bugGNU Wget - Bugs: bug #57884, wget reveals my operating system...

 
 

bug #57884: wget reveals my operating system to the server

Submitter:  Bruno Haible <haible>
Submitted:  Sun 23 Feb 2020 04:52:05 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  rockdaboot
Originator Name:  Open/Closed:  Closed
Release:  1.19.1 Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  trunk
Planned Release:  1.21 Regression:  None
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 24 Feb 2020 10:10:56 AM UTC, comment #6: 

There seem to be concerns and actions taken by browser vendors about regarding the User-Agent header. It's about "freezing" the User-Agent string once and for all to avoid compatibility issues.

Is this an option for us ?

https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/-2JIRNMWJ7s/yHe4tQNLCgAJ

https://techcommunity.microsoft.com/t5/discussions/new-privacy-oriented-feature-added-to-edge-82-freeze-user-agent/m-p/1165269

Tim Ruehsen <rockdaboot>
Group administrator
Mon 24 Feb 2020 08:57:57 AM UTC, comment #5: 

I see the point but start be become curious about backwards compatibility and about how browsers and other web clients behave.

Transmitting the OS type is likely not handled by GDPR, as it is likely not considered "personal data" (data that is bound to a real person). Otherwise, all the browser and tool vendors had been sued already.

Maybe we should bring this up on gnu-prog-disc ML for a broader discussion ?

Firefox
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0

Chromium
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36

Konqueror
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.34 (KHTML, like Gecko) konqueror/5.0.97 Safari/534.34

Curl
User-Agent: curl/7.67.0

aria2c
User-Agent: aria2/1.35.0

Tim Ruehsen <rockdaboot>
Group administrator
Sun 23 Feb 2020 06:32:04 PM UTC, comment #4: 

The HTTP 1.1 RTC, section 5.5.3 https://tools.ietf.org/html/rfc7231#section-5.5.3 , says that the version number is optional, and """A user agent SHOULD NOT generate a User-Agent field containing needlessly fine-grained detail ...  Overly long and detailed User-Agent field values increase request latency and the risk of a user being identified against their wishes ("fingerprinting")."""

Bruno Haible <haible>
Sun 23 Feb 2020 06:28:22 PM UTC, comment #3: 

What about the version number? It can reveal whether a system is regularly patched or not. A string like "User-Agent: Wget/1.10.2" would be an invitation to search for security vulnerabilities on all ports of the machine.

Bruno Haible <haible>
Sun 23 Feb 2020 06:02:27 PM UTC, comment #2: 

Thanks for the heads up !

Tim Ruehsen <rockdaboot>
Group administrator
Sun 23 Feb 2020 04:54:18 PM UTC, comment #1: 

See the attached screenshot:
"User-Agent: Wget/1.19.1 (linux-gnu)"
is too much private info.

Bruno Haible <haible>
Sun 23 Feb 2020 04:52:05 PM UTC, original submission:  

When I use wget to retrieve a web page, wget reveals my operating system to the server, through the 'User-Agent' header.

The server does not need to know my operating system. Following the "privacy by design" principle, which is now European law by virtue of the GDPR since 2018, the client should not transmit the operating system.

Likewise for the wget version number. It is a data point that can help the server to identify my machine.

How to reproduce:
1. Install wireshark.
2. Run the command
   wget -q -O - -T 30 http://translationproject.org/team/index.html
3. Look at the wireshark packets of type HTTP.


Bruno Haible <haible>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #48482:  wget-dump.png added by haible (23KiB - image/png - Screenshot of HTTP GET packet)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rockdaboot (Posted a comment)
  • -email is unavailable- added by haible (Submitted the item)
  •  

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-02-23 rockdaboot StatusNone Fixed
        Assigned toNone rockdaboot
        Open/ClosedOpen Closed
        Fixed ReleaseNone trunk
        Planned ReleaseNone 1.21
    2020-02-23 haible Attached File- Added wget-dump.png, #48482

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code