Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome deploys deep-linking in latest build despite privacy concerns

theregister.co.uk

Post reply on HN
Print view View original

11–20 of 159 posts

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#11

Post by amsully »

liveoneggs wrote: post #3
thinkingemote wrote: post #2

The quote about DNS seems wrong to me ""Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer," he wrote. "On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested."" I thought DNS requests just get the domain, not the hash and not even the page reque…

also #fragments aren't sent to the server at all, unless this changes that (a major major change if so)

The google document being used talks about crossing an origin-boundary.

So website with bad script injected is loaded by the user and is able to make requests to a logged-in banking website with time-based/scrolling attacks.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#12

Post by tedunangst »

thinkingemote wrote: post #2

The quote about DNS seems wrong to me ""Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer," he wrote. "On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested."" I thought DNS requests just get the domain, not the hash and not even the page reque…

It seems more plausible that I could send you a link to portal.site.example/you-have-cancer-what-now and if you don't have cancer it redirects to portal.site.example/home, if we're willing to consider the infiniverse of possible health care portal designs.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#13

Post by deathanatos »

thinkingemote wrote: post #2

The quote about DNS seems wrong to me ""Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer," he wrote. "On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested."" I thought DNS requests just get the domain, not the hash and not even the page reque…

A sibling/top-level comment has a link to the security doc: https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj...

I think what that is saying is that, say evil.com starts embedding some sensitive site. It can't normally see the contents of that site, b/c it would be cross origin. (Or any other context where I can load a resource, but not see the content.) If I want to know whether some content is or is not in that sensitive site, I use the scroll-to-fragment to scroll to that text: either it will find the text, and scroll to it, or it won't; evil.com won't know the result of that directly, but it might be able to measure timing/CPU work done, and from that, infer the result: whether that text was or was not in the page. From there, repeat the attack to start brute forcing the content of the page. W.r.t. DNS, if the scrolling or lack of scrolling initiate two separate sets of DNS requests that I can observe, then that's one possible way to leak the information on the page.

At least, that's how I'm reading that security doc; this is fairly different from how other responses to your remark are interpreting it, but I wonder if they were only looking at TFA, which really was not very clearly explaining anything.

The security doc also mentions "Restrict feature to user-gesture initiated navigations", which would completely stop the iframe attack I've outlined above.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#18

Post by DoctorOW »

AlexandrB wrote: post #15

IE6 is back, baby! All that’s left is deep integration with some proprietary Google “standard” (I’m thinking AMP) and it’ll be the early 2000s all over again.

It'll be like the early 2000's if switching to another browser was most likely just IE6 reskinned.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#19

Post by davidhyde »

MentallyRetired wrote: post #16

As a developer, how do I lend my support to stopping google from trying to steal the web? Something actionable, something specific to my semi-unique position as a developer?

Only use web technologies supported by the majority of the browsers, not just the majority browser. Basically, use vanilla html5. You can make a perfectly decent website with it. You can play with the shiny (chrome) toys but they should remain curiosities.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#20

Post by abbracadabbra »

DoctorOW wrote: post #18
AlexandrB wrote: post #15

IE6 is back, baby! All that’s left is deep integration with some proprietary Google “standard” (I’m thinking AMP) and it’ll be the early 2000s all over again.

It'll be like the early 2000's if switching to another browser was most likely just IE6 reskinned.

Microsoft Edge, which is built on Chromium, would fit this parallel nicely.
Post reply on HN