Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Your Social Media Fingerprint (maybe NSFW)

robinlinus.github.io

Post reply on HN
Print view View original

181–190 of 258 posts

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#181

Post by coverband »

throwanem wrote: post #167
drvdevd wrote: post #164

Earlier quoted context omitted.

When I first read that it was making these requests here in the comments, my reaction was similar. But then upon reflection, I don't think there's a problem for the author here. Why? Because all I did was click the link. Meaning if I was behind a corporate firewall or the like, this sort of thing could be happening all the time and unless I was always tracing requests in my browser or via MITM or logging DNS, I'd hav…

The point I'm making is that it's not necessary to hit a porn site in order to get the point across, and there are HN users whose organizations observe and don't care for that kind of thing.

Absolutely!... If your company is doing web filtering, it will report an attempted hit from your browser to the YP site.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#182

Post by ge96 »

throwanem wrote: post #140
ktta wrote: post #138

Earlier quoted context omitted.

I think it helps in conveying the fact that it is a vulnerability not a feature. So any website (even your own company's internal one) can check stuff like this. And you can't do anything about it. Other than always using private browsing for anything you don't want your company/anyone else to know about.

I mean, if somebody is logged into YouPorn from work, that's not a problem I expect the developer of a tool like this to solve. What I expect the developer of a tool like this to do is not create problems by just arbitrarily making HTTP requests to porn sites without a prompt or a chance to opt out. That's a dick move.

In bird culture, this is considered a dick move.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#183

Post by JoshMnem »

ktta wrote: post #138
throwanem wrote: post #136

Earlier quoted context omitted.

Yeah, that would've been nice to know ahead of time. Why not, for example, trigger the test when someone clicks a button, rather than taking someone's page visit as permission to try lighting up their organization's content filter?

I think it helps in conveying the fact that it is a vulnerability not a feature. So any website (even your own company's internal one) can check stuff like this. And you can't do anything about it. Other than always using private browsing for anything you don't want your company/anyone else to know about.

Privacy Badger will stop that tool if you edit the settings.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#184

Post by welanes »

tankenmate wrote: post #176
to3m wrote: post #57

Earlier quoted context omitted.

I only ever log in to Facebook in private browsing mode.

I only ever log into Facebook via a VPN to a remote VPS using a private window on a browser I don't use for anything else. And also... Chain OUTPUT (policy ACCEPT 6309 packets, 599K bytes) pkts bytes target prot opt in out source destination 330 19800 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 match-set block-facebook-ips dst reject-with icmp-port-unreachable I have an ipset that matches FB networks.

Yikes. Sounds easier just to not use Facebook.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#186

Post by ge96 »

How does this work?

I think I get the basic concept of calling redirects to various sites from the page, probably back-end like with php, CURL maybe?

I just don't get how you'd keep track of where it goes after the redirect (trying a link) since you would now be on Facebook's site for example

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#187

Post by proaralyst »

ge96 wrote: post #186

How does this work? I think I get the basic concept of calling redirects to various sites from the page, probably back-end like with php, CURL maybe? I just don't get how you'd keep track of where it goes after the redirect (trying a link) since you would now be on Facebook's site for example

There's an explanation further down the page, but essentially the redirect they choose is an image. You can tell if an image loaded successfully using JS, so if the redirect succeeds, that JS fires. If it fails (because the login page isn't an image), some other JS runs instead.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#188

Post by joosters »

zerognowl wrote: post #39

This is why I use 'browser isolation', which is a way to separate different types of surfing activity into different buckets. Currently the best way to do this in Firefox is to create multiple profiles, or in Chrome, you can simply add a different user/persona. Having one profile, or even an entire dedicated browser just for Twitter/FB ensures the login is not spilled over into other sites. If you're surfing the web…

Shouldn't disabling 3rd party cookies also prevent this kind of attack? The request for the facebook/twitter favicon is being made from a non-FB/TW page and so the login cookie won't be sent.

This would depend upon how the browser implements its 3rd party cookie blocking. If it only blocks setting cookies, but still allows existing cookies to be sent, then there would be no protection.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#189

Post by Zeklandia »

0942v8653 wrote: post #152
Pxtl wrote: post #123

FYI, it's very NSFW in the back-end. Your browser is sending requests to obvious porn servers when you hit this link so it can test if you're logged in to them.

A more SFW version (took out YouPorn): http://codepen.io/anon/pen/ALdqox/right/ This version connects to squareup.com, twitter.com, www.facebook.com, accounts.google.com, accounts.google.com, plus.google.com, login.skype.com, www.flickr.com, www.spotify.com, www.reddit.com, www.tumblr.com, www.expedia.de, www.dropbox.com, www.amazon.com, www.pinterest.com, www.netflix.com, de.foursquare.com, eu.battle.net, store.stea…

This one actually works for me! The other said that I was using Privacy Badger since it couldn't detect anything. I'm not, but I am using uBlock Origin. This one is only wrong about a couple (it doesn't register, for example, that I am logged in to G+, Khan Academy, Steam, Amazon, PayPal, or Skype).

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#190

Post by duaneb »

drvdevd wrote: post #173
Bartweiss wrote: post #118

Earlier quoted context omitted.

At risk of being depressing, it's worth knowing that a dedicated profiler can reconcile accounts across all of the protections you've mentioned - not just as a targeted attack, but algorithmically. There are a lot of fingerprinting tricks which transcend cookie restrictions and user profiles. The battery percent/value one will reconcile all accounts on one device (as will several other like fonts). If you log into on…

What about virtualization? It seems to me that something like Qubes might not at present protect against this (I don't know what information is available to guest/isolated domains on that system), but could be made to? One can easily lie to a browser about battery status and fonts from the OS too, for example. I guess my point is that it depends on what you view as pathological? I surmise that this is the kind of thi…

It's very difficult to prevent side channel thumbprints—something as simple as traceroutes, wifi hotspots, caches (DNS, routing) can be uniquely identifiable. Add on top of this biometrics like how you type, how you move your mouse, etc, and it becomes very difficult to avoid concerted tracking efforts.

Of course, if you're not pissing off state actors, you're probably fine with qubes/tails.

Post reply on HN