81–90 of 99 posts
You've also got to set you locale aswell. It's easy to see if you've set your language to say Australian English.
Recently made this extension and interested in getting some feedback on it. Vytal can Spoof your timezone, locale, geolocation and user agent. This data can be used to track you or reveal your location. Most extensions that provide anti-fingerprinting features rely on content scripts to inject script tags into webpages. There are many limitations to script tag injections which you can read about here: https://palant.…
Can you explain how Firefox (or Chrome) knows my location within 20m even if I use a VPN? Brave puts me where I think the VPN exit point is. For example: https://wikishootme.toolforge.org/
Earlier quoted context omitted.
> It also makes the spoofing completely undetectable. It's my understanding that the usage of the debugger is detectable by scripts running on the page. I've actually come across content websites that will refuse to activate their features (play video) if the debugger is active. Similarly on Android some video streaming apps will refuse to load and play their content catalog if USB debugging is enabled.
How can you detect it? Which websites refuse to activate their features if the debugger is active?
A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open.
Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
Earlier quoted context omitted.
How can you detect it? Which websites refuse to activate their features if the debugger is active?
The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
Earlier quoted context omitted.
The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
I'm unsure if that would work for this extension. Do you have a link to an implementation?
This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf
The debugger timing method is described on page 10.
Earlier quoted context omitted.
Many (most?) VPN mechanisms don't entirely remove access to the other routes from apps that manually request them, so even if an app isn't able to use something akin to "location services" on your device it might still easily be able to get access to your other IP addresses by sending requests with sockets manually bound to specific interfaces, and even might choose to lower the priority of information learned using…
> by sending requests with sockets manually bound to specific interfaces I don’t believe this is possible in client JavaScript within a web browser. Very open to be proved wrong.
(FWIW, a website that is given media recording privileges can definitely do that, though, using WebRTC. If you don't have that privilege then you can still use the WebRTC API but it doesn't return alternative candidates. But I also don't think that is what they meant.)
Earlier quoted context omitted.
Many (most?) VPN mechanisms don't entirely remove access to the other routes from apps that manually request them, so even if an app isn't able to use something akin to "location services" on your device it might still easily be able to get access to your other IP addresses by sending requests with sockets manually bound to specific interfaces, and even might choose to lower the priority of information learned using…
Also known as split tunnel, this can be used by corporate VPN solutions to lower the amount of network traffic entering a data center (so you don’t overload your undersized pipes)
Earlier quoted context omitted.
The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
I'm unsure if that would work for this extension. Do you have a link to an implementation?
setInterval(function() {
try {
let before = new Date().getTime();
// This will pause the program execution if debugging is enabled.
// If debugging isn't enabled this statement is a no-op.
debugger;
let after = new Date().getTime();
// Detect if the program was paused or not.
if (after - before > 0.01) {
// > 10ms difference? The program was (most likely) paused by the debugger.
document.body.innerHTML = "Debugging started";
}
} catch(e) {}
}, 1000);
Earlier quoted context omitted.
You clicked "Allow" on the location request dialog, click deny and it won't do that.
Of course, but how does it know? Where is the information from?
There are services that wardrive around mapping locations of WiFi access points. Your laptop periodically will phone home with your nearby Wi-Fi MAC addresses (BSSIDs) to ask where they were detected.
Here's one such service: https://www.skyhook.com/wifi-location-solutions
Earlier quoted context omitted.
Of course, but how does it know? Where is the information from?
I'm assuming you mean on devices without a GPS. There are services that wardrive around mapping locations of WiFi access points. Your laptop periodically will phone home with your nearby Wi-Fi MAC addresses (BSSIDs) to ask where they were detected. Here's one such service: https://www.skyhook.com/wifi-location-solutions
When Location Services is on (which it is by default), macOS will periodically switch your wireless card to monitor mode to find those nearby SSIDs. That briefly interrupts normal network traffic.
IIRC, it does this more often when Find My.app is turned on.
You can disable Location Services in: System Preferences > Security & Privacy > Location Services