An iframe from googlesyndication.com tries to access the camera and microphone • Hacker News Board

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#31

Post by tomudding » Sun, Dec 19, 2021, 4:11 PM UTC

I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed.

There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something which can be used for fingerprinting.

Which reminds me of fingerprinting by tiny differences in the audio API provided by browsers [0]. Super interesting, but also a bit depressing. Also works for things like canvases and WebGL.

EFF allows you to check how fingerprintable your browser is [1]. Do note that the results may not be very accurate.

[0]: https://fingerprintjs.com/blog/audio-fingerprinting/

[1]: https://coveryourtracks.eff.org

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#32

Post by colordrops » Sun, Dec 19, 2021, 4:11 PM UTC

SahAssar wrote: post #8

jessaustin wrote: post #2

We have a chance to notice this when it's mediated by a browser. Native apps don't barf all over the console and thus escape such scrutiny. I first considered this when a friend told me about a brand of lawnmower of which I had never heard let alone searched (mowing lawns is the least interesting activity I can imagine), and one minute later a podcast app had a big banner at the top by which I could purchase a lawnmo…

I've heard similar stories many times but every time it seems to be baader-meinhof effect/frequency illusion or that the linking is not via audio but something else. People have man-in-the-middle checked advertising traffic to see if they either stream audio or send spoken keywords to ad servers and they do not seem to do that. It's more likely that it saw your phone and your friends at similar locations and your fri…

Would it have to be audio? It could do TTS on the phone then send the text back.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#33

Post by Rygian » Sun, Dec 19, 2021, 4:12 PM UTC

streptomycin wrote: post #20

Shitty ad code barfing errors onto the console is typical, unfortunately. The JS is not written by Google, it's written by the individual advertiser, with very limited oversight.

It is served by Google. Google has an enormous amount of resources to vet the code that Google serves. They are skirting their obligation of due diligence.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#34

Post by eloisius » Sun, Dec 19, 2021, 4:12 PM UTC

SahAssar wrote: post #8

jessaustin wrote: post #2

We have a chance to notice this when it's mediated by a browser. Native apps don't barf all over the console and thus escape such scrutiny. I first considered this when a friend told me about a brand of lawnmower of which I had never heard let alone searched (mowing lawns is the least interesting activity I can imagine), and one minute later a podcast app had a big banner at the top by which I could purchase a lawnmo…

I've heard similar stories many times but every time it seems to be baader-meinhof effect/frequency illusion or that the linking is not via audio but something else. People have man-in-the-middle checked advertising traffic to see if they either stream audio or send spoken keywords to ad servers and they do not seem to do that. It's more likely that it saw your phone and your friends at similar locations and your fri…

That's almost scarier. Seems like it could leak embarrassing information about what you've been searching or buying to your friends.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#35

Post by driverdan » Sun, Dec 19, 2021, 4:12 PM UTC

vklmn wrote: post #29

I don't think that it's google's fault. Google sometimes trade ads on auctions, meaning they issue and HTTP request to partners asking "Hey, you want to show an ad here", and partner respond with price and HTML code, the highest bidder wins and HTTP code is inserted. HTTP contains JavaScript, and theoretically anything can be executed within the browser (I've seen people mining bitcoins!). Google can't monitor an exe…

> I don't think that it's google's fault

Of course it is. It's their ad network.

> Google can't monitor an execute every HTML snippet

Of course they can. There's no excuse for allowing this nonsense on their network.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#36

Post by kadoban » Sun, Dec 19, 2021, 4:13 PM UTC

tmsbrg wrote: post #13

underscore_ku wrote: post #10

Earlier quoted context omitted.

also tape your laptop's camera

That doesn't protect your microphone from being exposed though.

An icepick/paperclip does.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#37

Post by Malcx » Sun, Dec 19, 2021, 4:14 PM UTC

vklmn wrote: post #29

I don't think that it's google's fault. Google sometimes trade ads on auctions, meaning they issue and HTTP request to partners asking "Hey, you want to show an ad here", and partner respond with price and HTML code, the highest bidder wins and HTTP code is inserted. HTTP contains JavaScript, and theoretically anything can be executed within the browser (I've seen people mining bitcoins!). Google can't monitor an exe…

That sill is Google's fault as far as I'm concerned as an end user.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#38

Post by CrazyStat » Sun, Dec 19, 2021, 4:14 PM UTC

foota wrote: post #14

Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.

Allowing an ads customer to "just" slip a request for camera and mic access into an ad script is malicious.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#39

Post by streptomycin » Sun, Dec 19, 2021, 4:15 PM UTC

kadoban wrote: post #30

streptomycin wrote: post #20

Shitty ad code barfing errors onto the console is typical, unfortunately. The JS is not written by Google, it's written by the individual advertiser, with very limited oversight.

> "with very limited oversight" I think I found the problem.

It's a problem, but it's not "the" problem.

The problem is that letting advertisers write their own JS means advertisers are willing to pay more for the ad. If Google banned that practice, or put in a lot of oversight, people would pay less for ads through Google. But some other ad networks would still allow the bad practices, and thus be able to pay higher rates. So sites would just move more ads to those other networks.

That doesn't absolve Google of responsibility, but it does mean that we can't actually solve the problem just by being mad at Google.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#40

Post by ehnto » Sun, Dec 19, 2021, 4:17 PM UTC

CrazyStat wrote: post #38

foota wrote: post #14

Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.

Allowing an ads customer to "just" slip a request for camera and mic access into an ad script is malicious.

Negligent, I wouldn't call it malicious but I would call it negligent.