Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome deploys deep-linking in latest build despite privacy concerns

theregister.co.uk

Post reply on HN
Print view View original

101–110 of 159 posts

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#101

Post by chias »

bad_user wrote: post #94

I avoid Chrome due to privacy concerns, but I actually like this feature ¯\_(ツ)_/¯ Many times I'm looking for an existing anchor for linking to a certain section of the page, because the author did not bother to create a table of contents and many times that anchor ID is missing. Also — I was under the impression that anything that comes after # is not sent to the server, being a fragment meant to be processed entire…

Let me give you an example. It will be contrived for simplicity but there are circumstances that will seem more real-worldish. Lets consider the following scenario:

- you visit a page at example.com that contains private data about you (e.g. bank account number, medical conditions, what have you)

- this page loads external resources only when they are scrolled into view

- it also hotlinks some image below the fold that a potentially bad actor can see requests to (maybe the image is on their webserver, maybe you're on a corp network and they can see dns resolutions, whatever)

So now I link you to: https://example.com/privatepage#:~:text=Account%201

Did the image get requested? If yes, I know your account number starts with 1; if not, I know it starts with something other than 1. Rinse and repeat.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#102

Post by [deleted] »

ogre_codes wrote: post #100
bad_user wrote: post #94

I avoid Chrome due to privacy concerns, but I actually like this feature ¯\_(ツ)_/¯ Many times I'm looking for an existing anchor for linking to a certain section of the page, because the author did not bother to create a table of contents and many times that anchor ID is missing. Also — I was under the impression that anything that comes after # is not sent to the server, being a fragment meant to be processed entire…

I think this paragraph sort-of fills it in: > "Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer," he wrote. "On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested." The impression I got was that you'd need a combined hack with javascript readi…

[deleted]

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#104

Post by bad_user »

internalthief wrote: post #99
JaceLightning wrote: post #95

Earlier quoted context omitted.

> Also — I was under the impression that anything that comes after # is not sent to the server, being a fragment meant to be processed entirely by the client. You aren't missing anything. The article is wrong.

The article isn't wrong, by forcing scroll to a certain location and embedding for example images that only load when scrolled into view the web server can know that someone was linked to a particular section of the website with the new deep-linking feature. This is especially the case if the browser scrolls and doesn't load all prior resources automatically because they were never "in view".

You can already measure where the visitor's view is and notice the sections at which the visitor stares the most.

The scenario you've given is also very similar to a scenario in which the user opens the web page and then manually searches for "cancer". Or scrolls down rapidly until they notice the word "cancer" and then stops. I do that all the time for example.

So I don't see how excluding such a feature protects the user in any way compared with the status quo.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#105

Post by tpmx »

chias wrote: post #101
bad_user wrote: post #94

I avoid Chrome due to privacy concerns, but I actually like this feature ¯\_(ツ)_/¯ Many times I'm looking for an existing anchor for linking to a certain section of the page, because the author did not bother to create a table of contents and many times that anchor ID is missing. Also — I was under the impression that anything that comes after # is not sent to the server, being a fragment meant to be processed entire…

Let me give you an example. It will be contrived for simplicity but there are circumstances that will seem more real-worldish. Lets consider the following scenario: - you visit a page at example.com that contains private data about you (e.g. bank account number, medical conditions, what have you) - this page loads external resources only when they are scrolled into view - it also hotlinks some image below the fold th…

> Rinse and repeat.

How exactly would you as an attacker perform this rinse and repeat action?

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#106

Post by bradyd »

tootie wrote: post #88
squeaky-clean wrote: post #41

Earlier quoted context omitted.

The github issue has more actual examples. The important bit is the "looking for lower-on-the-page resources being requested." bit. You can't necessarily tell anything from that lone DNS request. But after loading the page, the user's browser will go on to send requests for elements on the page, and anything JS wants to grab based on position, which can be a channel for information. Example: 99% of your employees' DN…

You don't send URLs or query parameters to a DNS server. Only a hostname. Also, it's usually cached after the first lookup. Sniffing the network will only requests to that IP. Hostnames, URLs, params and responses are all fully encrypted if they're on https.

Hostnames are not encrypted in HTTPS requests. They are sent in plain text via SNI (Server Name Indication). There is a new way of handling this called ESNI that does encrypt it, but I'm not sure how widely that is supported.

Edit: Cloudflare has a page to check if ESNI is supported by your browser. I tested it in the latest version of Firefox, Chrome, and Safari and it failed the test in all three.

https://www.cloudflare.com/ssl/encrypted-sni/

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#107

Post by jfim »

derefr wrote: post #90

Amusingly, I built a (private prototype of an) extension for functionality almost exactly like this a while ago. My goal was to be able to bookmark arbitrary long articles (or single-page books) “in the middle”—without the author providing an anchor permalink—and then come back to them where I left off, precisely by embedding my scroll location on the page into the fragment of the bookmarked URL. It worked pretty wel…

For those confused by the "Xanadu transclusions" part, it's basically quoting documents through hyperlinks (somewhat like OLE embedding on Windows).

See https://en.wikipedia.org/wiki/Transclusion

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#108

Post by chadlavi »

tpmx wrote: post #105
chias wrote: post #101

Earlier quoted context omitted.

Let me give you an example. It will be contrived for simplicity but there are circumstances that will seem more real-worldish. Lets consider the following scenario: - you visit a page at example.com that contains private data about you (e.g. bank account number, medical conditions, what have you) - this page loads external resources only when they are scrolled into view - it also hotlinks some image below the fold th…

> Rinse and repeat. How exactly would you as an attacker perform this rinse and repeat action?

and why would a bank site hotlink to an asset owned by someone else?

All the security concerns I've seen for this seem quite contrived to me. And I say that as someone who assiduously avoids google products*

(*alas, except at work, because I can't really choose that)

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#109

Post by merrywhether »

prophesi wrote: post #71
merrywhether wrote: post #46

Earlier quoted context omitted.

Say you have a long page that lists “Pre-existing conditions” at the bottom, and near that section is also a unique image or other external asset. If you click on the link and cancer is in your list, the page will scroll and load the related assets instantly. Without cancer in your list, you’d only load those assets through human scroll, which would most likely look different timing-wise. Thus you can determine with…

This is absurdly difficult to pull off with very little payoff. You'd need to be sniffing the traffic of a network. Then craft a URL that contains a unique image near your text fragment query. Then somehow send that URL to the victims on your network. _Then_ check how long it takes for them to load that image upon clicking the URL. I'd like to call myself a privacy advocate, but this is just absurd. The pros obviousl…

For what it’s worth, I wasn’t trying to say that this is an easy attack, just explaining the supposed outline.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#110

Post by chadlavi »

notatoad wrote: post #91
prophesi wrote: post #71

Earlier quoted context omitted.

This is absurdly difficult to pull off with very little payoff. You'd need to be sniffing the traffic of a network. Then craft a URL that contains a unique image near your text fragment query. Then somehow send that URL to the victims on your network. _Then_ check how long it takes for them to load that image upon clicking the URL. I'd like to call myself a privacy advocate, but this is just absurd. The pros obviousl…

>I'd like to call myself a privacy advocate, but this is just absurd. Yeah, my read of this is that it has nothing to do with privacy, people who want to block change for some reason have just learned that "i have privacy concerns about google" is a catchword that will get you some press coverage, and are essentially hijacking the actually valid and important privacy concerns to push forward their unrelated opinions…

This is my take on this, too.

As a FF user, I'd love to see FF implement this too!

Post reply on HN