Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JavaScript can snoop on other browser tabs to work out what you're visiting

theregister.co.uk

Post reply on HN
Print view View original

41–50 of 68 posts

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#41

Post by crankylinuxuser »

efdee wrote: post #27
detritus wrote: post #23

Earlier quoted context omitted.

It's not ‘clickbait’, it's a headline. It's meant to attract attention and engage the user. See the red top header The Register uses? That's a nod to British tabloid newspaper mastheads going back decades, and The Register likens itself to similar hovels of deplorable journalist talent-waste. Not everything is some clinically cynical attempt to con the contemporary reader — sometimes such effort is intentionally tong…

I can't be the only one who feels The Register _IS_ a tabloid. Not tongue-in-cheek.

Yep. It feels like the "IT National Enquirer".

* SEE WHAT INTERNET EXPLORDED DID BEHIND THE SCENES!

* 10 SECRETS FIREFOX DOESN'T WANT YOU TO KNOW

* USING A FREE VPN? WHY NOT SKIP THE MIDDLEMAN AND SEND YOUR DATA TO XI JINGPING?

* MICROSOFT: YOU LOOKIN AT ME FUNNY? OH, YOU JUST WANT TO SIGN IN

(Btw, the last 2 are legit, from the website right now...)

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#42

Post by admax88q »

crankylinuxuser wrote: post #41
efdee wrote: post #27

Earlier quoted context omitted.

I can't be the only one who feels The Register _IS_ a tabloid. Not tongue-in-cheek.

Yep. It feels like the "IT National Enquirer". * SEE WHAT INTERNET EXPLORDED DID BEHIND THE SCENES! * 10 SECRETS FIREFOX DOESN'T WANT YOU TO KNOW * USING A FREE VPN? WHY NOT SKIP THE MIDDLEMAN AND SEND YOUR DATA TO XI JINGPING? * MICROSOFT: YOU LOOKIN AT ME FUNNY? OH, YOU JUST WANT TO SIGN IN (Btw, the last 2 are legit, from the website right now...)

> USING A FREE VPN? WHY NOT SKIP THE MIDDLEMAN AND SEND YOUR DATA TO XI JINGPING?

That's a great headline. What's your problem with it? Does IT journalism need to be dry and purely technical?

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#43

Post by code_duck »

leni536 wrote: post #3

I think it would be more appropriate to link the paper[1] and use its title (as it's much more descriptive). [1] https://arxiv.org/abs/1811.07153 Robust Website Fingerprinting Through the Cache Occupancy Channel

“Robust Website Fingerprinting“ sounds like something that is done to a website, not a user. It depends on your audience. I don’t think HN is quite that specialized.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#44

Post by MuppetMaster42 »

dahart wrote: post #40

I see a lot of suggestions to throttle or randomize the cache somehow, and none to stop JavaScript for background tabs. What are the reasons that disallowing background JS might not be preferable? Doesn’t Safari do this by default? And I’m not sure but I imagine that even allowing a background timeslice every once in a while would allow for background notifications and connections while preventing timing attacks?

Chrome throttles background JavaScript by default (disables requestAnimationFrame entirely, reduces allowed runtime to around 1% of real time, etc) [1].

However disabling it entirely would break a lot of use cases.

Chat apps would stop working, push notifications would no longer come, web sockets would stop getting processed, feeds would not get refreshed. You'd break a lot of the web.

Doing so would force more companies to push out their own separate apps... Which would probably be electron (and I know how much HN hates electron).

[1] https://developers.google.com/web/updates/2017/03/background...

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#46

Post by detritus »

admax88q wrote: post #42
crankylinuxuser wrote: post #41

Earlier quoted context omitted.

Yep. It feels like the "IT National Enquirer". * SEE WHAT INTERNET EXPLORDED DID BEHIND THE SCENES! * 10 SECRETS FIREFOX DOESN'T WANT YOU TO KNOW * USING A FREE VPN? WHY NOT SKIP THE MIDDLEMAN AND SEND YOUR DATA TO XI JINGPING? * MICROSOFT: YOU LOOKIN AT ME FUNNY? OH, YOU JUST WANT TO SIGN IN (Btw, the last 2 are legit, from the website right now...)

> USING A FREE VPN? WHY NOT SKIP THE MIDDLEMAN AND SEND YOUR DATA TO XI JINGPING? That's a great headline. What's your problem with it? Does IT journalism need to be dry and purely technical?

Somewhat ironically, The Register has a misbegotten step-sibling, https://www.theinquirer.net/ [1], which tends towards the dry and purely technical and I've always found it thoroughly unenjoyable.

[1] I can't remember the history [2], but long ago there was some disagreement and subsequent parting of ways and The Inquirer was born

[2] Wikipedia does though, obviously: https://en.wikipedia.org/wiki/The_Register "[co-founder Mike] Magee left in 2001 to start competing publications The Inquirer, and later the IT Examiner and TechEye."

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#47

Post by eeZah7Ux »

Browsers and javascript has been security disasters for decades and yet the web crowd perpetuates this model and even plans for webassembly.

Large webassembly applications will make it extremely difficult to inspect suspicious code for this kind of attacks.

Dodgy ad providers will exploit similar vulnerabilities to better track user behavior or worse.

Yet, there isn't an ongoing discussion on limiting the resources available to random websites. The idea of not enabling js by default is seen as absurd.

Good luck to all of us: browsers are developed by companies selling ads.

EDIT: Judging by the downvotes looks like I struck a nerve.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#48

Post by gowld »

dandare wrote: post #34

>This fingerprinting attack involves using JavaScript to measure processor cache access latency over time as websites are loaded Can someone explain to me how exactly can JavaScript measure processor cache access latency? Also, isn't the performance of inactive tab supposed to be throttled?

It's not a direct measurement, but a program can request an action ("get data from a website") and measure how long it takes. Short time implies cached.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#49

Post by gowld »

eeZah7Ux wrote: post #47

Browsers and javascript has been security disasters for decades and yet the web crowd perpetuates this model and even plans for webassembly. Large webassembly applications will make it extremely difficult to inspect suspicious code for this kind of attacks. Dodgy ad providers will exploit similar vulnerabilities to better track user behavior or worse. Yet, there isn't an ongoing discussion on limiting the resources a…

This isn't a language problem, it's a computers and networking problem.
Post reply on HN