Chrome deploys deep-linking in latest build despite privacy concerns • Hacker News Board

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#61

Post by dredmorbius » Fri, Feb 21, 2020, 4:35 PM UTC

phillipseamore wrote: post #24

What? A DNS lookup doesn't include anything but the hostname and anything following a hash is never sent with a request from the browser.

This Google Doc (posted earlier in this thread) seems to desribe possible attack vectors far more clearly than either the Forbes or Register articles (second being better than the first as well):

https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj...

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#62

Post by pornel » Fri, Feb 21, 2020, 4:36 PM UTC

There are plenty of reasons one would want to switch away from Chrome, but potential abuse of ScrollToTextFragment must be the most contrived one.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#63

Post by ryanolsonx » Fri, Feb 21, 2020, 4:37 PM UTC

If I'm understanding his correctly, google actually changes the HTML to have these anchor tags?

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#64

Post by l33tman » Fri, Feb 21, 2020, 4:40 PM UTC

JaceLightning wrote: post #37

Uhhhhh, you do realize the anchor (#...) is not sent to the server, right?

The attack depends on measuring the timing of resource-loading that in turn depends on the free-text search the attacker can get the victim browser to do on his behalf.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#65

Post by def_true_false » Fri, Feb 21, 2020, 4:42 PM UTC

sincerely wrote: post #43

blakesterz wrote: post #7

The article says the folks at Google have this short docs to address the concerns: Scroll-to-text Fragment Navigation - Security Issues https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj...

I don't have access to this document, is there a mirror?

https://pastebin.com/raw/M1yQMK3h

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#66

Post by blitmap » Fri, Feb 21, 2020, 4:43 PM UTC

AlexandrB wrote: post #15

IE6 is back, baby! All that’s left is deep integration with some proprietary Google “standard” (I’m thinking AMP) and it’ll be the early 2000s all over again.

I'm actually looking forward to WebAssembly but I'm just imagining wasm applications tying into ChromeOS and we have ActiveX all over again.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#67

Post by ghostpepper » Fri, Feb 21, 2020, 4:43 PM UTC

netsharc wrote: post #9

thinkingemote wrote: post #2

The quote about DNS seems wrong to me ""Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer," he wrote. "On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested."" I thought DNS requests just get the domain, not the hash and not even the page reque…

Kind of an edge case privacy issue, IMO. Imagine if the page has 10 parts. Part 1 has an image reference hosted on part1.imagehost.xyz, but loaded lazily. Each part has something analogous, an image hosted on a different domain, but loaded lazily (so, no requests before that part of the page is visible). If you open the page and read from the top, the browser will open with part 1, Javascript will fire and tell the b…

I read it as the opposite, where the evil party doesn't control the browser but they can sniff traffic on the network and now they can see which part of a page you requested instead of merely which page.

I am not a web dev so I'd love to hear someone with more knowledge spell out some other privacy concerns.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#68

Post by ghostpepper » Fri, Feb 21, 2020, 4:45 PM UTC

squeaky-clean wrote: post #41

thinkingemote wrote: post #2

The quote about DNS seems wrong to me ""Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer," he wrote. "On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested."" I thought DNS requests just get the domain, not the hash and not even the page reque…

The github issue has more actual examples. The important bit is the "looking for lower-on-the-page resources being requested." bit. You can't necessarily tell anything from that lone DNS request. But after loading the page, the user's browser will go on to send requests for elements on the page, and anything JS wants to grab based on position, which can be a channel for information. Example: 99% of your employees' DN…

Does this require you to intercept their traffic on the network? If not, how do you know what their page load looks like?

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#69

Post by DanHulton » Fri, Feb 21, 2020, 4:46 PM UTC

ryanolsonx wrote: post #63

If I'm understanding his correctly, google actually changes the HTML to have these anchor tags?

No, it's a selector, but one that can include the actual text in the page. So instead of having to select based on a pre-existing anchor, like `http://site.com/page#anchor`, you can link to `http://site.com/page#understanding+his+correctly` (though that's not their format). No need to alter the markup.

Though, I'm curious how this works when text is broken apart over spans or divs.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#70

Post by ghostpepper » Fri, Feb 21, 2020, 4:48 PM UTC

I think a lot of the comments in this thread are trying to evaluate the privacy concerns on merit, which makes sense, but IMHO it's also instructive to look at the fact that other W3C members don't want this included and Google is able to do it anyway. Perhaps that should be the bigger cause for alarm than any one feature.