Downgrade User Agent Client Hints to 'harmful' • Hacker News Board

Re: Downgrade User Agent Client Hints to 'harmful'

#21

Post by thaumasiotes » Tue, Jul 13, 2021, 3:59 PM UTC

Svip wrote: post #12

Ajedi32 wrote: post #2

> Moving stuff around (from User-Agent to Sec-CH-UA-*) doesn't really solve much. That is, having to request this information before getting it doesn't help if sites routinely request all of it. I think this is sort of ignoring the whole point of the proposal. By making sites request this information rather than simply always sending it like the User-Agent header currently does, browsers gain the ability to deny exce…

> browsers gain the ability to deny excessively intrusive requests when they occur But Set-Cookie kind of proves what happen to that kind of feature. If at first sites gets used to be able to request it and get it, then the browsers that deny anything will simply be ignored. And then those browsers will start providing everything, because they don't want to be left out in the cold. That's what happened to User-Agent,…

> Set-Cookie was supposed to have the browser ask the user to confirm whether they wanted to set a cookie. Not many clients doing that today.

No worries, that's why we have laws to make the website do in the content what the browser no longer wants to do in the viewer. ;D

Re: Downgrade User Agent Client Hints to 'harmful'

#22

Post by blowski » Tue, Jul 13, 2021, 4:03 PM UTC

ocdtrekkie wrote: post #11

Ajedi32 wrote: post #5

Earlier quoted context omitted.

I think the idea is that there are some legitimate uses for UA information that they don't want to eliminate entirely, otherwise yeah they could just deprecate the User-Agent header and be done with it.

I think most of the legitimate uses could be solved in a simple statement: Let users know whether the device is mobile or desktop, and then expect websites to send all of the logic to handle the rest client-side, so the server does not need to know. I'd love to see browser metrics being absolutely devastated as an analytic source: It just is used today as an excuse to only support Chrome.

Risk-based authentication can use a change in user agent as an increased risk factor.

Re: Downgrade User Agent Client Hints to 'harmful'

#23

Post by wolverine876 » Tue, Jul 13, 2021, 4:15 PM UTC

kijin wrote: post #16

Svip wrote: post #12

Earlier quoted context omitted.

> browsers gain the ability to deny excessively intrusive requests when they occur But Set-Cookie kind of proves what happen to that kind of feature. If at first sites gets used to be able to request it and get it, then the browsers that deny anything will simply be ignored. And then those browsers will start providing everything, because they don't want to be left out in the cold. That's what happened to User-Agent,…

Yes, this looks like DNT all over again. Just another header that quickly becomes meaningless, wasting terabytes of bandwidth all over the world for no good reason.

DNT does nothing technically, but it has political power and that's where privacy happens to a great degree. When 70% of users say 'do not track me', it is hard to claim that they don't care about privacy.

Re: Downgrade User Agent Client Hints to 'harmful'

#24

Post by Thiez » Tue, Jul 13, 2021, 4:22 PM UTC

blowski wrote: post #22

ocdtrekkie wrote: post #11

Earlier quoted context omitted.

I think most of the legitimate uses could be solved in a simple statement: Let users know whether the device is mobile or desktop, and then expect websites to send all of the logic to handle the rest client-side, so the server does not need to know. I'd love to see browser metrics being absolutely devastated as an analytic source: It just is used today as an excuse to only support Chrome.

Risk-based authentication can use a change in user agent as an increased risk factor.

It could, but as someone who has spoofed user-agents in the past (primarily to get Chrome-only websites to cooperate) I would prefer if it wouldn't. If the baddies can snoop my https traffic or directly copy the auth cookies from my machine then also copying my user-agent isn't that big of a step for them. One might argue that detecting changes in user agents could be part of some kind of defense in depth strategy, but as a user I imagine I'm already so boned in that scenario that I doubt it would save me. So overall such a mechanism would bring me more inconvenience than security.

Re: Downgrade User Agent Client Hints to 'harmful'

#25

Post by notriddle » Tue, Jul 13, 2021, 4:29 PM UTC

thaumasiotes wrote: post #21

Svip wrote: post #12

Earlier quoted context omitted.

