Live data from Hacker News

Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

bleepingcomputer.com

31–40 of 56 posts

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#31
post #3

Is this an official statement from Mozilla? If understood right, it says that because every tracking site already does, we will put it inside the browser. It seems like one day Nike will say, we need to send the location of every step you take, where you're heading and the speed so we can make better shoes. And people just, yes, seems fair to me.

It's a little different.

It's more like Nike are fitting their stores with a special floor that track people walking around in the store to figure out where people go and what they find interesting.

There are many vendors of these special floors, and they offer different kinds of reporting to Nike.

At the moment, Nike can't use multiple vendors without careful testing because the floors can potentially interfere with eachother. Sometimes the interactions only occur in extreme cases, such as massively overweight or underweight individuals. Nike may not be floor experts and not know how to to this. It also makes the floor "thicker" with multiple vendors special floors layered on top of each other, which might feel weird walking on.

These vendors don't just sell to Nike, they sell to lots of stores. Obviously they don't share Nike's "data" with ASIC but each of them have to deal with the fact that even if they solve the problem for Nike's chosen set of vendors, they'll have to do it again for ASIC as well.

So, the floor vendors got together and proposed a mechanism whereby they can all work together.

No new privacy leak, no new information is being generated, or even being transmitted to anyone who didn't already have the ability to collect it, but the implementation is simpler, and user experience is better.

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#32

> "We don’t believe that offering an option to disable this feature alone will have any meaningful improvement in the user privacy, since website can (and often already do) detect the various supported mechanisms for hyperlink auditing in each browser and disabling the more user friendly mechanisms will cause them to fall back to the less user friendly ones, without actually disabling the hyperlink auditing functiona…

The solution to this is eg a content blocker in safari. The browser still reports “ping” as usable so no blocking of the user or expensive (resource wise) js alternatives, but when you click the link the URL is evaluated as being blocked and safari does nothing relating to the ping. This isn’t theory, I’ve tested it and it works. I don’t know enough about blocking capabilities in Firefox to theorise how it would work…

> This isn’t theory, I’ve tested it and it works.

That only works when the destination URL of the ping is specified as a content blocker rule. Content blockers are too limited to block the ping mechanism itself, so you would need to statically add every single arbitrary tracker URL pattern to the ruleset and hope they don't match a site or resource you want.

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#33
post #29
post #19

This feature allows a trivial DDOS attack to be constructed https://securityaffairs.co/wordpress/83890/hacking/ddos-html... https://www.nsaneforums.com/topic/341522-hyperlink-auditing-... you can always downgrade your FF version and turn off auto updates, or go to a custom palemoon, then have a chat with mozilla about why you did so.

I (former Firefox developer) do not see how using ping for this sort of attack has any advantage over any of the other myriad ways Javascript running in a browser can generate traffic to a site. If it does have an advantage, it's probably just something incidental like particular HTTP proxies being configured to let pings through, or something like that.

no it involves multiple links being pointed at one webserver. read the article and you will see. you dont need JS or any skill other than knowing how to use an HTML5 tag and malform a ping for every link. you just need a good piece of clickbait is all.

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#34
post #19

This feature allows a trivial DDOS attack to be constructed https://securityaffairs.co/wordpress/83890/hacking/ddos-html... https://www.nsaneforums.com/topic/341522-hyperlink-auditing-... you can always downgrade your FF version and turn off auto updates, or go to a custom palemoon, then have a chat with mozilla about why you did so.

Installing ublock origin is far preferable to an old version of Firefox or an old version of Firefox with branding.

when as mozilla is apparently stating, pinging is turned on by default, and cant be disabled, that is the point when you use a different version. there are a lot of people who block JS regardless of how it "breaks a page" I for one can live without pages that require JS for anything more than a blank page

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#35

Earlier quoted context omitted.

