Why this topic matters to me now
After three notes on two mirrors, the lab genre, and profile consistency, it makes sense to step down to the most familiar web token.
User-Agent.
Everyone sees it. Everyone parses it. Everyone has “fixed” it at least in their head. That is why there is a lot of magic around UA and little discipline.
I read it like this: it is the browser’s claim about itself. Not proof. Not a verdict. A hypothesis that must be checked against surface, behavior, and network.
Why people still look at UA at all
Because the layer is still alive.
Servers, CDNs, analytics, old antifraud rules, mobile storefronts — still lean on the string. Even a reduced modern UA carries a coarse version and family. Client Hints added structure: brands, platform, mobile flag. That is easier to parse than one long tail.
But convenience ≠ proof.
Any claim is cheap. A cheap claim cannot sit in the foundation of a “bot” or “human” verdict. It can sit in the foundation of a question: “what else must be true if this is true?”
If the browser called itself a fresh Chrome on a phone — I expect a certain Web API floor, window geometry, sensors, touch behavior. Not a spoofing recipe. An expectation of consistency.
Client Hints are useful, but not sacred
Hints are cut by policies, extensions, privacy modes. Some fields do not always arrive. Some can be limited. Chrome docs describe User-Agent Client Hints as a response to the bloated UA and as a layer with disclosure control.
For the lab this matters twice.
First: missing a full set of hints is not yet automation. Sometimes it is just privacy.
Second: having “pretty” hints is not yet honesty. A pretty claim without a confirming surface is the same story as a badge on the desk without a tool next to it.
I do not publish how to tune brands or sec-ch-ua. That is a red line of the series. What is publicly useful is different: stop trusting the string as a sentence.
What I share without spoofing recipes
Three working habits.
- I write two columns side by side: “what is claimed” and “what is measured.” If the columns diverge — that is a contradiction signal, not instantly a “bot” label.
- I lower the weight of solitary UA parsing. A version from the string without a feature-floor and without cross-checks is a weak story.
- I do not confuse a reduced UA / private mode with automation. Privacy Sandbox and reduced UA are user everyday life. Stamping that is a design mistake.
The series is called “dual laboratory” for a reason. A detector without a browser grows theories. A browser without a detector tunes a storefront. UA is the perfect place where both mistakes meet: you trust the claim too much, or you “fix” it too easily.
The next note is about version floor via Web APIs: how open detectors assess the capability floor without staring blindly at the string.
Public anchors: https://developer.chrome.com/docs/privacy-security/user-agent-client-hints https://developer.chrome.com/docs/privacy-security/
Public frame (links)
Chrome docs on User-Agent Client Hints say it plainly: hints are requested, cut, and depend on policy. Nearby — the privacy / reduced UA corpus. Open consistency pages like x-bot.tech remind you: surface classification and “proof of personhood” are different genres.
What this changes in detect and/or build (no specifics)
In detect I teach myself to write “the client claims X,” not “the client is X.” In research Chromium the goal is not “tune the string for a site,” but to understand which claim I am making and what it must agree with on the surface. An experiment that changes only UA/CH is unfinished for me until I have looked at neighboring layers.
What I will not say, and why
No recipes for spoofing UA/CH against concrete antifraud, no lists of “working” strings, and no internal weights of a production contour. Literacy of reading a claim — yes. An instruction “how to pass X” — no.
Short first-person takeaway
User-Agent and Client Hints remain useful claims. I read them carefully and do not trust them blindly. In the dual lab they are a hypothesis on the way in, not a verdict on the way out.