> browsers gain the ability to deny excessively intrusive requests when they occur But Set-Cookie kind of proves what happen to that kind of feature. If at first sites gets used to be able to request it and get it, then the browsers that deny anything will simply be ignored. And then those browsers will start providing everything, because they don't want to be left out in the cold. That's what happened to User-Agent,…

> Set-Cookie was supposed to have the browser ask the user to confirm whether they wanted to set a cookie. Not many clients doing that today. No worries, that's why we have laws to make the website do in the content what the browser no longer wants to do in the viewer. ;D

Having the browser explicitly prompt for cookies is neither necessary nor sufficient to do what strong, consistently-enforced privacy laws can do, because the browser can't tell a tracking cookie (which needs a prompt) apart from a settings cookie (which does not).

Re: Downgrade User Agent Client Hints to 'harmful'

#26

Post by m45t3r » Tue, Jul 13, 2021, 4:36 PM UTC

wolverine876 wrote: post #23

kijin wrote: post #16

Earlier quoted context omitted.

Yes, this looks like DNT all over again. Just another header that quickly becomes meaningless, wasting terabytes of bandwidth all over the world for no good reason.

DNT does nothing technically, but it has political power and that's where privacy happens to a great degree. When 70% of users say 'do not track me', it is hard to claim that they don't care about privacy.

Unless a big vendor (coff Microsoft coff) decides to enable it by default, them it becomes meaningless.

Re: Downgrade User Agent Client Hints to 'harmful'

#27

Post by blowski » Tue, Jul 13, 2021, 4:43 PM UTC

Thiez wrote: post #24

blowski wrote: post #22

Earlier quoted context omitted.

Risk-based authentication can use a change in user agent as an increased risk factor.

It could, but as someone who has spoofed user-agents in the past (primarily to get Chrome-only websites to cooperate) I would prefer if it wouldn't. If the baddies can snoop my https traffic or directly copy the auth cookies from my machine then also copying my user-agent isn't that big of a step for them. One might argue that detecting changes in user agents could be part of some kind of defense in depth strategy, b…

That's the whole point of RBA, though. That two requests have the same user agent doesn't tell me much, but if you have two different user agents from two different IPs that may sound really risky (use case dependent, of course).

Re: Downgrade User Agent Client Hints to 'harmful'

#28

Post by Analemma_ » Tue, Jul 13, 2021, 4:47 PM UTC

m45t3r wrote: post #26

wolverine876 wrote: post #23

Earlier quoted context omitted.

DNT does nothing technically, but it has political power and that's where privacy happens to a great degree. When 70% of users say 'do not track me', it is hard to claim that they don't care about privacy.

Unless a big vendor (coff Microsoft coff) decides to enable it by default, them it becomes meaningless.

It was meaningless from the beginning: DNT was always nothing but an Evil Bit. You’re getting mad at Microsoft for pointing out that the emperor had no clothes.

Re: Downgrade User Agent Client Hints to 'harmful'

#29

Post by jefftk » Tue, Jul 13, 2021, 4:47 PM UTC

Ajedi32 wrote: post #2

> Moving stuff around (from User-Agent to Sec-CH-UA-*) doesn't really solve much. That is, having to request this information before getting it doesn't help if sites routinely request all of it. I think this is sort of ignoring the whole point of the proposal. By making sites request this information rather than simply always sending it like the User-Agent header currently does, browsers gain the ability to deny exce…

Yes, I wish they would engage with how this fits into the rest of the Privacy Sandbox proposal (https://www.chromium.org/Home/chromium-privacy/privacy-sandb...). My understanding is it's:

1. Move entropy from "you get it by default" to "you have to ask for it".

2. Add new APIs that allow you to do things that previously exposed a lot of entropy in a more private way.

3. Add a budget for the total amount of entropy a site is allowed to get for a user, preventing identifying users across sites through fingerprinting.

Client hints are part of step #1. Not especially useful on its own, but when later combined with #3 sites now have a strong incentive to reduce what they ask for to just what they need.

(Disclosure: I work on ads at Google, speaking only for myself)

Re: Downgrade User Agent Client Hints to 'harmful'

#30

Post by wolverine876 » Tue, Jul 13, 2021, 4:49 PM UTC

m45t3r wrote: post #26

wolverine876 wrote: post #23

Earlier quoted context omitted.

DNT does nothing technically, but it has political power and that's where privacy happens to a great degree. When 70% of users say 'do not track me', it is hard to claim that they don't care about privacy.

Unless a big vendor (coff Microsoft coff) decides to enable it by default, them it becomes meaningless.

Yes, but it's not hard to ignore DNT on Microsoft user agents, which are a small part of the population.