Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I recorded user behaviour on my competitor’s websites

dejanseo.com.au

Post reply on HN
Print view View original

251–260 of 329 posts

Re: How I recorded user behaviour on my competitor’s websites

#251

Post by dejanseo »

_bxg1 wrote: post #246
rapind wrote: post #239

Earlier quoted context omitted.

This is the misconception I can't stand. Where we hold individuals responsible for a product / companies defect. I thoroughly disagree with the idea that it's his fault people are vulnerable. So called responsible disclosure is just a marketing spin term. Disclosing bugs privately is a favour not a responsibility. All this does is reduce the risk of bad software decisions. It doesn't solve anything. How about free ma…

This is the most idiotic comment I've ever read on hacker news. "The free market"? What? What does that have to do with anything? Vendors are extremely incentivized to fix bugs and thereby maintain user trust. Google regularly pays out generous bounties for bugs that are reported properly. There are the odd cases where a bug is reported and the company denies it, sits on their hands or threatens the reporter. Those s…

Google? When I brought a serious issue up in 2012 https://dejanseo.com.au/hijack/ Google never fixed it:

In summary, I can take any of your (or anyone else's content) pass more pagerank to it than the original page and then I become the original page. Not only that but all your inbound links now count towards my site and I can see your links in Search Console of my domain.

This is something link graph theory refers to as "link inversion" and is very harmful to smaller publishers.

Re: How I recorded user behaviour on my competitor’s websites

#252

Post by _bxg1 »

dejanseo wrote: post #244
_bxg1 wrote: post #232

Earlier quoted context omitted.

I'm willing to give you the benefit of the doubt and assume you were just unaware of how things are supposed to be done (reporting exploits to the vendors privately and waiting for the fix before going public), but man, you did a fantastically dangerous thing even if it was unintentional. I'd never condone beating up on somebody on the internet, but I dearly hope you've learned a valuable lesson here. You've put lots…

Trying to be objective and understand my own motivations here. Obviously I didn't do anything out of malice. But yes, I could have told Google directly about the problem, but then I'd have no cool story to publish on my blog. At the end of the day, that's what it boils down to. Now that I got too much attention from it, I regret all of it.

"I could have told Google directly about the problem, but then I'd have no cool story to publish on my blog"

First of all, you definitely would. Standard practice is 1) report the bug privately, 2) wait for a fix, 3) get the go-ahead to publish your report and take credit publicly. That's how it always works; that's how security researchers build their reputations and careers. I guess you just weren't aware of that.

Second of all, even if you wouldn't get to publish it, that is horribly selfish reasoning. Putting millions of people at risk of having their information stolen for the sake of a popular blog post?

Re: How I recorded user behaviour on my competitor’s websites

#253

Post by _bxg1 »

dejanseo wrote: post #251
_bxg1 wrote: post #246

Earlier quoted context omitted.

This is the most idiotic comment I've ever read on hacker news. "The free market"? What? What does that have to do with anything? Vendors are extremely incentivized to fix bugs and thereby maintain user trust. Google regularly pays out generous bounties for bugs that are reported properly. There are the odd cases where a bug is reported and the company denies it, sits on their hands or threatens the reporter. Those s…

Google? When I brought a serious issue up in 2012 https://dejanseo.com.au/hijack/ Google never fixed it: In summary, I can take any of your (or anyone else's content) pass more pagerank to it than the original page and then I become the original page. Not only that but all your inbound links now count towards my site and I can see your links in Search Console of my domain. This is something link graph theory refers t…

I can't speak to that particular exploit, but no matter what you always go to the vendor privately first. Period. If they are uncooperative you can then go public. Not before.

Re: How I recorded user behaviour on my competitor’s websites

#254

Post by _bxg1 »

winkeltripel wrote: post #242
_bxg1 wrote: post #232

Earlier quoted context omitted.

I'm willing to give you the benefit of the doubt and assume you were just unaware of how things are supposed to be done (reporting exploits to the vendors privately and waiting for the fix before going public), but man, you did a fantastically dangerous thing even if it was unintentional. I'd never condone beating up on somebody on the internet, but I dearly hope you've learned a valuable lesson here. You've put lots…

I mean, Google has been told (over and over) for a long time that HTTPS doesn't fix trust on the web being broken, and that the back button shouldn't have an API. These are both well documented security problems. What has happened now is that Google is under public pressure and scrutiny to actually fix these things. A fire has been lit under their bum, and rightly so.

I believe they did remove the green lock from https sites to avoid implying trustworthiness. And removing the back button API is something Google can't decide on their own; it has to go through the standards process.

Re: How I recorded user behaviour on my competitor’s websites

#255

Post by refoundglory »

rapind wrote: post #239
_bxg1 wrote: post #232

Earlier quoted context omitted.

