Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

241–250 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#241

Post by userbinator »

Ensorceled wrote: post #228
userbinator wrote: post #217

Earlier quoted context omitted.

I doubt you actually work there given your last sentence, but have you tried proposing an alternative (along with some reasons why it would be better) the next time someone asks you to use it?

> I doubt you actually work there given your last sentence, What is your logic? My company uses Meet and it's "mandated" in the sense that it is used for all company meetings. I'm in a position that I might get us to switch if I pushed it, but Teams and Zoom aren't much better. I assure you I work at my company.

I meant not working for Google.

I'm not sure about Teams, but Zoom lets you use a standard SIP client to join meetings.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#242

Post by hetspookjee »

jefftk wrote: post #239
hetspookjee wrote: post #234

Earlier quoted context omitted.

https://tools.google.com/dlpage/gaoptout

The site owner interacts with the user to get consent or not (often via a CMP) and then decides whether and how to invoke third-party scripts, including Google Analytics. The alternative would be for each third party script on the page to attempt to inject their own set of consent dialogues, but those would conflict with each other. The extension you're linking allows someone to opt out of Google Analytics across all…

Thank you for replying. Though, I do not understand why a plugin is required? It feels even more invasive to have such a thing running in the browser.

My understanding is that I have an advertisement ID attached to my user, and that enables Google to infer who I am and what my persona is about, to match me with personalized ads.

Wherever possible I disallow Google and all others to stop tracking me, having done so in my account. I find it odd I also need to disallow the tracking from Google, through a third party site (e.g. anyone's blog) even though I have already done so through every direct means possible. What do the consent settings in Google even mean then if I need to allow/disallow consent of tracking per seperate website in addition?

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#243

Post by jefftk »

hetspookjee wrote: post #237
jefftk wrote: post #231

Earlier quoted context omitted.

Animations can be CSS, yes. That's what you do in https://amp.dev/documentation/guides-and-tutorials/learn/a4a... (declarative ad format, no advertiser-written JS)

Then I don't understand the necessity for javascript in ads?

In this particular case, advertisers were not interested in moving to a declarative format, and publishers were not interested in requiring declarative ads. So it didn't end up going anywhere as a general purpose ad format.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#244

Post by topspin »

Rygian wrote: post #33
streptomycin wrote: post #20

Shitty ad code barfing errors onto the console is typical, unfortunately. The JS is not written by Google, it's written by the individual advertiser, with very limited oversight.

It is served by Google. Google has an enormous amount of resources to vet the code that Google serves. They are skirting their obligation of due diligence.

Yes, discounting Google's responsibility is inappropriate. They take money for this. They're responsible.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#245

Post by jefftk »

hetspookjee wrote: post #242
jefftk wrote: post #239

Earlier quoted context omitted.

The site owner interacts with the user to get consent or not (often via a CMP) and then decides whether and how to invoke third-party scripts, including Google Analytics. The alternative would be for each third party script on the page to attempt to inject their own set of consent dialogues, but those would conflict with each other. The extension you're linking allows someone to opt out of Google Analytics across all…

Thank you for replying. Though, I do not understand why a plugin is required? It feels even more invasive to have such a thing running in the browser. My understanding is that I have an advertisement ID attached to my user, and that enables Google to infer who I am and what my persona is about, to match me with personalized ads. Wherever possible I disallow Google and all others to stop tracking me, having done so in…

Your understanding is correct for Google Ads, but in its default (and most common) configuration, Google Analytics does not interact with that third party cookie ID. GA is primarily a tool for helping publishers understand what's happening on their sites, and so uses a first-party (per-site) cookie.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#247

Post by dheera »

beeboop wrote: post #27
tmsbrg wrote: post #13

Earlier quoted context omitted.

That doesn't protect your microphone from being exposed though.

this is why we need hardware switches for microphones

I just got a Framework laptop (https://frame.work) and it has this.

Take that, Apple fanboys.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#248

Post by tgsovlerkhgsel »

tehlike wrote: post #94

This is not google, but a third party ad network serving ads through google. Google tries to sandbox the creatives in an attempt to prevent issues exactly like this, and develops browser features to prevent issues exactly like this. This is likely a script that somehow avoided google's malware scanning pipelines. This is definitely not google's malintent. Disclaimer: Ex googler, worked in ads, dealed with problems li…

IMO, if you serve content to the user, you're responsible for making sure you're not serving malware, e.g. by not allowing parties you cannot trust to serve arbitrary code.

And this doesn't apply just to the ad network, it also applies to the publisher. I'd really like the publishers to be held liable for malvertising they serve.

There is nothing inherently hard about serving safe ads, we've gotten pretty good at separating code from content nowadays. There is no reason why a "classic adsense" three-blue-links ad should be able to inject malware. Even images can be served safely. The only reason why this happens is because in pursuit of a few percent more profit (and more tracking) everyone allows everyone to include arbitrary scripts.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#249

Post by tgsovlerkhgsel »

teej wrote: post #238
VRay wrote: post #187

Earlier quoted context omitted.

Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code

It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-e...

This gets a lot harder to pull off when the images are transcoded by being decoded in one sandboxed process that outputs a bitmap, then encoded in another sandboxed process that outputs what ultimately reaches the user.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#250

Post by tgsovlerkhgsel »

jefftk wrote: post #71
veeti wrote: post #63

Earlier quoted context omitted.

Curiously no explanation why this sort of malicious behavior is accepted by "Google Ad Manager" in the first place. If you haven't already installed: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... https://chrome.google.com/webstore/detail/ublock-origin/cjpa...

I'm not sure it is allowed; that's not a part of the business I know much about. Since ads can run arbitrary JS it's hard to enforce policy programmatically. On the other hand, it's not clear to me that whatever this advertiser is trying to do is having any real effect, aside from causing a console message that it is being blocked. Access to the mic and camera from cross-origin iframes is blocked by default, and you…

> Since ads can run arbitrary JS

That's the problem!

Post reply on HN