这是indexloc提供的服务,不要输入任何密码
Skip to content

Make platform a low-entropy hint #213

@miketaylr

Description

@miketaylr

It's already possible to infer platform (OS) through various web platform APIs, without looking at the User-Agent header or navigator.userAgent, so I think we should move "platform" from high entropy to low. Platform version should remain high entropy.

Some examples:

  • canPlayType + HLS MIME can be used to detect Android (for Chrome & Firefox), or macOS (Safari, pre-Chromium Edge)
  • Blob.size can be used to detect native CRLF (Windows) vs LF (Mac / Linux) line endings
  • Detecting scrollbar width to infer OS (via innerWidth & clientWidth)
  • Detecting OS specific and available fonts (-apple-system, BlinkMacSystemFont, Segoe UI, etc.)
  • Canvas / WebGL fingerprinting techniques (Notably Picasso, among other research, etc.)
  • navigator.platform, navigator.appVersion, navigator.oscpu (Gecko-only)

In terms of what this would mean, we would stick Sec-CH-UA-Platform into the low-entropy table, and update relevant bits here: https://wicg.github.io/ua-client-hints/#interface

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions