Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: What every browser knows about you

webkay.robinlinus.com

Post reply on HN
Print view View original

161–170 of 209 posts

Re: Show HN: What every browser knows about you

#161

Post by throwaway41597 »

MichaelGG wrote: post #52

Not sure why battery is exposed; I guess that's the result of making browsers more like OSes. The only really annoying thing is the idiotic WebRTC settings. Their love for "data channels" with zero prompts, despite having no legitimate uses[1], ignores your proxy settings. This should be fixed. 1: I asked someone involved with WebRTC. They suggested "maybe a page wants to communicate with your fridge directly" as a s…

Just like with mobile apps, battery info can help websites decide whether they should run a complex operation now. It also helps detect regressions if a commit happens to suck power faster. Unfortunately, it's more bits available to deanonymize users across websites.

Data channels are useful for synchronizing your phone and your laptop. All native platforms support this. Most websites do it with a roundtrip to the server. So it would be mysterious to the user why a permission is prompted for something that should just work. Obviously it's bad for privacy though.

So painting it as having no legitimate uses is a bit one-sided. There is no easy fix.

Re: Show HN: What every browser knows about you

#162

Post by stephenr »

ATsch wrote: post #160
stephenr wrote: post #87

Earlier quoted context omitted.

When the parts that break are leaking user hardware and network information, I'll take the break thanks.

It isn't like there is no legitimate use case for these technologies. It's just that they are accessible without any supervision.

And I'd rather not have them than accept the glaring security and privacy issues of having them without user permission.

Re: Show HN: What every browser knows about you

#163

Post by voltagex_ »

ryuuchin wrote: post #154

I see NoScript being recommended but if you're not using Firefox this isn't an option. Lukily both uBlock[1] and uMatrix[2] are cross platform and will work on most (any?) Chromium based browsers as well as Firefox. All instances of uBlock in this post are referring to uBlock Origin[1]. In addition to NoScript both uBlock[1] and uMatrix[2] can be configured to block javascript (you can block both 3rd and 1st party ja…

Subjectively, uBlock doesn't seem to be catching everything recently - has something been changed?

Re: Show HN: What every browser knows about you

#164

Post by ryuuchin »

voltagex_ wrote: post #163
ryuuchin wrote: post #154

I see NoScript being recommended but if you're not using Firefox this isn't an option. Lukily both uBlock[1] and uMatrix[2] are cross platform and will work on most (any?) Chromium based browsers as well as Firefox. All instances of uBlock in this post are referring to uBlock Origin[1]. In addition to NoScript both uBlock[1] and uMatrix[2] can be configured to block javascript (you can block both 3rd and 1st party ja…

Subjectively, uBlock doesn't seem to be catching everything recently - has something been changed?

If you're only relying on the filter lists then you're at their mercy.

Re: Show HN: What every browser knows about you

#166

Post by haddr »

MichaelGG wrote: post #52

Not sure why battery is exposed; I guess that's the result of making browsers more like OSes. The only really annoying thing is the idiotic WebRTC settings. Their love for "data channels" with zero prompts, despite having no legitimate uses[1], ignores your proxy settings. This should be fixed. 1: I asked someone involved with WebRTC. They suggested "maybe a page wants to communicate with your fridge directly" as a s…

I'ts funny with WebRTC, because I rememeber when the same could be accomplish with Java applets (Java ignored any proxy settings, which allowed to deanonynimize people on the internet, e.g. it no longer mattered if you were behind TOR if you had Java enabled). I think it was considered security bug and was patched later. Seems that WebRTC people are not so security-wise I suppose...

Re: Show HN: What every browser knows about you

#168

Post by mojuba »

stephenr wrote: post #127
mojuba wrote: post #126

Earlier quoted context omitted.

Same here, it didn't detect some of the things it should have (theoretically?), e.g. AdBlock plug-in, Twitter & Co., and the EXIF data wasn't fully exposed. The geo location was wrong by some 70 miles, but that's a question of a proper geoip database I suppose. All in all, not very spooky with Safari at least.

I think it's specifically not GeoIP location - that doesn't require a browser to leak anything as its using your public IP address. I assume (because mine didn't show anything) that it's relying on the browser leaking it's device-detected location without prompting?

I don't think it's possible without user's permission, so no it's likely one of those public GeoIP databases which are usually a bit behind, inaccurate and incomplete.

Re: Show HN: What every browser knows about you

#169

Post by stephenr »

mojuba wrote: post #168
stephenr wrote: post #127

Earlier quoted context omitted.

I think it's specifically not GeoIP location - that doesn't require a browser to leak anything as its using your public IP address. I assume (because mine didn't show anything) that it's relying on the browser leaking it's device-detected location without prompting?

I don't think it's possible without user's permission, so no it's likely one of those public GeoIP databases which are usually a bit behind, inaccurate and incomplete.

Hmm yes, quite odd. The first time I loaded the site, nothing appeared in the location area, leading me to suspect that it was abusing a prompt-less device location API.

After your comment I loaded the page again, and sure enough it shows a very specific, but quite wrong location. Wrong province wrong.

I actually got better GeoIP results than that (down to the local city) on my old broadband connection. I just tried it now (we moved 2KM and changed ISP, from DOCSIS to ADSL) and all I get is the country now - possibly because its dynamic whereas our DOCSIS IP never seemed to change.

So it's kind of creepy on Google's part that they even offer this service, but the data seems to be so woefully useless that I can't believe anyone would actually use it.

Re: Show HN: What every browser knows about you

#170

Post by Dylan16807 »

MichaelGG wrote: post #108
SquareWheel wrote: post #105

Earlier quoted context omitted.

Simply visiting a link downloads dozens, sometimes hundreds of files without your explicit permissions. It simply uses a different protocol.

No, it doesn't just use a different protocol. It ignores your network settings (proxy) and exposes your local network information. I can understand not wanting to scare people with "Allow P2P Data Channel", but ignoring proxy settings and revealing all IPs is unacceptable. WebRTC folks toss off these concerns with "there's no way to prevent tracking so heh".

It's bad that it ignores network settings.

But that's orthogonal to whether it's torrenting. You can torrent while respecting network settings, and without exposing local IPs.

Post reply on HN