201–210 of 280 posts
Does googlesyndication.com serve anything that is in the user's interest? I've had that domain blocked for several years and don't think I've ever noticed it hindering any experience.
Serious question - why do we need iframes? Can't we disable them?
In this case, having the ad in a cross-origin iframe is what keeps it from being able to read the content of the page, which is definitely something you'd want from a privacy/security perspective.
(Disclosure: I work on ads at Google, speaking only for myself)
I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed. There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something whi…
As someone working on exactly this type of stuff, your'e absolutely right. \*.safeframe.googlesyndication.com is Google's implementation of the IAB's safeframe standard[0], which is basically a cross origin iframe with an API that's exposed to the embedded 3rd party code (the ad). This is how its HTML looks like (some attributes removed for readability): As you can see, it has both sandbox[1] and allow[2] attributes.…
That verizon JS is surprisingly not very obfuscated so if anyone is interested or just curious to hack around this is a great one to look at!
It looks like they are checking notificationPermission for notifications. stores (this.permissionStatus = "") & (this.notificationPermission = "")
I don't see any requestPermission() in the verizon js. So it's probably not the culprit?
I also don't think that would make sense for them to do it. it's probably a bad faith advertiser.
I'm not sure if cross origin permissions requests can be blocked by the parent safe frame yet? It looks like Chrome is proposing but I can't find any info on if it has been implanted? [1] [2]
-------
I really enjoy fingerprinting. Just feels like 'hacking' in the basic sense of poking around with things. Since I don't know enough to make actual complicated real vulnerability hacking. I've built a pretty big js file for our own ads analytics & tracking.
The verizon js has most basic common things but one that sticks out as cool is cssSelectorCheck & cssRuleCheck checks a few like div:dir(ltr) probably for eastern languages, and stuff like -moz-osx-font-smoothing: grayscale.
I also like the idea of adding HONEYPOT_TAGS looks like they are adding a button to check for auto click publisher fraud. But man they should have obfuscated that name....
One interesting idea to expand on the css testing they have started to use a small amount.
I've played with is placing actual unique CSS features and @supports in styles and then measuring them. Maybe use variables pass to js. Also a couple @media sizes to see if it's lying about size. Can also measure if css/svg animation is paused for view ability.
There are a ton of new css features that are implemented in different browser versions so likely high entropy. Also would love to learn paintWorklet just to know it for design and also seems like a big surface area (svg too).
I'm kind of surprised they aren't doing a RTCPeerConnection to try and get any IPs and it doesn't look like they are doing actual webgl / audio prints.
seeing the mime type checks is validating to me. that's the latest check I added it's pretty fast to execute i have something like 150 different codes/mime types loop through lol. Verizon is more sensible in checking only a couple lmfao
[1] https://docs.google.com/document/d/1iaocsSuVrU11FFzZwy7EnJNO... [2] https://dev.chromium.org/Home/chromium-security/deprecating-...
Earlier quoted context omitted.
But what do you see as the alternative for funding sites? The site we're on is funded by (declarative, non-personalized, non-obtrusive) ads. I would rather have ads than paywalls.
> I would rather have ads than paywalls. No offense but I've heard people who work at ad companies repeat this like a mantra, and it's a false dichotomy, akin to a coal company who dumps slag in rivers saying, "Well we think it's better than letting everyone freeze to death." We're not asking Google to stop advertising altogether and close up shop, just to make the internet ad ecosystem a little less awful and Orwell…
I think my parent was: "No one needs ads. Not arbitrary JS ads, not declarative ads, not personalised ads, not any ads."
I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed. There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something whi…
In my experience, with tools like Cover Your Tracks (apparently this is the new name for Panopticlick), the more you try and thwart fingerprinting, the more unique you appear. Although I still do everything I can to block and filter everything conceivable, I've given up on trying to figure out how identifiable I am on the web because it seems useless. If you don't try then you're identifiable, and if you do then you…
If your fingerprint is unique and doesn't change then yes, you stand out. But if your fingerprint changes on every page load, then you become indistinguishable from other users.
Earlier quoted context omitted.
But why do they need that? What purpose does an ad with javascript serve?
Animations, tracking and fraud detection are the big areas. Ads were historically one of the strongest drivers of Flash, given how easy it made for creatives to implement animations without needing a frontend developer - ad buyers these days would instantly protest against any attempt to remove either of the three use cases. And given that we are talking about sometimes eight figures worth of ad buying... no network…
EDIT: I am wrong to think that serving and interacting with a sqlite database goes without javascript.
Earlier quoted context omitted.
also tape your laptop's camera
My company is now giving us those to use in our company laptops: https://m.media-amazon.com/images/I/61l+gnZORVL._AC_SY355_.j... They're pretty convenient and look nice
I'm not 100% certain that was the cause. But the guy at the Apple store seemed to think it was, which meant they wouldn't pay for it. And a quick google shows others who are convinced.
The bezel on that laptop was really tiny and I can easily see it might have contributed to the crack. I now have a 2021 model and the bezel is much thicker. But I'm not taking the chance.
Earlier quoted context omitted.
The person to whom I replied!
To be fair, he said Google and others. I still don't know how much Google is responsible though.
I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed. There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something whi…
When does fingerprinting ever fail? Maybe in Brave and/or Tor, but I wouldn’t bet on it.