navigator.userAgent

**Thomas 'PointedEars' Lahn** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Jan Buchwald wrote:
[color=blue]
> navigator.userA gent returns information about the user operting system,
> Browser etc.[/color]

No, it does not. <http://pointedears.de/scripts/test/whatami>

PointedEars

**Randy Webb** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Thomas 'PointedEars' Lahn wrote:[color=blue]
> Jan Buchwald wrote:
>
>[color=green]
>>navigator.use rAgent returns information about the user operting system,
>>Browser etc.[/color]
>
>
> No, it does not.[/color]

Yes it does. And without flaw.

If the userAgent string has been modified, then it is still indicative
of certain things. Even if its nothing more than the fact that the
viewer is using a browser/OS that allows the modifying of the userAgent
string.

But that has *nothing* to do with the OP's question. As I read it, they
wanted to know how to break down what the userAgent string reports, not
how to identify a browser/OS.

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq

**Thomas 'PointedEars' Lahn** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Randy Webb wrote:
[color=blue]
> Thomas 'PointedEars' Lahn wrote:[color=green]
>> Jan Buchwald wrote:[color=darkred]
>>> navigator.userA gent returns information about the user operting system,
>>> Browser etc.[/color]
>>
>> No, it does not.[/color]
>
> Yes it does. And without flaw.[/color]

Nonsense. Given a suitable tool (like PrefBar), I can
fake *any* information that this host object returns.

PointedEars

**Randy Webb** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Thomas 'PointedEars' Lahn wrote:
[color=blue]
> Randy Webb wrote:
>
>[color=green]
>>Thomas 'PointedEars' Lahn wrote:
>>[color=darkred]
>>>Jan Buchwald wrote:
>>>
>>>>navigator.u serAgent returns information about the user operting system,
>>>>Browser etc.
>>>
>>>No, it does not.[/color]
>>
>>Yes it does. And without flaw.[/color]
>
>
> Nonsense. Given a suitable tool (like PrefBar), I can
> fake *any* information that this host object returns.[/color]

While it is 100% possible to modify/alter the userAgent string, you are
making a fundamental flaw in assuming that I do not know how to identify
a browser by other means. And the fact that you are spoofing the
userAgent string, in and of itself, gives a certain amoung of insight
into the OS and Browser.

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq

**Richard Cornford** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Jan Buchwald wrote:[color=blue]
> navigator.userA gent returns information about the
> user operting system, Browser etc.[/color]

The navigator.userA gent property is a manifestation of the HTTP
specified User-Agent header. However, the HTTP specification makes no
requirements about the contents or format of that header (it merely
suggests that it "can" contain particular information in a particular
format) and the vast majority of browsers disregard the suggestions in
the HTTP specification entirely.
[color=blue]
> Usually you get somthing like:
>
> Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)[/color]

Yes, I have three browsers that use that one by default (only one of
them is IE 6).
[color=blue]
> or
> Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
> .NET CLR 1.0.3705; .NET CLR 1.1.4322)
> or
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4)
> Gecko/20030624 Netscape/7.1 (ax)
>
> imho there is too many information, most of it confusing for the
> user.[/color]

The user, in the sense of the user of the browsers, has little reason to
be interested in any of that information (unless they intend to
configure their browser to spoof another, assuming it doesn't already do
that by default).
[color=blue]
> What I would like to do is, evaluate the information and
> reduce it to the opereting system and browser version.[/color]

That is not at all a useful thing to be doing because you can extract
the information from the string but that information does not
necessarily have any relationship with the user's operating system or
the browser type or version that they are using.

