Virtual Machine Detection in the Browser (2019) • Hacker News Board

Re: Virtual Machine Detection in the Browser (2019)

#11

Post by chii » Sat, Dec 19, 2020, 4:30 AM UTC

emptyparadise wrote: post #3

You already get banished from half of the internet for hiding your IP address, I hope this wouldn't be used to make our lives even worse. Imagining a grim future where sites block all ad blockers (how about some detecting if an ad blocker exists at all, rather than its usage?), VPNs, virtual machines, even incognito mode. No full trust = no website.

Then do go to those websites. It's not a right that you have access to a website.

Seek out only sites that don't block adblock, or has no ads. This might include a paid option (for example, youtube premium, or twitch subscription for ad-free viewing).

Re: Virtual Machine Detection in the Browser (2019)

#12

Post by ogre_codes » Sat, Dec 19, 2020, 4:34 AM UTC

Wowfunhappy wrote: post #9

ogre_codes wrote: post #8

Earlier quoted context omitted.

I agree with this in most cases, but when it comes to Javascript and fingerprinting, I think systems should be as generic as possible. This isn't even a VM versus bare metal thing.

Right, and so browsers need to fix this! Not because of VMs but because a web page, unlike desktop software, has no business knowing my graphics card.

> Right, and so browsers need to fix this!

Makes sense to me. There are a lot of legitimate reasons software on your computer might need to know it's in a VM or what the limits of your VR engine are.

Re: Virtual Machine Detection in the Browser (2019)

#13

Post by emptyparadise » Sat, Dec 19, 2020, 4:37 AM UTC

chii wrote: post #11

emptyparadise wrote: post #3

You already get banished from half of the internet for hiding your IP address, I hope this wouldn't be used to make our lives even worse. Imagining a grim future where sites block all ad blockers (how about some detecting if an ad blocker exists at all, rather than its usage?), VPNs, virtual machines, even incognito mode. No full trust = no website.

Then do go to those websites. It's not a right that you have access to a website. Seek out only sites that don't block adblock, or has no ads. This might include a paid option (for example, youtube premium, or twitch subscription for ad-free viewing).

I may not have the right to have access to most of these websites but I do have the right to complain about how unethical I find it.

And of course this situation has different implications if the website offers some sort of an essential service, but that's an entirely different discussion.

Re: Virtual Machine Detection in the Browser (2019)

#14

Post by grimli333 » Sat, Dec 19, 2020, 4:37 AM UTC

Wowfunhappy wrote: post #9

ogre_codes wrote: post #8

Earlier quoted context omitted.

I agree with this in most cases, but when it comes to Javascript and fingerprinting, I think systems should be as generic as possible. This isn't even a VM versus bare metal thing.

Right, and so browsers need to fix this! Not because of VMs but because a web page, unlike desktop software, has no business knowing my graphics card.

Well, presumably there may be valid use cases for WebGL applications or games behaving differently according to specific vendors/drivers.

It feels like something that needs to be asked permission for, however, so it can’t be used for nefarious purposes.

Re: Virtual Machine Detection in the Browser (2019)

#15

Post by Wowfunhappy » Sat, Dec 19, 2020, 4:44 AM UTC

grimli333 wrote: post #14

Wowfunhappy wrote: post #9

Earlier quoted context omitted.

Right, and so browsers need to fix this! Not because of VMs but because a web page, unlike desktop software, has no business knowing my graphics card.

Well, presumably there may be valid use cases for WebGL applications or games behaving differently according to specific vendors/drivers. It feels like something that needs to be asked permission for, however, so it can’t be used for nefarious purposes.

...I don't know. I realize this is an entirely subjective view of what a web page should be, but I just don't think any website should know the intricacies of my hardware. The web is a low-friction, low-trust environment; installing a desktop app has more friction, but it also acts as a signal of greater trust.

If a website ever really needs to know my hardware, it can ask me to choose from a drop-down. A lot of users won't know what hardware they have—but, those users are also unlikely to understand the implications of a hardware-detection permission prompt.

Re: Virtual Machine Detection in the Browser (2019)

#16

Post by colordrops » Sat, Dec 19, 2020, 4:53 AM UTC

emptyparadise wrote: post #3

You already get banished from half of the internet for hiding your IP address, I hope this wouldn't be used to make our lives even worse. Imagining a grim future where sites block all ad blockers (how about some detecting if an ad blocker exists at all, rather than its usage?), VPNs, virtual machines, even incognito mode. No full trust = no website.

How do you hide your IP address? Are you referring to using a VPN?

Re: Virtual Machine Detection in the Browser (2019)

#17

Post by koluna » Sat, Dec 19, 2020, 4:54 AM UTC

I am honestly more surprised by the fact that we let these kinds of APIs creep into our browsers. What’s the scenario where a website needs to know how much RAM or what kind of video adapter I have? I get it for a game or a desktop app, but a website?

At the end of the day, we all know that any kinds of unique identifiers will be used in combination. We need to reduce those to an absolute minimum. Today’s browser APIs are leaking information like a 1920s faucet.

Re: Virtual Machine Detection in the Browser (2019)

#18

Post by geofft » Sat, Dec 19, 2020, 4:59 AM UTC

userbinator wrote: post #2

quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information. I believe there are patches that can close those holes, but I've always found the fact that such infor…

> Ideally, a VM should be indistinguishable from real hardware

Why? I mean, it's possible to make a VM that's indistinguishable (except for speed), but what's the purpose of doing so?

Most people who run VMs have the purpose of "I want this application to run more conveniently than having dedicated hardware for it." For that purpose, it's useful to provide abstractions (e.g., providing dedicated access to CPUs in a way normal kernels usually don't) and usually to provide sandboxing (e.g., prohibiting disk writes outside of the VM disk), but there's generally little point in lying, unless the software you want to run won't run right without lying. And it's often counterproductive to lie, because software can adapt to the ways the abstraction is leaky if you're truthful about the nature of the abstraction. (In this case, the VMware graphics driver can achieve much better performance by cooperating with the host than a normal graphics driver expecting physical hardware could get on a software emulation of that hardware.)

It's also often pointless to lie - if you pay for a VM from Amazon EC2, and you log into it and it pretends to be a 1U physical server, are you going to believe it?

Re: Virtual Machine Detection in the Browser (2019)

#19

Post by geofft » Sat, Dec 19, 2020, 5:02 AM UTC

koluna wrote: post #17

I am honestly more surprised by the fact that we let these kinds of APIs creep into our browsers. What’s the scenario where a website needs to know how much RAM or what kind of video adapter I have? I get it for a game or a desktop app, but a website? At the end of the day, we all know that any kinds of unique identifiers will be used in combination. We need to reduce those to an absolute minimum. Today’s browser API…

Sometimes people put games and desktop apps in websites.

And, really, when you download a game or desktop app as a traditional executable, the OS gives it so much access to your private data that the term "leak" isn't meaningful any more. Any video game you install as a .exe can silently access every email and online banking account you either are logged into or will log into in the future.

Re: Virtual Machine Detection in the Browser (2019)

#20

Post by emptyparadise » Sat, Dec 19, 2020, 5:05 AM UTC

colordrops wrote: post #16

emptyparadise wrote: post #3

You already get banished from half of the internet for hiding your IP address, I hope this wouldn't be used to make our lives even worse. Imagining a grim future where sites block all ad blockers (how about some detecting if an ad blocker exists at all, rather than its usage?), VPNs, virtual machines, even incognito mode. No full trust = no website.

How do you hide your IP address? Are you referring to using a VPN?

VPNs, proxies, Tor, you name it.