Subject: Re: bug#47276: Stuck at Cloudflare 'browser checks'

From: Mart Rootamm <[email-masked]>
Date: Wed, 12 May 2021 02:26:30 +0300

It appears, that Cloudflare might have been designed to detect a
mismatch between what the string reports itself as, and what the oscpu
and platform strings say.

> whitelisting the host in "Manage Permissions" under
> "Cookies and Site Data"

This whitelisting works via View Page Info, too, where Allow under
Cookies is selected.

-M.

2021-05-11 3:07 GMT +03:00, bill-auger <[email-masked]>:
> i may have found a solution for this
>
> there has been a long-standing debate in parabola, as to whether
> spoofing the user-agent is a good anti-fingerprinting measure -
> people tend to agree that it probably does more harm than good
>
> for example, 'IceCat' in the user-agent string, actually presents
> significantly more identifiable information than the generic
> 'Firefox' would
>
> in addition to the user-agent string, there are javascript
> properties, which identify the browser and host - these are
> supposedly deprecated now; but they are available - icecat
> reports: 'Windows NT 6.1', where i believe this would be
> 'Windows NT 10.0' on most current windows systems
>
> related to this ticket, i have removed the user-agent
> over-rides in parabola's iceweasel, for the reasons above -
> the user-agent is now the same as archlinux and most other
> distros (the defaults) - in doing so, the problem with login
> to gitlab.com was resolved - i discovered that it is the
> 'general.platform.override' property, which is responsible for
> the gitlab/cloudflare rejecting the browser - presumably,
> because it conflicts with the user-agent information - setting
> it to 'Linux x86_64' (manually) satisfied the browser check;
> so this appears to be the general solution
>
> at least, the 'oscpu' and 'platform' properties should be updated
> to match the most common windows hosts - 'appVersion' also appears
> to be wrong - the default value is '5.0 (X11)' (not the browser
> version) - however, changing those properties to agree with the
> user-agent string, is effectively removing the overrides (which
> again, are deprecated)
>
> here is a test page:
>   <html><body><script type="text/javascript">
>   document.write("codeName="   + navigator.appCodeName + "<br />");
>   document.write("appName="    + navigator.appName     + "<br />");
>   document.write("appVersion=" + navigator.appVersion  + "<br />");
>   document.write("oscpu="      + navigator.oscpu       + "<br />");
>   document.write("platform="   + navigator.platform    + "<br />");
>   document.write("product="    + navigator.product     + "<br />");
>   document.write("buildID="    + navigator.buildID     + "<br />");
>   document.write("userAgent="  + navigator.userAgent   + "<br />");
>   </script><body><html>
>
> icecat:
>   codeName=Mozilla
>   appName=Netscape
>   appVersion=78.0
>   oscpu=Windows NT 6.1
>   platform=Win32
>   product=Gecko
>   buildID=Gecko/20100101
>   userAgent=Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
> IceCat/78.0
>
> arch (default values):
>   appCodeName=Mozilla
>   appName=Netscape
>   appVersion=5.0 (X11)
>   oscpu=Linux x86_64
>   platform=Linux x86_64
>   product=Gecko
>   buildID=Gecko/20100101
>   userAgent=Mozilla/5.0 (X11; Linux x86_64; rv:88.0) Gecko/20100101
> Firefox/88.0
>
>
>
>