Show HN: What every browser knows about you • Hacker News Board

Re: Show HN: What every browser knows about you

#201

Post by Capira » Sun, Apr 03, 2016, 9:23 PM UTC

eatsfoobars wrote: post #199

hm8 wrote: post #198

Earlier quoted context omitted.

Could you explain how this works? Er, I mean why only the re-direct to the favicon works?

The login page will redirect to the favicon if the user is already logged in, or it will serve a regular HTML page if the user is not. So, the script creates an (invisible) element for every website which points to the login page (which might redirect to the favicon). If it receives an image, the user is already logged in and the onLoad() callback will fire. Otherwise, it will get an HTML page, so the onError() callb…

Though the redirect works only with images hosted on the same domain. The favicon was the only image I could find on twitter.com or facebook.com.

I reported this bug to every company listed there, but all of them said it is not relevant to their users' privacy.

Re: Show HN: What every browser knows about you

#202

Post by Capira » Sun, Apr 03, 2016, 9:25 PM UTC

ahrs wrote: post #200

Safari on iOS doesn't leak anything out of the ordinary for me. The geolocation was way off, identifying my iPhone as being in London (likely due to me accessing the page over a mobile data connection).

Right, the Google Geolocation API is very inaccurate on mobile data connection.

Re: Show HN: What every browser knows about you

#203

Post by Capira » Mon, Apr 04, 2016, 7:46 AM UTC

ryuuchin wrote: post #154

I see NoScript being recommended but if you're not using Firefox this isn't an option. Lukily both uBlock[1] and uMatrix[2] are cross platform and will work on most (any?) Chromium based browsers as well as Firefox. All instances of uBlock in this post are referring to uBlock Origin[1]. In addition to NoScript both uBlock[1] and uMatrix[2] can be configured to block javascript (you can block both 3rd and 1st party ja…

Thanks a lot for your detailed explanation! I added a link to your post on the page.

Re: Show HN: What every browser knows about you

#204

Post by guyvkn » Mon, Apr 04, 2016, 9:08 AM UTC

Vvv

Re: Show HN: What every browser knows about you

#205

Post by JonMuzy » Tue, Apr 05, 2016, 4:40 PM UTC

Great project, actually seeing some pretty interesting stuff I didn't know was available. Thanks for this

Re: Show HN: What every browser knows about you

#206

Post by hm8 » Wed, Apr 06, 2016, 7:43 AM UTC

Capira wrote: post #201

eatsfoobars wrote: post #199

Earlier quoted context omitted.

The login page will redirect to the favicon if the user is already logged in, or it will serve a regular HTML page if the user is not. So, the script creates an (invisible) element for every website which points to the login page (which might redirect to the favicon). If it receives an image, the user is already logged in and the onLoad() callback will fire. Otherwise, it will get an HTML page, so the onError() callb…

Though the redirect works only with images hosted on the same domain. The favicon was the only image I could find on twitter.com or facebook.com. I reported this bug to every company listed there, but all of them said it is not relevant to their users' privacy.

Yeah, that's a very critical information. Thanks, guys!

Re: Show HN: What every browser knows about you

#207

Post by invisiblep » Mon, Apr 11, 2016, 4:50 PM UTC

ryuuchin wrote: post #154

I see NoScript being recommended but if you're not using Firefox this isn't an option. Lukily both uBlock[1] and uMatrix[2] are cross platform and will work on most (any?) Chromium based browsers as well as Firefox. All instances of uBlock in this post are referring to uBlock Origin[1]. In addition to NoScript both uBlock[1] and uMatrix[2] can be configured to block javascript (you can block both 3rd and 1st party ja…

I switched from easy to medium mode after reading following your advice. How would you suggest dealing with for instance youtube.com now that no videos will load?

Btw only hard mode stops any browser details leaking on the test site: http://webkay.robinlinus.com/ which is awesome, but I wonder how much time you have to spend fixing all the sites that you visit that will be broken in this mode.

Anyone using "hard mode"?

Re: Show HN: What every browser knows about you

#208

Post by dserodio » Mon, Apr 11, 2016, 9:40 PM UTC

eatsfoobars wrote: post #199

hm8 wrote: post #198

Earlier quoted context omitted.

Could you explain how this works? Er, I mean why only the re-direct to the favicon works?

The login page will redirect to the favicon if the user is already logged in, or it will serve a regular HTML page if the user is not. So, the script creates an (invisible) element for every website which points to the login page (which might redirect to the favicon). If it receives an image, the user is already logged in and the onLoad() callback will fire. Otherwise, it will get an HTML page, so the onError() callb…

This is showing that I'm logged in to Facebook but I don't have an account there anymore.

Re: Show HN: What every browser knows about you

#209

Post by ryuuchin » Thu, Apr 14, 2016, 5:27 AM UTC

invisiblep wrote: post #207

ryuuchin wrote: post #154

I see NoScript being recommended but if you're not using Firefox this isn't an option. Lukily both uBlock[1] and uMatrix[2] are cross platform and will work on most (any?) Chromium based browsers as well as Firefox. All instances of uBlock in this post are referring to uBlock Origin[1]. In addition to NoScript both uBlock[1] and uMatrix[2] can be configured to block javascript (you can block both 3rd and 1st party ja…

I switched from easy to medium mode after reading following your advice. How would you suggest dealing with for instance youtube.com now that no videos will load? Btw only hard mode stops any browser details leaking on the test site: http://webkay.robinlinus.com/ which is awesome, but I wonder how much time you have to spend fixing all the sites that you visit that will be broken in this mode. Anyone using "hard mode…

The easiest way is to enable 3rd party scripts on youtube. While at youtube open the uBlock Origin menu and set 3rd party scripts locally to no-op. After you enable advanced mode the two columns the now appear are for blocking stuff globally (left side) and locally (right side). Globally blocked stuff (like when you set up medium mode to block 3rd party scripts and iframes) automatically gets applied to the smaller scope (local to the site currently open).

To unblock scripts just turn the 3rd party scripts block to gray which equals a noop for that. Green is explicitly allow which is what we DON'T want since we still want filtering from the filter lists to apply. Basically to unbreak sites you start with setting 3rd party scripts to noop then iframes if that doesn't fully fix a site. This setup is rather course grained but is the easiest way to increase security and privacy with the least amount of user interaction (the most bang for your buck basically).

As you browse with this "medium mode" you'll probably interact less and less as your dynamic filtering list gets built up. I wouldn't recommend using the "hard mode" since there's not a lot to gain from it and it will cause a lot more breakage.

Edit: Also I just noticed this but font blocking is also enabled in the medium mode screenshots. This isn't part of the described medium mode and the author of the screenshots likely forgot to turn it off before taking them. However you're free to try it out if you want but keep in mind it can break the look and feel of sites. Also it may not actually block the downloading of the font if you're using Chrome or a Chromium based browser so there's less of a reason to use it on Chrome.