And what are methods to prevent browser from leaking all this information? I presume browsing in private mode is not a solution.
There should be some flags in the browser configuration to turn off or lie about some of these things. Or NoScript.
Show HN: What every browser knows about you
11–20 of 209 posts
Re: Show HN: What every browser knows about you
#12> Geo Coordinates: [lat,lng about 90 miles from the correct location] I find that error hilarious, because I setup correct in-addr.arpa and ip6.arpa reverse DNS entries for my (static) IP, which returns a domain name that has an accurate LOC record. My IP is two DNS queries away from my location (~10m precision), yet most of the time everyone uses these geoip databases instead of LOC.
Because you are literally the only one ever who has done this.
Re: Show HN: What every browser knows about you
#13Holy crap, I'm glad I have noscript running and only allow the minimal JS I need to run on pages I somewhat trust.
Re: Show HN: What every browser knows about you
#14Scanning the visitor's /24 without notice, warning, or opportunity to opt out is a dick move. Our IDS probably just lit up like a Christmas tree.
Yup. I have a honeypot on my home network that hits Twilio when it gets poked at. So the author at least got my phone to light up.
Re: Show HN: What every browser knows about you
#15Scanning the visitor's /24 without notice, warning, or opportunity to opt out is a dick move. Our IDS probably just lit up like a Christmas tree.
Sorry! Didn't think about that. It is fixed.
Re: Show HN: What every browser knows about you
#16And what are methods to prevent browser from leaking all this information? I presume browsing in private mode is not a solution.
Shut off javascript.
Yes, this will reveal sites that serve broken pages that require javascript to render usually static content (skipping progressive enhancement is lazy and unprofessional). Are those sites worth the expense of everyone learning more fingerprintable data about your and your browser?
The WebRTC scan that others are complaining about is another good reason to shut off javascript. Are other sites doing similar scans, perhaps in a less obvious way? It is insane that random pages even have that ability; it's a huge attack surface that is mostly unknown and unexplored.
> private mode
That's mostly about not leaving data trails on the local device (hence the "porn mode" nickname).
Re: Show HN: What every browser knows about you
#17While it hardly surprises any of HN audience, it's a GREAT showcase for a less technical audience.
I see that you removed automatic network scanning due to a comment here; but since it's an educational project, I think it would be valuable to add a comment that explains that a malicious website could get that info without consent.
Re: Show HN: What every browser knows about you
#18> Your Device is propably laying on a Table
I'm one of those heathens that actually puts the desktop tower on top of the desk. Got me.
Re: Show HN: What every browser knows about you
#19While it hardly surprises any of HN audience, it's a GREAT showcase for a less technical audience. I see that you removed automatic network scanning due to a comment here; but since it's an educational project, I think it would be valuable to add a comment that explains that a malicious website could get that info without consent.
Done!
Re: Show HN: What every browser knows about you
#20Scanning the visitor's /24 without notice, warning, or opportunity to opt out is a dick move. Our IDS probably just lit up like a Christmas tree.
Sorry! Didn't think about that. It is fixed.
You should leave it in, if the whole point is to demonstrate the capabilities.
It's incredible that a webpage can do that.