Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Your Social Media Fingerprint (maybe NSFW)

robinlinus.github.io

Post reply on HN
Print view View original

141–150 of 258 posts

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#141

Post by alexholehouse »

sdegutis wrote: post #110
alexholehouse wrote: post #108

So, interestingly, it had me logged in to reddit, but I don't actually have a reddit account at all. Thoughts?

Why not go to reddit.com and see who it says you're logged in as?

Nothing, because I literally don't have an account.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#142

Post by sperglord »

ktta wrote: post #138
throwanem wrote: post #136

Earlier quoted context omitted.

Yeah, that would've been nice to know ahead of time. Why not, for example, trigger the test when someone clicks a button, rather than taking someone's page visit as permission to try lighting up their organization's content filter?

I think it helps in conveying the fact that it is a vulnerability not a feature. So any website (even your own company's internal one) can check stuff like this. And you can't do anything about it. Other than always using private browsing for anything you don't want your company/anyone else to know about.

I believe using private browsing wouldn't matter. The IP I'm browsing from is still going to try pinging all those porn servers, and that's what's getting logged in the filter, not my browser history.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#143

Post by nodesocket »

Couldn't this be fixed by instead of using ?next= in the query string storing a cookie.

For example:

    if(!auth) {
        setCookie('next', '/url-here', 1h);
    }
    redirect(login);
Login page action:

    if(cookieExists('next')) {
        next = getCookie('next');
        deleteCookie('next');
        redirect(next);
    } else {
        redirect('dashboard');
    }

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#144

Post by the8472 »

The firefox and tor devs are cooperating to upstream a tor browser feature that isolates cookie stores and similar things based on the domain shown in the URL bar[0]. Available in nightly by enabling privacy.firstparty.isolate = true in about:config.

Additionally they're also also working on a more customizable version of that called contextual identities[1], which eventually will also be manageable by extensions[2]

And of course addons that block cookies in cross-origin requests or cross origin requests in general such as µmatrix[3] also plug this hole.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1260931

[1] https://blog.mozilla.org/tanvi/2016/06/16/contextual-identit...

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1302697

[3] https://github.com/gorhill/uMatrix

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#146

Post by detaro »

nodesocket wrote: post #143

Couldn't this be fixed by instead of using ?next= in the query string storing a cookie. For example: if(!auth) { setCookie('next', '/url-here', 1h); } redirect(login); Login page action: if(cookieExists('next')) { next = getCookie('next'); deleteCookie('next'); redirect(next); } else { redirect('dashboard'); }

Could easily muddle state with multiple tabs though, query string is clearer.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#147

Post by bhauer »

This is the first I had heard of GETs to login pages executing a redirect when the user is already logged in. I wasn't aware that so many did this.

Virtually every application I have built will render a simple response saying "You are already logged in" if you GET the login URL with an active session. As I understand the exploit, if a non-image is returned, the script assumes you are not logged in.

What value is there in redirecting a GET if you're already logged in? You redirect when the login form is submitted as a POST.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#149

Post by whamlastxmas »

Declanomous wrote: post #94
cookiecaper wrote: post #92

Earlier quoted context omitted.

Yes. If you do anything remotely personal on a work computer, use a VPN or some other type of encrypted tunnel (an SSH SOCKS tunnel + FoxyProxy makes a good poor man's VPN, and can usually be configured to allow seamless integration with internal resources going over the LAN and external going over the tunnel).

I'm more likely to get in trouble for creating a VPN than I would be for accidentally sending a DNS request to YouPorn. Our IT department is insane about data security, and running traffic through another VPN will cause them to drop everything to harass you for as long as it takes you to prove that you weren't leaking sensitive information.

Sounds like you need to just browse on your phone, then. And if that's not an option, you should probably just not browse at work.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#150

Post by detaro »

bhauer wrote: post #147

This is the first I had heard of GETs to login pages executing a redirect when the user is already logged in. I wasn't aware that so many did this. Virtually every application I have built will render a simple response saying "You are already logged in" if you GET the login URL with an active session. As I understand the exploit, if a non-image is returned, the script assumes you are not logged in. What value is ther…

2 tabs open. I log in in one of them, then follow a link in the other that points to the login page with a redirect to something that requires login.

or

2 tabs open, I follow links to login page on both. Login in one, F5 the other.

Post reply on HN