fixing some navigator object values

[noellarkin]

the value of the navigator object "webdriver" is supposed to be one of the indicators of whether a browser is a real user or being controlled by some kind of bot automation.
In Firefox, the value of navigator.webdriver is "false", whereas in Pale Moon, the value is "undefined".
Given that most feature detection algorithms try to block automated bots, perhaps it would be a good idea to set Pale Moon's `navigator.webdriver` value to "false" as well? AFAIK there aren't any automation frameworks that are compatible with it anyway.

[Moonchild]

I'm sorry but I don't see why "undefined" would be problematic. We don't support WebDriver and will not support it. Indicating a value would suggest we do support it.

In addition, note the following quote:

The navigator.webdriver attribute is meant as an indication to web authors that a document is visited by WebDriver. It is important to stress that it is not meant as a fool-proof way to detect that a website is being visited by a browser automation tool, but as a tool for web documents to take alternate code paths.

It's not there to detect browser automation tools; it's only there to provide differing results; not unlike the way this forum behaves differently when visited by known bots.

[noellarkin]

I agree, perhaps the webdriver property wasn't originally intended to detect automation, however there's abundant evidence of it being used to do so in the wild. Some examples around the web:

Here's an article from Datadome (a feature detection algorithm):
https://datadome.co/threat-research/det ... um-chrome/

A straightforward and well-known approach to detecting Selenium is to test if navigator.webdriver is equal to true.

A guide by fingerprintJS (a popular browser fingerprinting library) on how to DIY a bot detection script:
https://fingerprint.com/blog/build-your ... on-script/

One of the simplest places to find signals for bot detection is to look at the Navigator object. This object is a part of the Window interface and represents the state and identity of the user's browser. It has information about the browser itself, including its version, the operating system it's running on, and various capabilities of the browser environment.
Within the navigator object, the webdriver property is especially useful as it indicates whether the browser is being controlled by automation tools such as Selenium, Puppeteer, or other automated testing frameworks. Unlike many other indicators that require interpretation or analysis, these tools typically set the navigator.webdriver property to true to indicate automation control. Add this property to the detectors object.

And pretty much every single article on bot detection
https://medium.com/@browserscan/browser ... 2ac81156ae

When Selenium or Puppeteer controls the browser, it sets the window.navigator.webdriver property to true. This is a standard way to let websites know that the browser is being controlled by automation tools. However, this also means that any website that can execute JavaScript can detect this property.

It seems to me that - - especially since Pale Moon doesn't even work with Selenium webdriver, there's nothing lost by setting the property as "false" instead of undefined, especially when feature detection algos are specifically looking for webdriver values as an obvious indicator of automation.

[Moonchild]

Sure. This will take all but 5 minutes to implement and it's part of the web drafts anyway. Takes less time than continuing to discuss

EDIT: https://repo.palemoon.org/MoonchildProductions/UXP/commit/0886ccfa955f5b24a5e63a310d9f543ab180049c

[noellarkin]

that was FAST, thank you

[Moonchild]

that was FAST, thank you

Note that this missed the current dev cycle (there's a release tomorrow) so it won't be in release for a little while yet.

[noellarkin]

Looking forward to it