Laan Tungir
f4250de54c
Present the browser as Chrome, Firefox, Safari, Edge, or a mobile browser (Chrome Android, Safari iOS, Samsung Internet, Firefox Android) plus Googlebot/Bingbot, at both the User-Agent and JavaScript level. - src/fingerprint.rs: 15 internally-consistent presets, resolve(), JS config - www/js/fingerprint-spoof.js: stealthy overrides for navigator.*, userAgentData (Client Hints), screen, devicePixelRatio, outer size, touch points, matchMedia, WebGL vendor/renderer, window.chrome - Engine UA via Settings::set_user_agent with site-specific quirks disabled - Settings UI (Browser Identity section), hamburger submenu, and a sovereign://fingerprint debug page comparing spoofed vs real values - Settings persist and sync via NIP-78 Verified in real WebKitGTK 2.52.6 across six presets; sovereign:// pages are never spoofed. Sec-CH-UA request headers are deferred (needs a WebKitGTK web-process extension).
61 lines
2.4 KiB
HTML
61 lines
2.4 KiB
HTML
<!DOCTYPE html>
|
|
<html class="light">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>Browser Identity</title>
|
|
<link rel="stylesheet" href="sovereign://fingerprint.css">
|
|
</head>
|
|
<body>
|
|
<h1>Browser Identity <button class="btn" id="refresh-btn">Refresh</button></h1>
|
|
|
|
<div id="status-msg" class="status"></div>
|
|
|
|
<h2>Status</h2>
|
|
<div class="card" id="fp-status">
|
|
<div class="info-row"><span>Spoofing</span><span id="fp-enabled">—</span></div>
|
|
<div class="info-row"><span>Mode</span><span id="fp-mode">—</span></div>
|
|
<div class="info-row"><span>Active identity</span><span id="fp-identity">—</span></div>
|
|
<div class="info-row"><span>Category</span><span id="fp-category">—</span></div>
|
|
</div>
|
|
|
|
<h2>Spoofed values</h2>
|
|
<p class="note">The <strong>Spoofed</strong> column is what external sites see.
|
|
The <strong>This page (real)</strong> column is read live from this
|
|
<code>sovereign://</code> page, which is never spoofed — so you can compare
|
|
the two.</p>
|
|
<div id="fp-table-container">
|
|
<table id="fp-table">
|
|
<thead>
|
|
<tr><th>Property</th><th>Spoofed</th><th>This page (real)</th></tr>
|
|
</thead>
|
|
<tbody id="fp-table-body"></tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<h2>Known limitations</h2>
|
|
<ul class="limitations">
|
|
<li>Web Workers and Service Workers get their own <code>navigator</code> and
|
|
are <strong>not</strong> patched — they still see the real WebKit values.</li>
|
|
<li><code>Sec-CH-UA*</code> HTTP request headers are <strong>not</strong>
|
|
sent; the HTTP-level Client Hints do not match the JS surface.</li>
|
|
<li>TLS/JA3/JA4, HTTP/2 frame fingerprints and engine behavior still reveal
|
|
WebKitGTK.</li>
|
|
<li>Mobile presets change JS-visible values only; the actual layout viewport
|
|
is unchanged.</li>
|
|
</ul>
|
|
|
|
<h2>Test sites</h2>
|
|
<div class="card">
|
|
<div class="actions">
|
|
<a class="btn" href="https://browserleaks.com/javascript" target="_blank">browserleaks.com/javascript</a>
|
|
<a class="btn" href="https://www.whatismybrowser.com/" target="_blank">whatismybrowser.com</a>
|
|
<a class="btn" href="https://browserleaks.com/client-hints" target="_blank">browserleaks.com/client-hints</a>
|
|
<a class="btn" href="https://abrahamjuliot.github.io/creepjs/" target="_blank">creepjs</a>
|
|
</div>
|
|
</div>
|
|
|
|
<script src="sovereign://fingerprint.js"></script>
|
|
</body>
|
|
</html>
|