{{draft}}
User story:
As a CheckUser, it would be helpful if non-standard user-agent strings are flagged/highlighted so it is easier to spot spoofed user agents.
Implementation plan:
TBD
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T139810 RFC: Overhaul the CheckUser extension | |||
| Open | Niharika | T236225 [Epic] CheckUser 2.0 Improvements | |||
| Open | Niharika | T237593 [Epic] CheckUser 2.0: Compare | |||
| Open | None | T234980 Implement an option to highlight non-standard user-agent strings in CheckUser |
Event Timeline
Comment Actions
That would indeed be helpful to see. My first thought was that we can flag UAs which don't contain expected keywords (for example "Chrome" or "Webkit") but I guess if someone is spoofing a UA to evade a check, they would probably try and mimic a real-UA as much as possible, right?
Comment Actions
For this, it seems doing it on flay and frontend make sense.
I'm pretty sure there are libraries that parse UA and tell you if it belongs to a human user or not. They are widely needed in routing and analytics. Varnish uses something (don't know what exactly) to fill webrequest fields like access_method, agent_type, and user_agent_map. Let me search for something like this for javascript (we can't use npm packages in production though 😢)
Comment Actions
Here's two https://github.com/faisalman/ua-parser-js and https://www.npmjs.com/package/useragent the latter is node-based only though.
Comment Actions
The tool https://en.wikipedia.org/wiki/User:GeneralNotability/InvestorGoat.js is able to parse and compare user agent strings.