Browser name LEAKS because of InstallTrigger

[sdfergergweg]

please make these options to block InstallTrigger and fake window.chrome.webstore and other objects
because http://proxyleak.com can detect Firefox name

you can read about it on https://christopherdiehl.github.io/posts/browser-fingerprinting/

thank you

[sereneblue]

Hi @InstallTrigger, thanks for pointing this out! That's a pretty good resource that could also help improve spoofing for some of the other profiles. This will be addressed in a future update.

[Thorin-Oakenpants]

	let isFFsum = ("undefined" != typeof InstallTrigger ? true : false)
		+ ("InstallTrigger" in window ? true : false)
		+ (typeof InstallTriggerImpl !== "undefined" ? true : false)
	console.log(isFFsum > 0 ? "Firefox" : "Not Firefox")

Good luck beating that. You, and I can't stress this enough, cannot hide your browser engine. There are literally hunhdreds of ways to reliably detect it. The above script is really "gecko", not "Firefox" specifically. That said, anything that fools naive scripts is all good - just as long as you are aware that you can't really hide tampering from advanced scripts, and for many you still leak the real values via other methods or equivalency : and when that happens, you increase your entropy. The only long term real solution is for in-browser solutions

[sereneblue]

	let isFFsum = ("undefined" != typeof InstallTrigger ? true : false)
		+ ("InstallTrigger" in window ? true : false)
		+ (typeof InstallTriggerImpl !== "undefined" ? true : false)
	console.log(isFFsum > 0 ? "Firefox" : "Not Firefox")

Good luck beating that. You, and I can't stress this enough, cannot hide your browser engine. There are literally hunhdreds of ways to reliably detect it. The above script is really "gecko", not "Firefox" specifically. That said, anything that fools naive scripts is all good - just as long as you are aware that you can't really hide tampering from advanced scripts, and for many you still leak the real values via other methods or equivalency : and when that happens, you increase your entropy. The only long term real solution is for in-browser solutions

Agreed. So far I am able to spoof the above check. I'm working on implementing some of the other browser APIs/variables that were linked in OP.

[Thorin-Oakenpants]

you'll never win :) edit: i.e win against me :)

note: the value shown is accumulative, and I only ever set true in code (we start with false), i.e it is not the result of subsequent tests e.g. if it's already true in say "system font" but you manage to beat math, it still shows true

• i.e I only need to get isFF = true once

good luck beating that :)

[sereneblue]

you'll never win :) edit: i.e win against me :)

note: the value shown is accumulative, and I only ever set true in code (we start with false), i.e it is not the result of subsequent tests e.g. if it's already true in say "system font" but you manage to beat math, it still shows true

* i.e I only need to get isFF = true once

good luck beating that :)

Haha, with the ever growing number of browser APIs, it's a game of whack a mole. We'll just have to hope that most fingerprinting scripts are naive. :)

[sereneblue]

This issue is resolved in v0.21.22.

[ponces]

I can't make this to work while using a whitelist.

My scenario is: i need to spoof window.chrome to not be undefined on Firefox.

I'm using the real profile on my main config and I have a couple of sites on a whitelist rule with a chrome profile. For some reason, one of the sites (an internal portal at my company) detects window.chrome as undefined but only if I use the whitelist approach.

However, if I have the chrome profile configured as my main rule, without any whitelist one, everythink works as expected.

Any ideia?

[sereneblue]

window.chrome is a property of Chrome based browsers. It does not exist in Firefox so it should be undefined. Are you using a Chrome profile with the whitelist rules?

[ponces]

window.chrome is a property of Chrome based browsers. It does not exist in Firefox so it should be undefined. Are you using a Chrome profile with the whitelist rules?

Maybe I was not so clear.
I know it shouldn't exist on Firefox and that is why I was expecting to be able to spoof it with the chrome profile. But apparently, it's only able to do it by using the profile as the main one and but not on the whitelist...

[sereneblue]

@ponces Thanks for pointing out this issue. Whitelist profiles were missing some injection properties. This has been patched in the latest version.

[ponces]

Working perfectly now. Thanks!