Echoes
From browser strings to cookies to bot detection, every layer of web identity rests on a fiction that was reasonable when it was written.
Echoes
From browser strings to cookies to bot detection, every layer of web identity rests on a fiction that was reasonable when it was written.
The User-Agent String Taught Everyone to Lie
Your browser introduces itself to every server it contacts. The introduction contains six identity claims. One is accurate. The rest are fossils from thirty years of compatibility theater, each deposited when a new browser decided that honesty mattered less than getting the good content. When AI crawlers now send identical Chrome user-agent strings to pass as human visitors, they're following the string's own logic to completion. The web's access-control infrastructure still depends on this self-reported name tag. It was a courtesy, from an era when courtesy was enough.
The User-Agent String Taught Everyone to Lie
Your browser introduces itself to every server it contacts. The introduction contains six identity claims. One is accurate. The rest are fossils from thirty years of compatibility theater, each deposited when a new browser decided that honesty mattered less than getting the good content. When AI crawlers now send identical Chrome user-agent strings to pass as human visitors, they're following the string's own logic to completion. The web's access-control infrastructure still depends on this self-reported name tag. It was a courtesy, from an era when courtesy was enough.
Security Consequence
HTTP was stateless. Cookies faked statefulness, and the fake immediately leaked: any page could piggyback on another site's authenticated session. So Netscape Navigator 2 introduced the origin. Scheme, host, port. The W3C's 2011 security model acknowledged the concept was "born" from this need, not designed as a security primitive. RFC 6454 describes what followed as convergence, not architecture.
The origin locked things down. Too well. Legitimate cross-domain calls broke, so CORS spent a decade carefully re-permitting what SOP had blocked. One identity fiction required a security fiction to contain it. Web agents now navigate both fictions daily, hitting walls built for a threat model that never imagined them.
Fictions of State
A Shopping Cart's Long Shadow
In 1994, a 22-year-old engineer bolted memory onto a stateless protocol so shopping carts would work. Thirty years later, a trillion-dollar company spent six years trying to remove that fix and couldn't. The economic and political dependencies layered on a small text file had become load-bearing in ways no single actor could unwind. The first chapter of web identity's accidental infrastructure.
Rendering as Identity
When browsers started blocking cookies, the ad industry found another identifier hiding in plain sight: the subtle differences in how your specific hardware renders a line of text. Browser vendors engineered defenses. The largest advertising platform quietly legitimized the practice those defenses targeted. Fiction layered on fiction, each one less visible than the last. The second chapter—and this one leaves nothing on your device to delete.
Further Reading
Past Articles
When robots.txt stopped working, replacements arrived fast. Llms.txt, ai.txt, Google's WebMCP — each citing robots.txt a...
Unplug a 1984 Macintosh from the wall, carry it to another room, plug it back in. Everything still there. The operating ...
The entire web upgraded its security posture in about five years. For foundational internet infrastructure, that kind of...
In 1994, a science fiction novelist's web crawler kept crashing someone's server. The fix was a plain text file asking a...