Not sure what you mean, as exactly this is happening currently on 99% of the web. Brought to you by: ads

The string “null” or actually null? I have recently seen a huge amount of bot traffic which has actually no UA and just outright block it. It’s almost entirely (microsoft cloud) Azure script attacks.

yes, but it puts you in the incredibly small bucket of "users that has weird headers that don't mesh well", and makes using the rest of the (many) other fingerprinting techniques all the more accurate.

> If your headers are new every time then it is very difficult to figure out who is who.

https://xkcd.com/1105/

It is very easy unless the IP address is also switching up.

It's very easy to train a model to identify anomalies like that.

The string I use in my extension is "anubis is crap". I took it from a different FF extension that had been posted in a /g/ thread about Anubis, which is where I got the idea from in the first place. I don't use other people's extensions if I can help it (because of the obvious risk), but I figured I'd use the same string in my own extension so as to be combined with users of that extension for the sake of user-agent statistics.

The UA will be compared to other data points such as screen resolution, fonts, plugins, etc. which means that you are definitely more identifiable if you change just the UA vs changing your entire browser or operating system.

I don't think there are any.

Because servers would serve different content based on user agent virtually all browsers start with Mozilla/5.0...