Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual Machine Detection in the Browser (2019)

bannedit.github.io

Post reply on HN
Print view View original

21–30 of 98 posts

Re: Virtual Machine Detection in the Browser (2019)

#21

Post by koluna »

geofft wrote: post #19
koluna wrote: post #17

I am honestly more surprised by the fact that we let these kinds of APIs creep into our browsers. What’s the scenario where a website needs to know how much RAM or what kind of video adapter I have? I get it for a game or a desktop app, but a website? At the end of the day, we all know that any kinds of unique identifiers will be used in combination. We need to reduce those to an absolute minimum. Today’s browser API…

Sometimes people put games and desktop apps in websites. And, really, when you download a game or desktop app as a traditional executable, the OS gives it so much access to your private data that the term "leak" isn't meaningful any more. Any video game you install as a .exe can silently access every email and online banking account you either are logged into or will log into in the future.

A video game installation is a conscious choice that I can make depending on whether I trust the vendor or not. Me visiting New York Times and getting 58 trackers scraping my device configuration and preferences is not a choice.

Re: Virtual Machine Detection in the Browser (2019)

#22

Post by _lqaf »

chii wrote: post #11
emptyparadise wrote: post #3

You already get banished from half of the internet for hiding your IP address, I hope this wouldn't be used to make our lives even worse. Imagining a grim future where sites block all ad blockers (how about some detecting if an ad blocker exists at all, rather than its usage?), VPNs, virtual machines, even incognito mode. No full trust = no website.

Then do go to those websites. It's not a right that you have access to a website. Seek out only sites that don't block adblock, or has no ads. This might include a paid option (for example, youtube premium, or twitch subscription for ad-free viewing).

This entirely ignores the implications of a society that heads down that path.

There are questions substantially more interesting than a reductionist "do I have an innate right to access private websites?"

Re: Virtual Machine Detection in the Browser (2019)

#23

Post by judge2020 »

emptyparadise wrote: post #13
chii wrote: post #11

Earlier quoted context omitted.

Then do go to those websites. It's not a right that you have access to a website. Seek out only sites that don't block adblock, or has no ads. This might include a paid option (for example, youtube premium, or twitch subscription for ad-free viewing).

I may not have the right to have access to most of these websites but I do have the right to complain about how unethical I find it. And of course this situation has different implications if the website offers some sort of an essential service, but that's an entirely different discussion.

OP is just suggesting you vote with your 'wallet' by not using those sites - they're not saying you should stop complaining.

Re: Virtual Machine Detection in the Browser (2019)

#24

Post by pishpash »

koluna wrote: post #21
geofft wrote: post #19

Earlier quoted context omitted.

Sometimes people put games and desktop apps in websites. And, really, when you download a game or desktop app as a traditional executable, the OS gives it so much access to your private data that the term "leak" isn't meaningful any more. Any video game you install as a .exe can silently access every email and online banking account you either are logged into or will log into in the future.

A video game installation is a conscious choice that I can make depending on whether I trust the vendor or not. Me visiting New York Times and getting 58 trackers scraping my device configuration and preferences is not a choice.

It is as much a choice as installing an .exe. Treat the web browser like the OS of old, because that's exactly what browser makers think of it.

Re: Virtual Machine Detection in the Browser (2019)

#25

Post by yjftsjthsd-h »

Wowfunhappy wrote: post #15
grimli333 wrote: post #14

Earlier quoted context omitted.

Well, presumably there may be valid use cases for WebGL applications or games behaving differently according to specific vendors/drivers. It feels like something that needs to be asked permission for, however, so it can’t be used for nefarious purposes.

...I don't know. I realize this is an entirely subjective view of what a web page should be , but I just don't think any website should know the intricacies of my hardware. The web is a low-friction, low-trust environment; installing a desktop app has more friction, but it also acts as a signal of greater trust. If a website ever really needs to know my hardware, it can ask me to choose from a drop-down. A lot of use…

I mean, it's the usual duality. If a browser is for browsing documents, then of course you don't need that. And if a browser is a method for running arbitrary applications pseudo-safely, then it absolutely should be doing that.

Re: Virtual Machine Detection in the Browser (2019)

#26

Post by yjftsjthsd-h »

Wowfunhappy wrote: post #7
zensavona wrote: post #6

Earlier quoted context omitted.

And most importantly, it should be checked by default IMO

...no, that's where I don't agree. Again, software should attempt to be truthful by default. There's a reason we allow programs to detect the hardware they're running on—it allows for all sorts of optimizations. Does the VM claim it's network driver was manufactured by Broadcom, or does it go with Cambridge Silicon Radio? Or does it decline to provide a vendor, and if it does, how long until software starts assuming…

I think a key distinction is whether we're in an adversarial context or not. And I think loading untrusted applications over network connection from arbitrary third parties is absolutely a position to be distrustful.

Re: Virtual Machine Detection in the Browser (2019)

#27

Post by PurpleFoxy »

grimli333 wrote: post #14
Wowfunhappy wrote: post #9

Earlier quoted context omitted.

Right, and so browsers need to fix this! Not because of VMs but because a web page, unlike desktop software, has no business knowing my graphics card.

Well, presumably there may be valid use cases for WebGL applications or games behaving differently according to specific vendors/drivers. It feels like something that needs to be asked permission for, however, so it can’t be used for nefarious purposes.

The web APIs seem to be filled with features that in theory could be useful but you would have to do some serious hunting to find a legitimate user while you are flooded with examples of evil uses.

Firefox removed the battery API for this. In theory you could do something like show a stripped down site for low power users or something but it was only ever used for tracking.

While browsers have been used for a lot now, gaming seems like the one place we have seen virtually no use outside of random 2D games. I doubt there is a single web game that actually makes useful use of the gpu vendor details.

Re: Virtual Machine Detection in the Browser (2019)

#28

Post by Darkphibre »

emptyparadise wrote: post #20
colordrops wrote: post #16

Earlier quoted context omitted.

How do you hide your IP address? Are you referring to using a VPN?

VPNs, proxies, Tor, you name it.

Ooof, yeah. I was trying to make a new, purely anonymized identity. Went through an anonymized bitcoin VPN with TOR on top. Registered an email through Protonmail.

Pretty much no social media platform will accept Protonmail as an address without also having a phone number.

Got banned from Discord within 3 hours, literally all I'd done was send three friend requests and join one discord. My IP was rotating and I then needed to have 2-factor authentication (and protonmail wasn't allowed, I needed that phone number).

So, I went out and bought a burner phone, cash, with a 1-year prepaid account. Got it setup over a wired proxy with all radios turned off. Now at least I had a Google account! (they also require a phone number)

And Discord proceeded to reject it, because I needed to have a 'real' phone number from a major carrier.

I essentially needed to craft an entirely new identity if I wanted to be truly anonymous. It was eye-opening how invasive and pervasive the 'track you down to a real identity' accounts have become.

Re: Virtual Machine Detection in the Browser (2019)

#29

Post by upbeat_general »

pishpash wrote: post #24
koluna wrote: post #21

Earlier quoted context omitted.

A video game installation is a conscious choice that I can make depending on whether I trust the vendor or not. Me visiting New York Times and getting 58 trackers scraping my device configuration and preferences is not a choice.

It is as much a choice as installing an .exe. Treat the web browser like the OS of old, because that's exactly what browser makers think of it.

True in theory but good luck explaining this to my grandma/99% of internet users. People click links freely even if they shouldn’t,
Post reply on HN