Viewing profile — kdarutkin

I’d like to share an open source project I’ve been working on during the last year. It analyzes production JavaScript code and detects bundled NPM package versions. A vulnerability…

It is possible on Tor Browser. Chrome and Firefox show a confirmation popup in the main frame.

Wow, that's weird. The internet connection may be the issue here, or the custom configuration on Safari.

Thanks for the feedback. The accuracy is the main issue on Chrome. See also https://news.ycombinator.com/item?id=27147876

We haven't tested Vivaldi so far and the demo is not designed for it. However that doesn't mean Vivaldi is secure against this attack.

This is possible in theory. For example, Safari opens the Apple Music without any user prompt. The app itself is designed to handle deep links (such as opening an album or starting…

We will make a detailed report with some statistics, after the vulnerability is fixed

Mostly because it took hours to make an exploit on Safari compared to days on Firefox, however the final approach ended up the same. Only Chromium has a built-in scheme anti-floodi…

Edge 90 is also affected. We tested it on Windows 10.

Thanks. Linux is tricky. Mostly because Chrome opens applications through `xdg-open`. Custom configuration on Firefox may also affect the result.

I also made a special branch for Chromium (Chrome, Brave, Edge, etc.) that works much slower, but should be more accurate. It still may not work for your browser with a custom conf…

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not…

Hi, agilob. I've updated the demo for Chromium and made it work slower, in order to increase accuracy. See also https://news.ycombinator.com/item?id=27147325

Chromium results may be flaky on slow internet or because of less performant hardware (such as Virtual Machines). I've updated the demo for Chromium and made it work slower, in ord…

The exploit was tested in Safari 14.0.3 and 14.1 on MacBook M1 and MacBook Pro. What version do you have?

Any custom settings may affect the result. However default settings will work for the Firefox 88.0.1. Was tested on Windows, Safari and Linux. Chrome does not work on Ubuntu, since…

Hi, nimbius. I’m the article author, can you please clarify your question? The demo will not work without a popup window in Chrome, Firefox and Safari. The “Get My Identifier” butt…