Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

231–240 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#231

Post by jefftk »

hetspookjee wrote: post #206
mschuster91 wrote: post #142

Earlier quoted context omitted.

Animations, tracking and fraud detection are the big areas. Ads were historically one of the strongest drivers of Flash, given how easy it made for creatives to implement animations without needing a frontend developer - ad buyers these days would instantly protest against any attempt to remove either of the three use cases. And given that we are talking about sometimes eight figures worth of ad buying... no network…

I still don't understand it. I was under the impression that animations are also able to be served through HTML5? Both CSS and HTML should be sufficient. ~We're in the age where we're able to serve an entire sqlite database over a static website, yet an animation does require javascript?~ EDIT: I am wrong to think that serving and interacting with a sqlite database goes without javascript.

Animations can be CSS, yes. That's what you do in https://amp.dev/documentation/guides-and-tutorials/learn/a4a... (declarative ad format, no advertiser-written JS)

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#232

Post by jefftk »

hetspookjee wrote: post #208
theWreckluse wrote: post #160

Earlier quoted context omitted.

To be fair, he said Google and others. I still don't know how much Google is responsible though.

Google goes way further and doesn't even serve a prompt. Instead they show you a opt-out plugin that you can download to run in your browser. Most blatant disregard of rules and feeling better than the rest behaviour if you ask me.

Link?

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#233

Post by authed »

foota wrote: post #14

Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.

> Is this just click bait?

It is not. It sounds like something that should have been taken care of by Google at least 10 years ago.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#234

Post by hetspookjee »

jefftk wrote: post #232
hetspookjee wrote: post #208

Earlier quoted context omitted.

Google goes way further and doesn't even serve a prompt. Instead they show you a opt-out plugin that you can download to run in your browser. Most blatant disregard of rules and feeling better than the rest behaviour if you ask me.

Link?

https://tools.google.com/dlpage/gaoptout

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#235

Post by rovr138 »

jspash wrote: post #207
ratww wrote: post #108

Earlier quoted context omitted.

My company is now giving us those to use in our company laptops: https://m.media-amazon.com/images/I/61l+gnZORVL._AC_SY355_.j... They're pretty convenient and look nice

Be careful with those on laptops. I had a 2016 Macbook Pro and put one of those one it. About 1 month later I had a nice big crack in display straight down the middle of the screen. I'm not 100% certain that was the cause. But the guy at the Apple store seemed to think it was, which meant they wouldn't pay for it. And a quick google shows others who are convinced. The bezel on that laptop was really tiny and I can ea…

>I'm not 100% certain that was the cause

I'll leave this,

https://support.apple.com/en-us/HT211148

>Make sure the camera cover is not thicker than an average piece of printer paper (0.1mm).

>If you install a camera cover that is thicker than 0.1mm, remove the camera cover before closing your computer.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#236

Post by hetspookjee »

danachow wrote: post #224
hetspookjee wrote: post #206

Earlier quoted context omitted.

I still don't understand it. I was under the impression that animations are also able to be served through HTML5? Both CSS and HTML should be sufficient. ~We're in the age where we're able to serve an entire sqlite database over a static website, yet an animation does require javascript?~ EDIT: I am wrong to think that serving and interacting with a sqlite database goes without javascript.

> We're in the age where we're able to serve an entire sqlite database over a static website Making use of the SQLite database is entirely client side and requires JavaScript or WASM (the distinction is unimportant) - it requires running code on the frontend. This is not a great way to state your case.

You're right and I misinterpreted the sqlite implementation. I will edit my comment to reflect my error.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#237

Post by hetspookjee »

jefftk wrote: post #231
hetspookjee wrote: post #206

Earlier quoted context omitted.

I still don't understand it. I was under the impression that animations are also able to be served through HTML5? Both CSS and HTML should be sufficient. ~We're in the age where we're able to serve an entire sqlite database over a static website, yet an animation does require javascript?~ EDIT: I am wrong to think that serving and interacting with a sqlite database goes without javascript.

Animations can be CSS, yes. That's what you do in https://amp.dev/documentation/guides-and-tutorials/learn/a4a... (declarative ad format, no advertiser-written JS)

Then I don't understand the necessity for javascript in ads?

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#238

Post by teej »

VRay wrote: post #187
soared wrote: post #124

Earlier quoted context omitted.

Yes - banner ads are constantly targeted by malicious actors. My employer pays a vendor something like $200k/mo for creative scanning to avoid issues like this. Google certainly spends tens of millions a year trying to avoid issues like this. See vendors like “the media trust”

Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code

It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-e...

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#239

Post by jefftk »

hetspookjee wrote: post #234
jefftk wrote: post #232

Earlier quoted context omitted.

Link?

https://tools.google.com/dlpage/gaoptout

The site owner interacts with the user to get consent or not (often via a CMP) and then decides whether and how to invoke third-party scripts, including Google Analytics. The alternative would be for each third party script on the page to attempt to inject their own set of consent dialogues, but those would conflict with each other.

The extension you're linking allows someone to opt out of Google Analytics across all sites. That pretty much has to be a browser extension, because GA by default doesn't use any third-party cookies (and third party cookies are going away anyway).

(Disclosure: I work at Google, speaking only for myself)

Post reply on HN