Comment by bobbiechen

Let's ignore for the moment that this has been reverse engineered.

If they only look at this header, then legitimate users using non-chrome browsers will get treated as bots.

If the these headers are only used for chrome user agents, then it would be easy to bypass by using headless chromium with a user agent that spoofs firefox or safari.

This is what I don't get. Anybody scraping at scale is using headful browsers as fallback, this does nothing. I will just find the browser that works, and use it.

> This is a very useful signal for fraud and abuse prevention.

Like people spoofing the Chrome UA in Firefox to avoid artificial performance degradation inflicted by Google on their websites...