I'm willing to give you the benefit of the doubt and assume you were just unaware of how things are supposed to be done (reporting exploits to the vendors privately and waiting for the fix before going public), but man, you did a fantastically dangerous thing even if it was unintentional. I'd never condone beating up on somebody on the internet, but I dearly hope you've learned a valuable lesson here. You've put lots…

This is the misconception I can't stand. Where we hold individuals responsible for a product / companies defect. I thoroughly disagree with the idea that it's his fault people are vulnerable. So called responsible disclosure is just a marketing spin term. Disclosing bugs privately is a favour not a responsibility. All this does is reduce the risk of bad software decisions. It doesn't solve anything. How about free ma…

So you're saying that small companies should just accept that any bugs found will be sold to black hats?

Re: How I recorded user behaviour on my competitor’s websites

#256

Post by gus_massa »

I just realized that it is not necessary to hijack the back button!

1) Watch out for users coming from Google (or Bing) using the referrer field.

2) Choose randomly In 5% of them are redirect them to your shady domain using a temporal 303 redirect. [If Google notice this, they will hate you.]

3) Host a copy of your competitors page in the shady domain, with all the tracking enabled. [This is illegal! You may get a lawyer C&D, nastygram or more.]

I guess that when the user finds your site in Google and click the link, they will most of the time not be sure of with link they choose, so they will not notice the change. And if they realize that they went to the wrong site, they will click the back button and click the search result again, and get the normal page like the 95% of the people.

This is probably more credible if the search field in the referrer doesn't have your site in it, so the user is looking for any generic site that includes you and your competitors.

As I said before, this is shady and some parts are illegal, so don't do it. Google may demote your site, and also you can get some legal problems.

Re: How I recorded user behaviour on my competitor’s websites

#257

Post by UncleMeat »

superasn wrote: post #142
dejanseo wrote: post #54

Hi everyone! I did this. It was just a random cool idea I wanted to try. It worked a little too well and I quickly moved it to a disposable site to test if the page will get penalised by Google. I got busy with other things and forgot about it. When I bumped into it again I decided to write about it, for two reasons: 1) To me it's hard to believe that Chrome would allow for this to happen in the first place and 2) th…

It's sad that everyone is being so harsh to you just because you decided to post about a vulnerability that who knows thousands of other people are quietly exploiting for their own benefit. If anything I am happy that instead of trying to misuse it or keeping it a secret you made it public knowledge so that there can be something done about it. Yes you could have handled it more appropriately and you probably will in…

Back button hijacking has been known for ages. This isn't increasing anybody's security posture. There might be a bit more slack if this was actually new.

Re: How I recorded user behaviour on my competitor’s websites

#258

Post by LyndsySimon »

wiether wrote: post #196
azeirah wrote: post #87

Earlier quoted context omitted.

... Don't use the back button? What? I actually kind of like the ability to move between pages and domains with the back button.

A good website give you the ability to move without this button. It's like Android VS iOS. The first one has a back button, the other don't.

> A good website give you the ability to move without this button.

I disagree, fairly strongly. Re-implementing behavior that the user already has in their client is at best superfluous, and at worst very confusing.

> It's like Android VS iOS. The first one has a back button, the other don't.

iOS apps implement history as part of their UI because iOS doesn't have provision for one in the default UI. This is changing, as gestures become more and more common. I don't think I've actually used a "back button" on my iPhone in months. I pretty much take its presence as communicating that it's possible to go back, not as a means to do so.

Re: How I recorded user behaviour on my competitor’s websites

#259

Post by dwild »

mrob wrote: post #4
lukestevens wrote: post #2

This is an interesting yet disturbing case of blackhat SEO and phishing, where the site owner hijacks the back button and sends visitors to fake sites where he can observe their behaviour. FTA: Here’s what I did: 1. User lands on my page (referrer: google) 2. When they hit “back” button in Chrome, JS sends them to my copy of SERP 3. Click on any competitor takes them to my mirror of competitor’s site (noindex) 4. Now…

Yet another reason to browse with JS disabled by default.

Yeah I know, personally I prefer to use paper, way safer. I plan to just do the full TCP request by hand using the ethernet wire, morse-code-like, next./s

Sure increasing the functionalities increase the risk, it doesn't means the risk isn't worth it or isn't mitigable. Worst case, he fake your back button.. it's not that bad seriously. Google will probably try back buttons and different similar situation now on their engine and deal with theses cases one by one.

Re: How I recorded user behaviour on my competitor’s websites

#260

Post by UncleMeat »

nkozyra wrote: post #146

I don't understand why you would have been expected to report this to Google. It's not an issue or bug with Google, it's a simple gray hat social engineering trick. People linking to fake sites as a dark pattern is nothing novel, you just did so too capture analytics instead of, say, installing a virus or taking someone's credentials. That said, you certainly could have done the latter and gotten views into your comp…

The expectation isnt to report to Google. The expectation is to not do this on live sites affecting real people.
Post reply on HN