Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

41–50 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#41

Post by jefftk »

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it isn't even getting as far as a permissions prompt because the default Feature Policy doesn't allow camera or mic access in cross-origin iframes. (Ex, for Chrome: https://sites.google.com/a/chromium.org/dev/Home/chromium-se...) Instead, I think the most likely thing happening here is that an advertiser is running a script that is trying to do fingerprinting, and which is blocked by the browser protection.

(That it's an iframe running on https://[random].safeframe.googlesyndication.com tells us it's an ad served through Google Ad Manager, and the contents of the iframe are supplied by the advertiser.)

Disclosure: I work for Google, speaking only for myself

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#42

Post by streptomycin »

Rygian wrote: post #33
streptomycin wrote: post #20

Shitty ad code barfing errors onto the console is typical, unfortunately. The JS is not written by Google, it's written by the individual advertiser, with very limited oversight.

It is served by Google. Google has an enormous amount of resources to vet the code that Google serves. They are skirting their obligation of due diligence.

It's hard to change the status quo when people's livelihoods are at stake. It's not just about Google, it's about all the sites running Google ads, and all the companies advertising through Google. If Google makes things sufficiently less profitable for all those parties, they'll just move elsewhere. Incremental progress is being made, like SafeFrames, but it's never going to be completely solved all at once.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#43

Post by mattgreenrocks »

streptomycin wrote: post #39
kadoban wrote: post #30

Earlier quoted context omitted.

> "with very limited oversight" I think I found the problem.

It's a problem, but it's not "the" problem. The problem is that letting advertisers write their own JS means advertisers are willing to pay more for the ad. If Google banned that practice, or put in a lot of oversight, people would pay less for ads through Google. But some other ad networks would still allow the bad practices, and thus be able to pay higher rates. So sites would just move more ads to those other netw…

I don’t think expecting Google to take responsibility for the ads they serve is unreasonable.

It is profoundly strange that we extol the virtues of succeeding in society and yet also act like said success doesn’t come with heavy responsibility.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#44

Post by 5e92cb50239222b »

tmsbrg wrote: post #13
underscore_ku wrote: post #10

Earlier quoted context omitted.

also tape your laptop's camera

That doesn't protect your microphone from being exposed though.

Disable it in system settings, browser settings, and prevent access through something like firejail. It is not as reliable as a hardware kill-off switch, but puts a lot of barriers to overcome.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#45

Post by luckylion »

streptomycin wrote: post #39
kadoban wrote: post #30

Earlier quoted context omitted.

> "with very limited oversight" I think I found the problem.

It's a problem, but it's not "the" problem. The problem is that letting advertisers write their own JS means advertisers are willing to pay more for the ad. If Google banned that practice, or put in a lot of oversight, people would pay less for ads through Google. But some other ad networks would still allow the bad practices, and thus be able to pay higher rates. So sites would just move more ads to those other netw…

The value in adsense is absolutely not in the ability to run unvetted javascript served from a google-hosted domain. The value is in the tracking and retargeting.

Serving javascript from a well-connected CDN isn't something that sets anyone apart, you can just sign up with cloudflare and have that working in a few minutes.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#46

Post by alkonaut »

I really don’t care what advertisers think is necessary to do in order to ensure targeting/fingerprinting or countering fraud, but running any third party script isn’t anything I consider remotely acceptable from an ad. Worst case I could accept that some generic script from the ad network is run - but for the ad network to pipe through the advertisers third party script should mean they are adblocked by the browser without even requiring a plugin.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#47

Post by michael-ax »

beeboop wrote: post #27
tmsbrg wrote: post #13

Earlier quoted context omitted.

That doesn't protect your microphone from being exposed though.

this is why we need hardware switches for microphones

fwiw, there's a switch in every ext. mic. jack.

plug in an un-wired connector, cut of the wiring post, smooth with a nail-file or put on a crowning drop of glue so it won't rip your bag and you're done.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#48

Post by jasonjayr »

streptomycin wrote: post #20

Shitty ad code barfing errors onto the console is typical, unfortunately. The JS is not written by Google, it's written by the individual advertiser, with very limited oversight.

Google (+ apple) Control their mobile platforms and take responsibility for apps served through their respective stores.

Why can't they do the same with their ad networks? Transpile any JS code served from their network into a safe execution environment/api that only permits the resources allowed safely?

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#49

Post by jasonjayr »

streptomycin wrote: post #39
kadoban wrote: post #30

Earlier quoted context omitted.

> "with very limited oversight" I think I found the problem.

It's a problem, but it's not "the" problem. The problem is that letting advertisers write their own JS means advertisers are willing to pay more for the ad. If Google banned that practice, or put in a lot of oversight, people would pay less for ads through Google. But some other ad networks would still allow the bad practices, and thus be able to pay higher rates. So sites would just move more ads to those other netw…

Those other networks would start getting blocked hard with adblock/DNS block/public shaming of sites using them.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#50

Post by criddell »

kadoban wrote: post #36
tmsbrg wrote: post #13

Earlier quoted context omitted.

That doesn't protect your microphone from being exposed though.

An icepick/paperclip does.

You should also destroy any speakers.

https://arxiv.org/ftp/arxiv/papers/1611/1611.07350.pdf

Post reply on HN