Why not to whitelist operating system user agents

#97

Post by Freak_NL »

makeitdouble wrote: post #92
lmilcin wrote: post #52

Earlier quoted context omitted.

> After I saw the same error with some other websites for businesses in my town I started seeing a pattern. The company that hosts/builds this website apparently copy/pastes their basic server set up, and so every website they host works everywhere, except when using Firefox on Linux. So maybe one in a thousand users gets this. Haha! Never attribute malice when a simple incompetence would explain it!

This is not straight incompetence though, as that config is not there by accident. It’s more in line with “screw that 1 per 1000 users”, for whatever reason. Malice might be too strong of a word, disdain could be closer to what we are seeing.

I would guess it was more in the line of not suspecting that it was a valid user-agent string; just one used by bots.

Re: Why not to whitelist operating system user agents

#98

Post by Freak_NL »

Freak_NL wrote: post #51

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…

One happy addendum:

Seeing this topic on HN reminded me to try to and contact the website builder again, and this time they did get their hosting party to fix the problem.

The explanation as passed on to me was:

> There was a bit in the htaccess that was there since 2019, we don't know why.

Re: Why not to whitelist operating system user agents

#99

Post by JumpCrisscross »

JshWright wrote: post #74
Freak_NL wrote: post #51

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…

If you're in the US, call your doc and mention that this may be a violation of the 21st Century Cures Act, as it is preventing or interfering with the access, exchange, or use of electronic health information. It would be a stretch to call this an outright violation (as they could satisfy the requirement by printing the information you want and mailing it to you...), but it's a trendy topic in healthcare right now, s…

> call your doc and mention that this may be a violation of the 21st Century Cures Act

Unless you’re a lawyer, don’t do this. Empty threats are more frequently sorted into the crackpot category than the kind one responds to.

Re: Why not to whitelist operating system user agents

#100

Post by krolden »

zxcvbn4038 wrote: post #62

Banks do stuff like this all the time - they are always the long tail of security - could be a topic in itself. I contemplated this for a very long time and decided that JP Morgan would rather take the hit for bad security then pay wages and benefits to support people to deal with password resets, lost yubikeys, etc. No other answer makes sense. My advise to OP is to dump Chase, Citibank, Bank Of America, ASAP. Move…

Or better yet, use a credit union.
Post reply on HN