Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Banner ads on CNN.com contain keyloggers

twitter.com

Post reply on HN
Print view View original

71–80 of 83 posts

Re: Banner ads on CNN.com contain keyloggers

#71

Post by dahart »

Iframed banner ads can’t log keystrokes outside their frame, browsers don’t allow that. And no site in their right mind would include ads that aren’t iframed.

A keylogger would be possible if there was some kind of zero day exploit, but this isn’t that, it sound like the tweeter didn’t do their due diligence. I’m curious how someone gets as far as looking through the minified JavaScript without knowing the browser doesn’t allow that, obviously(?), otherwise all your passwords and information would have been compromised long ago.

Re: Banner ads on CNN.com contain keyloggers

#72

Post by dahart »

Crontab wrote: post #13

Sites bemoan ad blockers but then take no responsibility for the ads that are shown. That needs to change - it’s not like print advertising.

> Sites bemoan ad blockers but then take no responsibility fo the ads that are show. That needs to change - it’s not like print advertising.

It has been changing and improving for years.

Your statement is true for the ad content for sure. (Though sites do take flack for inappropriate ad content, just like print publications have.)

This is irrelevant to the OP’s link, though, since it’s not a keylogger and keyloggers aren’t actually possible.

Ads are subject to the security rules imposed by the browser, and for the most part every abuse that ads have attempted have been shut down. Sometimes not as fast as we’d like, I admit, but for the most part I think the system is working.

Ads can no longer play audio, they can’t see data passing between me and the site they’re embedded into, they can’t abuse popups anymore, etc., etc.. Every time an advertiser comes up with some new annoying way to try and get extra attention, the good folks designing the web and making the browsers patch the hole.

I like that the web standards and browsers, and laws to some extent, are where the responsibility lies, and I wouldn’t want to have individual sites taking responsibility for the security of ads.

As for bemoaning ad blockers, at least keep in mind the ads in ad-supported free content is their revenue stream, and that the majority of ads aren’t malicious. Personally, I’d love to see a better free business model than ad-supported free content. In the mean time, paying directly for ad-free content, and putting up with ads are our main options.

Re: Banner ads on CNN.com contain keyloggers

#73

Post by oh_sigh »

mcny wrote: post #54
oh_sigh wrote: post #38

Earlier quoted context omitted.

Google ads container keyloggers? I doubt that.

> Google ads container keyloggers? I doubt that. Just to be clear, I think they are talking about advertisements placed via Google's platform, not ad campaigns by Google. I think there is only one way to solve this: programmatic ads cannot contain executable code (no access to local storage or network) and ads must come from the same origin as the page they are on. For example, YouTube will host an ad for Subaru on Y…

Again, I still doubt that Google places ads with key loggers via their platform. Maybe I misunderstand something about how they operate though, and I can't recreate anything close to what the original article shows. In fact, I can't even load cnn.com right now.

Re: Banner ads on CNN.com contain keyloggers

#74

Post by sbinthree »

tjoff wrote: post #14
sbinthree wrote: post #2

How likely is this to be due to accessibility (ie. keyboard-only users) vs. keylogging?

How can an add increase accessibility by listening to the keyboard?

Keyboard shortcuts instead of onclick handlers. Unless someone is using Vimium there is no way to use a keyboard to navigate the web without explicitly defined keypress handlers.

Re: Banner ads on CNN.com contain keyloggers

#75

Post by cirenehc »

tialaramex wrote: post #59
cirenehc wrote: post #32

Scripts from the ad should be iframed no? Doesn't make sense that an ad could run arbitrary JS within the same browsing context as the host.

It doesn't make any sense, but it's very popular. To be fair, when they're desperate real world newspapers are like this too. A flush successful newspaper will make a deal of its editorial independence and insist you write "Advertising Feature" in big letters at the top of your full page ad, use a completely different typeface and give your company's name, but when money is tight the guy selling those adverts is unde…

Are you sure this approach is popular? AFAIK none of the top ad platforms allow you to inject scripts. Do you know any?

Re: Banner ads on CNN.com contain keyloggers

#76

Post by tjoff »

sbinthree wrote: post #74
tjoff wrote: post #14

Earlier quoted context omitted.

How can an add increase accessibility by listening to the keyboard?

Keyboard shortcuts instead of onclick handlers. Unless someone is using Vimium there is no way to use a keyboard to navigate the web without explicitly defined keypress handlers.

How do you envision this to work in practice?

Do I need to read a manual for the ad? Also, the ones that actually are dependant on the keyboard will already use Vimium or something else.

Re: Banner ads on CNN.com contain keyloggers

#77

Post by dwild »

SpaceGorilla wrote: post #29
Crontab wrote: post #13

Sites bemoan ad blockers but then take no responsibility for the ads that are shown. That needs to change - it’s not like print advertising.

Right? Imagine IRL advertising that would break into your house and put up advertising posters or plant listening devices.

Seems more taking a plant to your house while knowing it will listen to you, while there is plant that won't listen to you but that you have to pay for.

That listening device is the cost of the plant... don't like it? Then pay to avoid it...

It's that simple, there's no alternative. They have to pay to make that content and send it to you. If it's not advertising that pay for it, that cash won't appear out of thin air. Someone needs to pay for it and if it's not an advertiser that does, it needs to be you.

There's plenty of news agency that offer paid membership without ads, go for them.

There's plenty of people that can't afford to pay or that just doesn't have the means to. I remember the amount of content I was able to learn because advertising was subsidizing it. My parent were sadly against paying on the internet and I'm far from being the only one that learned that way.

Re: Banner ads on CNN.com contain keyloggers

#78

Post by isostatic »

tialaramex wrote: post #59
cirenehc wrote: post #32

Scripts from the ad should be iframed no? Doesn't make sense that an ad could run arbitrary JS within the same browsing context as the host.

It doesn't make any sense, but it's very popular. To be fair, when they're desperate real world newspapers are like this too. A flush successful newspaper will make a deal of its editorial independence and insist you write "Advertising Feature" in big letters at the top of your full page ad, use a completely different typeface and give your company's name, but when money is tight the guy selling those adverts is unde…

And of course this all stems from the fact people have stopped paying for news.

Re: Banner ads on CNN.com contain keyloggers

#80

Post by reilly3000 »

corny wrote: post #62
thaumaturgy wrote: post #56

Lots of speculation here, not much analysis, even from lazy gits like me. Chrome web inspector kindly gives the "Initiator" for every request. In this case it's cnn-header-second.min.js. Load that, and Chrome again kindly detects minified JS and offers to pretty-print it. The context here appears to be some kind of ad console tool, added by CNN, not by an ad. The relevant function is at https://pastebin.com/EwgPAM6T…

Functionality is to enable an "AdFuel Creative Review" form when typing "d o h" anywhere on the page. Try it. Then click the blue icon in the lower right.

The tool is for reviewing bad ads and ad stack QA.
Post reply on HN