The solution to this is eg a content blocker in safari. The browser still reports “ping” as usable so no blocking of the user or expensive (resource wise) js alternatives, but when you click the link the URL is evaluated as being blocked and safari does nothing relating to the ping. This isn’t theory, I’ve tested it and it works. I don’t know enough about blocking capabilities in Firefox to theorise how it would work…

> This isn’t theory, I’ve tested it and it works. That only works when the destination URL of the ping is specified as a content blocker rule. Content blockers are too limited to block the ping mechanism itself, so you would need to statically add every single arbitrary tracker URL pattern to the ruleset and hope they don't match a site or resource you want.

That is literally my point.

You don’t need to “block” the ping functionality (which itself would be come a fingerprinting data point) any more than you need to block xhr/fetch or following 301 redirects (which are also used for the same purposes the ping attribute may be used for)

There are literally dozens of content blockers available for both macOS and iOS and all have extensive block lists of trackers, ad networks, etc. Some also allow you to add custom rules.

That same content blocker will also block XHR/fetch based link tracking that many will just fallback to if ping support is not detected.

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#36
post #29
post #19

This feature allows a trivial DDOS attack to be constructed https://securityaffairs.co/wordpress/83890/hacking/ddos-html... https://www.nsaneforums.com/topic/341522-hyperlink-auditing-... you can always downgrade your FF version and turn off auto updates, or go to a custom palemoon, then have a chat with mozilla about why you did so.

I (former Firefox developer) do not see how using ping for this sort of attack has any advantage over any of the other myriad ways Javascript running in a browser can generate traffic to a site. If it does have an advantage, it's probably just something incidental like particular HTTP proxies being configured to let pings through, or something like that.

Probably more that certain sites are using serverside XSS filters that allow third party content a elements with ping attributes, but not to inject arbitrary JavaScript.

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#37
post #28
post #27

Earlier quoted context omitted.

Not supporting it means sites without tracking have better user experience. Now tracking is natively supported, everyone can just start doing tracking without any of the disadvantages.

That argument would carry weight if you could point to sites that deliberately avoid outbound link tracking because of the impact on the user experience. I've never heard of any.

That's not what GP was saying. They were saying that given two websites, one that doesn't track and one that does, the one that doesn't would have a better user experience as a side effect, which would give it a competitive advantage in this "department" over the one that does track. So, all things being equal, users would choose the one that doesn't track for the simple virtue of it giving them a better experience.

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#38

> "We don’t believe that offering an option to disable this feature alone will have any meaningful improvement in the user privacy, since website can (and often already do) detect the various supported mechanisms for hyperlink auditing in each browser and disabling the more user friendly mechanisms will cause them to fall back to the less user friendly ones, without actually disabling the hyperlink auditing functiona…

What if it was a compile-time option?

If those capable were compiling and sharing versions of Firefox without some of these "features", perhaps some users might be interested.

Bias/ignorance: I like to use smaller software for doing TCP connections and HTTP requests that require more modest resources and shorter time to compile; often these projects provide many compile-time options. There are many, many examples of such software. First example that comes to mind for some reason is socat, if one needs an example of what I mean.

Re: Mozilla Firefox to Enable Hyperlink Ping Tracking by Default

#39
post #31
post #3

Is this an official statement from Mozilla? If understood right, it says that because every tracking site already does, we will put it inside the browser. It seems like one day Nike will say, we need to send the location of every step you take, where you're heading and the speed so we can make better shoes. And people just, yes, seems fair to me.

It's a little different. It's more like Nike are fitting their stores with a special floor that track people walking around in the store to figure out where people go and what they find interesting. There are many vendors of these special floors, and they offer different kinds of reporting to Nike. At the moment, Nike can't use multiple vendors without careful testing because the floors can potentially interfere with…

Or, you can make this "floor tracking" so difficult and circumventable that people start to question it and decide that new pair of shiny shoes doesn't deserve the added hassle of walking in them.

There's that producer of floors that stands against these forms of tracking and says "go to the stores that buy from us, they won't track you!" So this benefits the stores that but from them, the floor maker and the store's patrons.

But this analogy broke down pretty soon this way, didn't it?

Post reply on HN