Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

101–110 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#101

Post by jeffbee »

reaperducer wrote: post #59
jefftk wrote: post #41

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it isn't even getting as far as a permissions prompt because the default Feature Policy doesn't allow camera or mic access in cross-origin iframes. (Ex, for Chrome: https://sites.google.com/a/chromium.org/dev/Home/chromium-se... ) Instead, I think the most likely…

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone You are correct, that is the author's concern. The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.

What? In what way have you been conditioned to accept prompts?

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#102

Post by fault1 »

_hyn3 wrote: post #92
jefftk wrote: post #82

Earlier quoted context omitted.

Ads are allowed to run arbitrary JS, but that doesn't mean they are allowed to do arbitrary things by policy. That is, the technical restrictions are not able to be as strict as the policy. A bunch of us were working on a project where ads would be fully declarative, and so no longer able to run arbitrary JavaScript, but this received very little interest outside of Google (advertisers didn't want to move to a new fo…

Why is it up to the advertisers and publishers?

how do you think google, an adtech company, makes money?

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#103

Post by barneygale »

jefftk wrote: post #82
ineptech wrote: post #74

Earlier quoted context omitted.

> Since ads can run arbitrary JS it's hard to enforce policy programmatically. Letting ads run arbitrary JS is the policy, right? It's not like that's a requirement to make the internet work, that's just a Google policy that trades money for user experience.

Ads are allowed to run arbitrary JS, but that doesn't mean they are allowed to do arbitrary things by policy. That is, the technical restrictions are not able to be as strict as the policy. A bunch of us were working on a project where ads would be fully declarative, and so no longer able to run arbitrary JavaScript, but this received very little interest outside of Google (advertisers didn't want to move to a new fo…

I do wish google engineers would do something positive for society and switch to a career in subsistence farming. No one needs ads. Not arbitrary JS ads, not declarative ads, not personalised ads, not any ads.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#104

Post by fault1 »

jeffbee wrote: post #101
reaperducer wrote: post #59

Earlier quoted context omitted.

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone You are correct, that is the author's concern. The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.

What? In what way have you been conditioned to accept prompts?

I think there is most definitely conditioning going on. I watched my fiance click on one of the "accept all cookies" GDPR-prompts (it's become an antipattern) a few days ago. She almost automatically did it without thinking. I went to the same site on my laptop and if you clicked decline, it immediately brought up modal dialogs that made that site unusable. I can see why 99% of people would be conditioning to just hit yes.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#106

Post by jeffbee »

fault1 wrote: post #104
jeffbee wrote: post #101

Earlier quoted context omitted.

What? In what way have you been conditioned to accept prompts?

I think there is most definitely conditioning going on. I watched my fiance click on one of the "accept all cookies" GDPR-prompts (it's become an antipattern) a few days ago. She almost automatically did it without thinking. I went to the same site on my laptop and if you clicked decline, it immediately brought up modal dialogs that made that site unusable. I can see why 99% of people would be conditioning to just hi…

And you blame Google for that, instead of some brain-dead Eurocrat?

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#107

Post by jsnell »

_hyn3 wrote: post #92
jefftk wrote: post #82

Earlier quoted context omitted.

Ads are allowed to run arbitrary JS, but that doesn't mean they are allowed to do arbitrary things by policy. That is, the technical restrictions are not able to be as strict as the policy. A bunch of us were working on a project where ads would be fully declarative, and so no longer able to run arbitrary JavaScript, but this received very little interest outside of Google (advertisers didn't want to move to a new fo…

Why is it up to the advertisers and publishers?

If they tried to unilaterally make such a change and ban the old formats, both the advertisers and publishers would complain to competition regulators around the world. And whether you think there would be any merit to those complaints or not, the outcome would still be another round of lawsuits with billions on the line.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#108

Post by ratww »

underscore_ku wrote: post #10
akersten wrote: post #6

The Exhibit A why no one will ever convince me to turn off my ad blocker or switch away from Firefox. It's a great feeling to just not have to worry about this entire class of exploits.

also tape your laptop's camera

My company is now giving us those to use in our company laptops:

https://m.media-amazon.com/images/I/61l+gnZORVL._AC_SY355_.j...

They're pretty convenient and look nice

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#109

Post by seedie »

tomudding wrote: post #31

I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed. There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something whi…

The result of [1] surprises me. I'm on a very standard Android device with a standard Browser and nevertheless I'm told that my USER AGENT and the HTTP_ACCEPT HEADERS are unique.

[1]: https://coveryourtracks.eff.org/

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#110

Post by jefftk »

williamtwild wrote: post #75
jefftk wrote: post #71

Earlier quoted context omitted.

I'm not sure it is allowed; that's not a part of the business I know much about. Since ads can run arbitrary JS it's hard to enforce policy programmatically. On the other hand, it's not clear to me that whatever this advertiser is trying to do is having any real effect, aside from causing a console message that it is being blocked. Access to the mic and camera from cross-origin iframes is blocked by default, and you…

How about the company you work for disallow arbitrary JS in the ads they serve? We already know the answer though. Bottom line over doing what is right.

As I wrote above, this was something we tried: https://news.ycombinator.com/item?id=29615583

This was the main thing I worked on in 2018-2019, along with many other engineers. I wrote about it some in https://www.jefftk.com/p/value-of-working-in-ads If this is something that users were demanding I could see picking it up again, but as far as we could tell us a time there was minimal interest externally.

Post reply on HN