61–67 of 67 posts
Earlier quoted context omitted.
Same for me. Maybe something changed about HN since the demo was written?
For me it shows I'm logged into HN, but shows I'm 'not logged in' many of other things that I'm actually logged in to, like Twitter, Reddit, Facebook and a few others.
Earlier quoted context omitted.
For me it shows I'm logged into HN, but shows I'm 'not logged in' many of other things that I'm actually logged in to, like Twitter, Reddit, Facebook and a few others.
Same here. I use uBlock Origin with all of the tracking filters enabled, plus Privacy Badger.
Sounds like they copy pasted my demo into production: https://robinlinus.github.io/socialmedia-leak/
But this is more of a business decision than a security decision likely. It is probably to prevent services like Intuit (Mint.com, Quickbooks, etc), Plaid, Quovo, and other data aggregators from accessing online banking and screen scraping / web crawling. Obviously, there are security reasons to prevent this access as well, but it has historically been a business decision with security as an excuse.
Disclaimer: I'm co-founder of a company that powers online banking, mobile banking, and open banking APIs for credit unions and banks and used to be CTO at a credit union.
Earlier quoted context omitted.
Does uBlock Origin not do it out of the box?
uMatrix is more granular. From example, you can tell it to allow images and CSS from a domain, but not cookies or JavaScript. Or, you can tell it to allow JavaScript from Facebook while you're on Facebook's site, but not when you're on other sites. I find both uBlock Origin and uMatrix to be useful.
I obviously don't for sure if this is happening, but if your social media footprint helps determine if you see a captcha or not, or if you're forced to enter your credential again, it seems a reasonable signal to add to the mix of things like IP, browser, etc.
I suspect it might just be an anti-bot thing though. Most bots run in sandboxes which aren't logged into these sites.