Show HN: What every browser knows about you • Hacker News Board

Re: Show HN: What every browser knows about you

#191

Post by MacAsm » Sat, Apr 02, 2016, 9:16 PM UTC

Jach wrote: post #153

Rangi42 wrote: post #109

Earlier quoted context omitted.

tags are a more standardized part of the web. Although I should be able to disable auto-buffering as well as auto-play. Ideally the user can control whether all types of content get loaded—images, CSS, JavaScript, web fonts—or even allow/deny individual domains or files, but so far browsers require an extension like uMatrix for that.

The fact that some browsers do allow you to control these things, even if you have to use an extension because they don't support it themselves, is crucially important and totally acceptable. AFAIK there is nothing equivalent to NoScript for IE, however, so that's just one of many reasons I don't use it. I don't really mind the trend in browsers over the last several years to give explicit access to more OS resources…

Do you use NoScript in everyday? I think while it would make those annoying APIs go away, the web site experience would became a bit poor and even not work properly.

Re: Show HN: What every browser knows about you

#192

Post by MacAsm » Sat, Apr 02, 2016, 9:23 PM UTC

educar wrote: post #111

http://webkay.robinlinus.com/scripts/social-media.js that's a cool trick, thanks for this!

What is this useful for?

Re: Show HN: What every browser knows about you

#193

Post by JensRex » Sat, Apr 02, 2016, 9:31 PM UTC

stephenr wrote: post #116

JensRex wrote: post #23

Not much of interest showed up for me. Monitor resolution, browser ID, geo location, OS and public IP. My main browser, Firefox, has uBlock and Self-Destructing Cookies. Tried it in both IE11 and Edge (both of which I never use), and I got pretty much the same result. Firefox and Epiphany on Gentoo Linux also failed to startle me. I'd like to see a screenshot of a "worst case scenario".

> Not much of interest showed up for me. Monitor resolution, browser ID, geo location, OS and public IP. Are you saying it showed your geo location without having prompted for it, and that you're OK with that?

I meant whatever DB they use to get location from an IP address.

Re: Show HN: What every browser knows about you

#194

Post by educar » Sat, Apr 02, 2016, 9:47 PM UTC

MacAsm wrote: post #192

educar wrote: post #111

http://webkay.robinlinus.com/scripts/social-media.js that's a cool trick, thanks for this!

What is this useful for?

It helps you figure if a user is signed into a social network. One might think this is not possible because cross-origin restrictions but this trick shows you how to bypass it.

Re: Show HN: What every browser knows about you

#195

Post by MacAsm » Sat, Apr 02, 2016, 10:23 PM UTC

_RPM wrote: post #85

I am a hacker. How the hell does it know my local IP? Via WebRTC I presume?

Yes.

Re: Show HN: What every browser knows about you

#196

Post by Capira » Sun, Apr 03, 2016, 1:04 AM UTC

lttlrck wrote: post #187

Capira wrote: post #94

Earlier quoted context omitted.

https://snapdrop.net is also a cool use of webrtc ;)

Is the wink because of the 502?

No, it's an app of mine and up again. Thanks a lot for telling me it was down!

Re: Show HN: What every browser knows about you

#197

Post by stephenr » Sun, Apr 03, 2016, 7:16 AM UTC

JensRex wrote: post #193

stephenr wrote: post #116

Earlier quoted context omitted.

> Not much of interest showed up for me. Monitor resolution, browser ID, geo location, OS and public IP. Are you saying it showed your geo location without having prompted for it, and that you're OK with that?

I meant whatever DB they use to get location from an IP address.

> I meant whatever DB they use to get location from an IP address.

They aren't using GeoIP lookups. Google runs a service that uses Javascript to try to provide a more accurate position than GeoIP can.

Re: Show HN: What every browser knows about you

#198

Post by hm8 » Sun, Apr 03, 2016, 8:37 AM UTC

educar wrote: post #194

MacAsm wrote: post #192

Earlier quoted context omitted.

What is this useful for?

It helps you figure if a user is signed into a social network. One might think this is not possible because cross-origin restrictions but this trick shows you how to bypass it.

Could you explain how this works? Er, I mean why only the re-direct to the favicon works?

Re: Show HN: What every browser knows about you

#199

Post by eatsfoobars » Sun, Apr 03, 2016, 9:02 AM UTC

hm8 wrote: post #198

educar wrote: post #194

Earlier quoted context omitted.

It helps you figure if a user is signed into a social network. One might think this is not possible because cross-origin restrictions but this trick shows you how to bypass it.

Could you explain how this works? Er, I mean why only the re-direct to the favicon works?

The login page will redirect to the favicon if the user is already logged in, or it will serve a regular HTML page if the user is not.

So, the script creates an (invisible) element for every website which points to the login page (which might redirect to the favicon). If it receives an image, the user is already logged in and the onLoad() callback will fire. Otherwise, it will get an HTML page, so the onError() callback will fire.

It could work with any image on the website, not just the favicon.

Re: Show HN: What every browser knows about you

#200

Post by ahrs » Sun, Apr 03, 2016, 2:44 PM UTC

Safari on iOS doesn't leak anything out of the ordinary for me. The geolocation was way off, identifying my iPhone as being in London (likely due to me accessing the page over a mobile data connection).