How to deal with persistent cookies and tracking

[RMKoRn]

I can't get rid of these people any suggestions https://user-agents.net/string/mozilla-5-0-linux-android-9-sm-j737v-applewebkit-537-36-khtml-like-gecko-chrome-83-0-4103-101-mobile-safari-537-36
And on Facebook
Password Change
Created Apr 9, 2020, 8:14 PM
IP Address 45.27.132.nnn
Browser Mozilla/5.0 (Linux; Android 9; SM-J737V Build/PPR1.180610.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/80.0.3987.162 Mobile Safari/537.36

[FBAN/FB4A;FBAV/123.0.0.44.555;FBBV/123456789;FBDM/{density=2.0,width=720,height=1280};FBLC/en_US;FBRV/123456789;FBCR/Verizon ;FBMF/samsung;FBBD/Verizon;FBPN/com.facebook.katana;FBDV/SM-J737V;FBSV/9;FBOP/1;FBCA/armeabi-v7a:armeabi;]

Cookie kceP********************

[edited by: not2easy at 1:18 pm (utc) on Mar 7, 2021]
[edit reason] delinked and anonymized possible PII [/edit]

[not2easy]

Hi RMKoRn and Welcome to WebmasterWorld [webmasterworld.com]

Are you trying to prevent these particular UAs from visiting your website? Where are you seeing this particular UA string - and are they always from the same IP range?

I have edited your post to anonymize any personal identifiers, so the numbers here are not quite the same as what was originally posted. This is commonly done for privacy, the number format remains the same but numbers are replaced with 1-2-3 strings.

[lucy24]

:: log search for string “katana” ::

Hm. I don’t see many--not enough to be a legitimate FB-related function--but the ones I do find all give
fbapp://350685531728/unknown
as referer. Yah, that looks a bit sketchy. All the ones I see were blocked, with no indications of humanity. All are requests for images.

:: cross-check in headers ::

Oh, now that's interesting. There are more hits than there were in logs, because now I find
X-Requested-With: com.facebook.katana
which appear to be legitimate.

But the ones with katana in the User-Agent were all blocked due to various header deficits, notably that the UA begins with a non-word character (the [ bracket). They also come with a slew of other X- headers.

:: return to logs ::

Most of my logged katanas came in a bunch, but one of them was immediately preceded by a request for the same file, with a different UA, this time giving

https://www.google.com/blank.html

as referer. I've now forgotten what that is. It's got something to do with images and mobiles, and gets rewritten to a one-pixel gif, which must mean that at some time in the past I knew what it did.

Conclusion: Sure, go ahead and block ’em.

[not2easy]

I have never seen the 'armeabi' part of the string, a search says it is related to android dev libs. Some FB app?

[RMKoRn]

Yes I normally see this UA string but no it's not always the same IP address it changes my understanding is I have many UA's I hope this answers your question I'm new to all this and no it's not a website it's my Samsung Galaxy Android 9

[RMKoRn]

I'm sorry I can't remember the name I think it was Lucy said go ahead and block em that's my problem I don't know how to any advice would be appreciated thank you for your time

[not2easy]

That

go ahead and block ’em

advice was for dealing with unwanted traffic to a website. To deal with cookies and trackers on your device it is up to browser settings and privacy settings and choices. Some browsers are easier to configure than others and some are on a mission to protect users from invasive technology.

We have a category that covers most Browsers [webmasterworld.com] to help you learn the what and why. The Google Chrome Browser [webmasterworld.com] is not the most user friendly and secure browser out there, you can see new security issues popping up frequently. The Firefox Browser [webmasterworld.com] allows you to run FaceBook within its own container so your non-FB browsing is not part of their tracking. Just about a year ago the FF browser add that FB "container" policy: [webmasterworld.com...]

FaceBook does not allow users to login if cookies are disabled, it is their bread and butter, but you can limit their data gathering to their own properties.

[lucy24]

that's my problem I don't know how to

Do you mean that you don't know how to issue a 403 at all? Or do you mean that you can't figure out how to block visitors whose UA contains the string “katana”? If it's the latter, how do you normally handle access control? There's more than one approach; for example on an Apache server you could use either SetEnvIf + AuthThingummy, or a RewriteRule with condition.

[not2easy]

Originally, the question was about UAs and appeared to be related to blocking unwanted traffic. As reflected in the updated title, the topic has evolved from blocking UAs into tracking and persistent apps (?) with cookies seen in Chrome Browser that seem related to unwanted tracking cookies/apps.

it's not a website it's my Samsung Galaxy Android 9

Yes, it is still here in the UA forum, we don't have a forum for browser cookies so we're trying to offer ideas on avoiding unwanted cookies/tracking.

[RMKoRn]

Lucy 24 I don't know how to issue a 403 on my Android 9 but I'm sure I can learn how to I just want to say I appreciate your help and the time you spend
not2easy I took your advice and I downloaded the new Firefox 86 I'm learning how to set it all up right now I do listen to your guys's advice and I'm willing to learn and I want to thank you for your time and your help sincerely RMKoRn

[not2easy]

There is no way to add a 403 to your device RMKoRn, that is something you could add to a website to keep out unwanted visitors, but you can't add 403 "Forbidden" code to your browser. You control the cookies with your settings and control the UAs as you shared here by the apps you decide to use. In the Firefox browser you can run FB within its container and that should help stop things from following you around. I do not use the container myself so you would need to rely on the information that Firefox supplies, but that should deal with the problem you shared here.

In case it is of interest, another new Privacy-centric browser with search from Brave was just announced today: [webmasterworld.com...]

[lucy24]

I don't know how to issue a 403 on my Android 9

I don't know what this means, and I'd better not try to guess. A 403 is issued by a website in response to a request.

[RMKoRn]

Well I found out that I have Firefox Daylight Browser 86 is the windows version I found out when I got login alerts there was 5 Firefox 86 logins and my Firefox Samsung SM 7J737V connected I removed them but it only took an hour before they uhad access to my Firefox account they keep logging me out of the account and I have to sign back in I finally just gave up their changing settings and stuff I'm so fustrated about this bulling I just don't understand why can't they just go away I have nothing they would want I'm just going to take a break from my device thank you for your help sincerely RMKoRn

[not2easy]

Are you using any kind of AV or malware protection? The bracketed list of "accessories" you posted seem to be FB related. The list (without versions) seem to be a series of your preferences or settings for some FB app:

FBAN/FB4A
FBAV/
FBBV/
FBDM/
FBLC/en_US;
FBRV/
FBCR/Verizon;
FBMF/samsung;
FBBD/Verizon;
FBPN/com.facebook.katana;
FBDV/SM-J737V;
FBSV/9;
FBOP/1;
FBCA/armeabi-v7a:armeabi;

Though I am not very sure about exactly "where" on your device you are seeing these things or whether you are actively logged in when they are seen. If that is the case, it is part of your choices. Where do you see these login notifications?