Spoofed User-Agent String

[joshbuker]

Will this tool false-positive on browser clients that intentionally spoof their User-Agent, or is there a mitigation for this?

[lukevalenta]

That's right--the tool will throw a false positive in the case that a browser or bot spoofs the User Agent. The heuristic used just compares the expected TLS fingerprint for a given User Agent to the actual TLS fingerprint of the connection. So, the 'Likely MITM' outcome can be attributed to an actual MITM or a spoofed User Agent (or a fingerprint database that is incomplete).

The tool can also throw false negatives if a MITM mimics the client browser's TLS fingerprint (i.e. ClientHello). However, I don't necessarily see this as a bad thing because then the MITM software actually has to support a modern TLS stack.