Looking for a way to change Android's default User Agent string

General
1

Hey there,

I am trying to modify Android’s default User Agent string, which I assume is obtained via WebView.

Recently I have tried out Fauxx, a tracking and data poisoning app. It can fetch the system’s default UA to use for queries. I assume this uses WebView to send the queries to Google and such.

It works as you would expect, but this left me wondering:

How would I modify Android’s default UA?

I guess it is either baked into Chromium WebView (I am on vanilla LineageOS, Android 15), or it is dynamically constructed with some parameters from build.prop or so. (Or something completely different. :sweat_smile: )

Does anyone have any experience with this?

I should mention the goal, before anyone asks:

I am aware that modifying it could make me stand out, and it is probably best to set it to Brave’s, which I actually browse with, so it mixes with the poisoned data.

However, I want to modify the system one, so no app can fetch the default UA, which on LineageOS 22.2 contains the phone model and exact build.

(Note: Newer versions may already use a reduced string, see below.)

Some additional info:

WebView’s dev settings can be invoked with any activity launcher. However, you can only set flags there.

Fun Fact: In 2024 Google of all companies decided to use a default reduced UA string starting with Android 17 for more privacy.

2

What’s the goal of this? Changing UA is likely worse for privacy when combined with TLS fingerprinting techniques.

1 Like
3

I guess I could have formatted it better, but both the concern and the goal are already in there. :wink:

So yeah, I already thought about that.

The thing is, when not using GrapheneOS with its Vanadium WebView (or whatever defines it) possibly every smartphone user has a UA discrepancy between what I assume to be WebView invoked connections (apps) and their browser.

So apps get this UA (presumably until Android 17)

Mozilla/5.0 (Linux; Android 15; [Phone Model] Build/XXXX.YYYYYY.ZZZ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/151.0.XXXX.YYY Mobile Safari/537.36

while e.g. Brave sends this

Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36

so I guess you would be more fingerprintable when not modifying the system UA.

4

(Couldn’t find info if bumps are allowed.)

Anyone with expertise on this?

5

Apps can already identify your device and there’s absolutely no anonymity from apps on Android or iOS. So your method would not help achieve your goal. The best way to preserve privacy from privacy invasive services is not to use them or use them in the browser. If you want anonymity use Tor Browser on desktop

6

I know there are other things apps can utilize to identify me. I don’t use apps that fall into the invasive category.

However, the concern is not if the app does indentify me, but rather that it “leaks” the info to a website through WebView.

There are a lot of apps that are simple WebView wrappers for a website, e.g. GMaps WV or AI assistants duckAssist.
Or for example a video downloading app that parses streams through a WebView browser. Or general external download managers.

In themselves these app might be perfectly fine, but they (unintentionally) report your exact phone model and build version to the website.
In this case it is not about the app identifying you, it is the website you visit.

This is what I look to mitigate.

Of course many apps could just be avoided, but if anyone is curious, try disabling the WebView app and see which apps no longer work.
If you’re not on GrapheneOS with its Vanadium WebView, these apps might expose this info to websites.
And if you’re curious what your personal user agent string is, have Fauxx (or any other app) tell you.

As I mentioned, this is apprently no longer a concern for Android 17, but there are still devices getting security updates on a lower version.
And Google could just deem it as too private again and revert it in a later version.