Ask HN: Why does my credit union check if I'm logged into Steam and Reddit? • Hacker News Board

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#11

Post by manigandham » Wed, Oct 18, 2017, 8:09 PM UTC

It's basic fingerprinting used by every major security-sensitive service, like banks.

The more entropy (unique bits of data) about your browser context they can collect, the easier it is to recognize you and see if you're a human or not (and block if they need to).

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#12

Post by saberworks » Wed, Oct 18, 2017, 8:10 PM UTC

I'm usually completely against using "apps" for anything, but does using an app (on mobile) protect against this type of thing? Does an embedded web view have access to the things you're logged into in your main browser on your phone? So does using my credit union app to access my account protect me from them getting all this info from my phone browser?

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#13

Post by kristianp » Wed, Oct 18, 2017, 8:11 PM UTC

soared wrote: post #4

I'm sure you already know the answer, but the more data they can collect on you the better. If they are technically capable of building out a full profile on you, they can use it to recommend products, make credit decisions, etc. Favicons is only the tip of the iceberg - download ghostery and see what 3rd party scripts are running. Like a ton, including some from oracle that connect you to all their data in their dev…

I didn't realise Oracle was in that business, but it looks like its true: https://www.oracle.com/marketingcloud/products/data-manageme...

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#14

Post by Capira » Wed, Oct 18, 2017, 8:15 PM UTC

Sounds like they copy pasted my demo into production: https://robinlinus.github.io/socialmedia-leak/

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#15

Post by tpaschalis » Wed, Oct 18, 2017, 8:17 PM UTC

Seconding other commenters, using a dedicated browser and/or a VPN can help hide your 'digital footprint'.

For example, here's what I'm using. An easy way to set up a sandboxed Chrome using Docker! https://tpaschalis.github.io/sandboxed-browser-with-docker/

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#16

Post by binaryapparatus » Wed, Oct 18, 2017, 8:19 PM UTC

kristoff_it wrote: post #3

Use Firefox Containers and live happy. https://testpilot.firefox.com/experiments/containers/

Great link, thanks. I had no idea this exists.

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#17

Post by 7ewis » Wed, Oct 18, 2017, 8:19 PM UTC

> you install on your own server

Yes anyone can easily spin up their own server, but MailChimp does that part for you. Right?

So the cost analysis should really include the cost of an EC2 instance too, to compare them fairly.

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#18

Post by nathancahill » Wed, Oct 18, 2017, 8:21 PM UTC

saberworks wrote: post #12

I'm usually completely against using "apps" for anything, but does using an app (on mobile) protect against this type of thing? Does an embedded web view have access to the things you're logged into in your main browser on your phone? So does using my credit union app to access my account protect me from them getting all this info from my phone browser?

Yes, it does, since apps are sandboxed better than web pages. There are a number of steps you can take depending on your browser: Disabling 3rd-party cookies prevents this attack. So does Firefox's Containers (or just private browsing) and other addons like uMatrix.

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#19

Post by dzdt » Wed, Oct 18, 2017, 8:23 PM UTC

iamNumber4 wrote: post #2

I would suggest the following when connecting to this site. 1. use a dedicated browser, and only use that browser for this site. 2. utilize private mode if you don't want to dedicate a browser only for this site 3. use different profiles in your normal daily browser. for example firefox, and chrome allows you to have multiple profiles. Create a new profile to use when going to this site. 4. analyze the javascript and…

You trust the credit union with your money, but don't trust them with a fingerprint of your browser identity?

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#20

Post by soared » Wed, Oct 18, 2017, 8:23 PM UTC

kristianp wrote: post #13

soared wrote: post #4

I'm sure you already know the answer, but the more data they can collect on you the better. If they are technically capable of building out a full profile on you, they can use it to recommend products, make credit decisions, etc. Favicons is only the tip of the iceberg - download ghostery and see what 3rd party scripts are running. Like a ton, including some from oracle that connect you to all their data in their dev…

I didn't realise Oracle was in that business, but it looks like its true: https://www.oracle.com/marketingcloud/products/data-manageme...

Yeah they are making acquisitions in that space like crazy too