41–50 of 209 posts
The social media thing is cool, I didn't know that trick of using the favicon.ico img under the login of a site to see if the image will load or not. That's pretty nifty
Chromium 49. The only place I am logged into is Reddit
> Twitter: logged in > Facebook: logged in > Google Plus: logged in > Reddit: logged in > Flickr: logged in
I opened the same link in Firefox Android with uBlock Origin installed, and got no hardware stats other than the kernel, no software stats, and no IP.
My takeaway from this is to NEVER use an app that uses Webkit.
I'm not sure if that was the intended purpose, but thanks for the eye-opener anyway!
And what are methods to prevent browser from leaking all this information? I presume browsing in private mode is not a solution.
Shut off javascript. Yes, this will reveal sites that serve broken pages that require javascript to render usually static content (skipping progressive enhancement is lazy and unprofessional). Are those sites worth the expense of everyone learning more fingerprintable data about your and your browser? The WebRTC scan that others are complaining about is another good reason to shut off javascript. Are other sites doin…
Earlier quoted context omitted.
Yup. I have a honeypot on my home network that hits Twilio when it gets poked at. So the author at least got my phone to light up.
That sounds awesome, care to share a few more details?
1. Connect Raspberry Pi to local LAN and get wifi setup (I VLAN wireless traffic, so I have it listening/connected to both)
2. Change iptables default policy to DROP
3. Add relevant ALLOW rules to make sure basic stuff like DHCP still works. I added an allow rule to talk to another machine that runs a PHP script that talks to Twilio
4. Spend about a week adding custom DROP rules for any normal broadcast traffic on your network (Bonjour, random auto-discovery stuff, etc)
5. If you have properly excluded everything "normal" you should be able to run "iptables -vL" about 24 hours apart and the packet count next to the INPUT chain policy will not have incremented (remember we have a default of DENY)
6. Add a final rule of 'iptables -A INPUT -m limit --limit 2/min -j LOG --log-prefix "ZOMG: " --log-level 4'
7. Write a bash script to monitor syslog, parse the log, forward to the before-mentioned script on another host
If you try this with your iPhone it activates your gyroscope and says "Your Device is probably in your Hands." It knows too much
Reading keystrokes from a nearby keyboard using the gyroscope http://www.cc.gatech.edu/fac/traynor/papers/traynor-ccs11.pd...
Speech Recognition using the gyroscope http://www.wired.co.uk/news/archive/2014-08/15/gyroscope-lis...
Not just a problem with webpages, apps that don't have access to your mic do have access to your gyroscope
One possible solution is to not allow gyroscope reading above say 20hz without user permission (for both apps and webpages)
I visited the page once on my Android using my HN app's built-in webkit browser, where it displayed some interesting stats like the location, the battery level, ISP, etc. I opened the same link in Firefox Android with uBlock Origin installed, and got no hardware stats other than the kernel, no software stats, and no IP. My takeaway from this is to NEVER use an app that uses Webkit. I'm not sure if that was the intend…
If you try this with your iPhone it activates your gyroscope and says "Your Device is probably in your Hands." It knows too much
It gets worse Reading keystrokes from a nearby keyboard using the gyroscope http://www.cc.gatech.edu/fac/traynor/papers/traynor-ccs11.pd... Speech Recognition using the gyroscope http://www.wired.co.uk/news/archive/2014-08/15/gyroscope-lis... Not just a problem with webpages, apps that don't have access to your mic do have access to your gyroscope One possible solution is to not allow gyroscope reading above say 20hz…
Safari 9.1 : Minimal HW/SW detection, No social media leak, No network scan (after click)
Safari 9.1.1 (Tech Preview) : Minimal HW/SW detection, No social media leak, No network scan (after click)
Chrome 49.0.2623.110 : Full HW/SW detection, Social media login detected, Network scanning (after click)
Firefox 45.0.1 : Full HW/SW detection, Social media login detected, Network scanning (after click)