Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why not to whitelist operating system user agents

neelc.org

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Why not to whitelist operating system user agents

#101

Post by neelc »

Thanks for the upvotes.

I have updated my article. It seems Chase is whitelisting OSes, but they seem to allow Linux and not FreeBSD based on comments and using a Linux user agent.

Chase may not block Linux because does Chase exactly want to deal with angry Linux users on the phone, or see Linux die-hards switch to competitors. Even if 1% of customers leave and don't come back, it could anger Chase's investors.

They may not officially support Linux but the web developers allow it anyways since it's too big of a minority.

They still block FreeBSD. Whether Chase's web developers don't know about BSD or they're willing to let BSD users switch to Citi Bank, I don't know.

I mean, they shouldn't whitelist by OS, but I don't know what the reasoning of blacklisting FreeBSD is.

Re: Why not to whitelist operating system user agents

#102

Post by jakub_g »

tootie wrote: post #80
jakub_g wrote: post #56

For anyone who works at the company who does that: why you do it? Is it to reduce amount of testing, and only have a few "blessed" browsers with guaranteed happy experience? Any other reasons?

I mean there's an excellent and obvious answer and that's cost benefit when it comes to QA. Anything transactional, banks in particular, want to be 100% sure that end user experiences are doing exactly what they're expected to at all times. No one is being served incorrect information or is improperly served terms or disclaimers that they can use a leverage in a lawsuit. The tech teams likely have an explicit support…

Interesting point on lawsuits! I never thought this way (maybe because lawsuits sounds like a very American thing, and I'm in EU)

Re: Why not to whitelist operating system user agents

#103

Post by Wowfunhappy »

It's not just banks. Google Maps will refuse to work if you're running OS X Lion, even if you're using a fully up-to-date version of Chromium[1] which is just as capable as any other Chromium-based browser on any other operating system.

Google Maps work perfectly on Lion if you fake the user agent, because of course it does, it's a web app and the underlying OS is irrelevant.

1: https://github.com/blueboxd/chromium-legacy

Re: Why not to whitelist operating system user agents

#104

Post by JshWright »

JumpCrisscross wrote: post #99
JshWright wrote: post #74

Earlier quoted context omitted.

If you're in the US, call your doc and mention that this may be a violation of the 21st Century Cures Act, as it is preventing or interfering with the access, exchange, or use of electronic health information. It would be a stretch to call this an outright violation (as they could satisfy the requirement by printing the information you want and mailing it to you...), but it's a trendy topic in healthcare right now, s…

> call your doc and mention that this may be a violation of the 21st Century Cures Act Unless you’re a lawyer, don’t do this. Empty threats are more frequently sorted into the crackpot category than the kind one responds to.

While this is generally true, in my experience anything related to healthcare regulations are a lot less likely to get written off. Generally the failure mode is quite the opposite (people assume all sorts of things about, e.g. HIPAA, that aren't true).

EDIT: I also wouldn't characterize it as an "empty threat", as it is neither empty (I think a good faith argument could be made that this needlessly disrupts patient access to information), nor a threat (it's just making them aware of something).

Re: Why not to whitelist operating system user agents

#105

Post by tentacleuno »

lupire wrote: post #88
Freak_NL wrote: post #51

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…

The reaponse to that is to play dumb and repeatedly report yhar the website is failing, but don't try to diagnose it for them. Just focus on your problem, and keep annoying them so that it's their problem too (write a script to email occasionally, and share it with your friends). Eventually they and other customers will complain to the website vendor to make it their problem too.

Your comment seems to be dead (along with the last four of yours) which suggests you might be shadow banned? I vouched for you, hope it helps.

Re: Why not to whitelist operating system user agents

#106

Post by wswope »

flyinghamster wrote: post #71

Blue Cross and Blue Shield of Illinois (I can't vouch for any of the other Blue Cross affiliates) recently redid their website. I was wondering why the hell it was kicking me out after logging in, with a "did you forget your password?" message. Multiple password reset attempts later, I called their tech support and asked what was up. I use Firefox on Linux as my daily driver. What was up was that on their new site, I…

If you want to push back against the bureaucracy on this one, find a Firefox-only accessibility addon that can’t be used on their site, and play the ADA angle by sending a polite email mentioning that their negligent browser restrictions prevent “your favorite” visibility tweaker/screen reader/etc. from being used, harming the ability to access the site. You need not disclose the details of exactly what, if any, disabilities you personally suffer from.

Re: Why not to whitelist operating system user agents

#107

Post by the_pwner224 »

swills wrote: post #89

Downloading, installing and running kernel mode software to prevent cheating is already required for a number of online games. I wonder if/when banks will extend this idea to banking to prevent fraud? Perhaps it'll be merely an optional thing at first, like 2FA. Later it could become something that while optional, does get you a better price of some kind, much like the driving trackers that some auto insurance compan…

Already a thing on Android. Google "Safety"Net API is used by many apps to verify that the system is not rooted or modified. These days it's combined with hardware attestation from the phone to verify that the installed OS is properly signed by the manufacturer and unmodified. So there's no workaround to using an alternative Android distribution, or rooting your phone, and still being able to use media / banking / other apps.

Of course using the bank website with the phone's browser still works...

Re: Why not to whitelist operating system user agents

#108

Post by flyinghamster »

wswope wrote: post #106
flyinghamster wrote: post #71

Blue Cross and Blue Shield of Illinois (I can't vouch for any of the other Blue Cross affiliates) recently redid their website. I was wondering why the hell it was kicking me out after logging in, with a "did you forget your password?" message. Multiple password reset attempts later, I called their tech support and asked what was up. I use Firefox on Linux as my daily driver. What was up was that on their new site, I…

If you want to push back against the bureaucracy on this one, find a Firefox-only accessibility addon that can’t be used on their site, and play the ADA angle by sending a polite email mentioning that their negligent browser restrictions prevent “your favorite” visibility tweaker/screen reader/etc. from being used, harming the ability to access the site. You need not disclose the details of exactly what, if any, disa…

No thanks. Dishonesty does more harm than good.

Re: Why not to whitelist operating system user agents

#109

Post by jo-m »

danachow wrote: post #12

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I have been using chase.com on Ubuntu 18.04 and 20.04 with Firefox for years without any issues.

Re: Why not to whitelist operating system user agents

#110

Post by passivate »

JshWright wrote: post #96
voakbasda wrote: post #95

Earlier quoted context omitted.

And pay all those expenses to have the note bought up by one of the same large banks? Selling debt is a very common practice.

Personally, I use a local credit union that doesn't sell their loans (there are several CU's and regional banks in my area that make that commitment).

From what I've seen CUs are not competitive with the big banks for jumbo loans. I got a significantly worse interest rate on my home loan with the CUs compared to BOFA (who I ended up going with).
Post reply on HN