That is, the userAgent string contains what it contains and that can be
extracted, but what it contains has no certain one-to-one relationship
with individual browser type, version and OS configurations.
[color=blue]
> e.g.
>
> MSIE 6.0, Windows XP
>
> or
>
> Netscape 7.1, Windows 98
>
> obstacles:
> - As far as I know, the structure of the data returned by
> navigator.userA gent depends on the browser.[/color]

Inevitably (as it originates with the browser), but it also may be
subject to user configuration of the browser (and OS configuration in
some cases. e.g. the dot Net stuff on Windows). But you still have the
fact that the reported information does not necessarily correspond with
the actual situation.
[color=blue]
> So a specification for each browser would be a good
>starting point, any ideas where to find?[/color]

No, that would be utterly useless. The most you could know would be the
default user agent strings for each browser (and you will not find it
easy to even identify all web browsers), but even IE allows the user
complete freedom to re-configure the user agent string/header. Other
browsers offer extensive lists of user selectable user agent strings in
their preferences, all of which spoof some other browser/OS combination
more or less completely.
[color=blue]
> - Why do I get "Windows NT 5.1" instead of "Windows XP"?[/color]

Ask Microsoft.
[color=blue]
>Any other synonyms?[/color]

Potentially thousands.
[color=blue]
> I neither tested it on macs nor linux systems...[/color]

Not testing is always a good way of remaining ignorant of issues.
[color=blue]
> I would appreciate any help and hints, maybe somebody has done
> something similiar before...[/color]

Probably everyone has attempted something similar at one time or
another, but the better javascript authors have recognised that the
information available is of absolutely no real use at all (because it
cannot distinguish individual browser types or versions) and abandoned
any interest in identifying browsers in favour of "feature detection".

Richard.

**Thomas 'PointedEars' Lahn** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Randy Webb wrote:
[color=blue]
> Thomas 'PointedEars' Lahn wrote:[color=green]
>> Nonsense. Given a suitable tool (like PrefBar), I can
>> fake *any* information that this host object returns.[/color]
>
> While it is 100% possible to modify/alter the userAgent string, you are
> making a fundamental flaw in assuming that I do not know how to identify
> a browser by other means. [...][/color]

It is also possible to fake information that other host objects return.
In fact, e.g., there are libraries for it available on the Net in order
to make scripts "cross-browser" (IMHO a misguided approach, but they
exist) that do exactly this. Implemented on the client-side, you would
not be able to tell what is the real object model and thus what is the
real browser. And, for example, let us assume that I noticed that clients
running on *x are somehow blocked by many Web sites which information I
nevertheless need. Given the source code of my application, which is
likely on GNU/Linux, who would be able keep me from compiling my user agent
so that it is not blocked any further? Who would be able to keep me from
distributing it then (under the GNU GPLv2, for example), for the greater
good? And, more simple, who would keep me from having client-side
scripting disabled? If you as the author restricts access to clients
with client-side scripting enabled, you would be a fool. So you would
let me in, using *any* browser (because you have nothing else than the
User-Agent header at hand *then*, and I will fake it).

Most certainly *you* are the one without enough insight in the matter here.
If you still think I am wrong, provide proof that it can be done anyway.

PointedEars

**Jan Buchwald** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Listen guys,

I'm aware of the fact that, you can fake your IP, Browser, OP etc...stuff.
All I'm asking for, is a way of getting information of the normal user, who
has no interest of faking any kind of information about himself.

I don't care about the 1% freak people out there playing around with PrefBar
or something...

**Thomas 'PointedEars' Lahn** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Richard Cornford wrote:
[color=blue]
> Jan Buchwald wrote:[color=green]
>> - Why do I get "Windows NT 5.1" instead of "Windows XP"?[/color]
>
> Ask Microsoft.[/color]

Not necessary. The Windows XP kernel is the 5.1 version of the Windows NT
kernel, as the Windows 2000 kernel is its 5.0 version (and with Win2k
clients, if not faking, will show "Windows NT 5.0"). Simple as that :)

PointedEars

**Thomas 'PointedEars' Lahn** · Jul 23 '05, 01:01 PM

Re: navigator.userA gent

Jan Buchwald wrote:
[color=blue]
> I don't care about the 1% freak people out there playing around with
> PrefBar or something...[/color]

ROTFL! YMMD!

