-
Notifications
You must be signed in to change notification settings - Fork 80
Closed
Description
It's already possible to infer platform (OS) through various web platform APIs, without looking at the User-Agent
header or navigator.userAgent
, so I think we should move "platform" from high entropy to low. Platform version should remain high entropy.
Some examples:
- canPlayType + HLS MIME can be used to detect Android (for Chrome & Firefox), or macOS (Safari, pre-Chromium Edge)
- Blob.size can be used to detect native CRLF (Windows) vs LF (Mac / Linux) line endings
- Detecting scrollbar width to infer OS (via innerWidth & clientWidth)
- Detecting OS specific and available fonts (-apple-system, BlinkMacSystemFont, Segoe UI, etc.)
- Canvas / WebGL fingerprinting techniques (Notably Picasso, among other research, etc.)
- navigator.platform, navigator.appVersion, navigator.oscpu (Gecko-only)
In terms of what this would mean, we would stick Sec-CH-UA-Platform
into the low-entropy table, and update relevant bits here: https://wicg.github.io/ua-client-hints/#interface
Metadata
Metadata
Assignees
Labels
No labels