PointedEars

**kaeli** · Jul 23 '05, 01:02 PM

Re: navigator.userA gent

In article <1497761.LZeUHj SS8f@PointedEar s.de>, PointedEars@web .de
enlightened us with...[color=blue]
>
> Nonsense. Given a suitable tool (like PrefBar), I can
> fake *any* information that this host object returns.
>[/color]

Because the normal people who surf the net do this all the time and all.

--
--
~kaeli~
If it's tourist season, why can't we shoot them?

http://www.ipwebdesign.net/wildAtHeart

http://www.ipwebdesign.net/kaelisSpace

**Richard Cornford** · Jul 23 '05, 01:03 PM

Re: navigator.userA gent

Thomas 'PointedEars' Lahn wrote:[color=blue]
> Richard Cornford wrote:[color=green]
>> Jan Buchwald wrote:[color=darkred]
>>> - Why do I get "Windows NT 5.1" instead of "Windows XP"?[/color]
>>
>> Ask Microsoft.[/color]
>
> Not necessary. The Windows XP kernel is the 5.1 version of the
> Windows NT kernel, as the Windows 2000 kernel is its 5.0 version
> (and with Win2k clients, if not faking, will show
> "Windows NT 5.0"). Simple as that :)[/color]

That there is a direct relationship between the two was obvious, but why
either one was chosen to appear in the user agent header remains
unknown.

Richard.

**Randy Webb** · Jul 23 '05, 01:03 PM

Re: navigator.userA gent

Thomas 'PointedEars' Lahn wrote:[color=blue]
> Randy Webb wrote:
>
>[color=green]
>>Thomas 'PointedEars' Lahn wrote:
>>[color=darkred]
>>>Nonsense. Given a suitable tool (like PrefBar), I can
>>>fake *any* information that this host object returns.[/color]
>>
>>While it is 100% possible to modify/alter the userAgent string, you are
>>making a fundamental flaw in assuming that I do not know how to identify
>>a browser by other means. [...][/color]
>
>
> It is also possible to fake information that other host objects return.
> In fact, e.g., there are libraries for it available on the Net in order
> to make scripts "cross-browser" (IMHO a misguided approach, but they
> exist) that do exactly this. Implemented on the client-side, you would
> not be able to tell what is the real object model and thus what is the
> real browser. And, for example, let us assume that I noticed that clients
> running on *x are somehow blocked by many Web sites which information I
> nevertheless need. Given the source code of my application, which is
> likely on GNU/Linux, who would be able keep me from compiling my user agent
> so that it is not blocked any further? Who would be able to keep me from
> distributing it then (under the GNU GPLv2, for example), for the greater
> good? And, more simple, who would keep me from having client-side
> scripting disabled? If you as the author restricts access to clients
> with client-side scripting enabled, you would be a fool. So you would
> let me in, using *any* browser (because you have nothing else than the
> User-Agent header at hand *then*, and I will fake it).[/color]

Since you missed the juxt of my argument, I wont bother arguing with
your babble. Yes, its arbitrary to fake anything in a browser. I suppose
that means a browser detection script would fail in 5-10% of browsers
out. Not many people know what a userAgent string *is* much less how to
fake it. Those that know how to fake it are in a very slim minority.

So, let me rephrase what I said, in a manner you might be able to
comprehend. Ready? Read this twice so that *maybe* you can comprehend
what I say.

I *can* (in 99% of cases) identify a browser WITHOUT looking at the
userAgent string. All done with feature detection. Now, let me qualify
that 1%. If the 1% of people who know how to alter/modify the DOM of a
browser to the extent that it looks like another browser, then more
power to them. All it means is they are ignorant/stupid enough to modify
the browser to the point that a script won't run in it, just to prove
they can. Well, that 1% of the web can KMWA.
[color=blue]
> Most certainly *you* are the one without enough insight in the matter here.
> If you still think I am wrong, provide proof that it can be done anyway.[/color]

I am still waiting on you to reply to my challenge of limiting a page to
NS6 and you haven't. I guess that means you admit defeat in the matter?

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq

navigator.userAgent

navigator.userAgent

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment