Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Covert web-to-app tracking via localhost on Android

localmess.github.io

Post reply on HN
Print view View original

81–90 of 356 posts

Re: Covert web-to-app tracking via localhost on Android

#81

Post by gruez »

GrantMoyer wrote: post #23

Would an individual using this technique to collect information from someone else's computer possibly face prosecution under the Computer Fraud and Abuse act?

This only works if you control the code on both sides (ie. on the website being visited and an app running on the phone). It's not some sort of magic hack that allows you to exfiltrate arbitrary browser history. Therefore it's unclear how it can be construed as "hacking" in any meaningful way. As bad non-consensual tracking done by google/meta/whatever are, it's not covered under CFAA.

Re: Covert web-to-app tracking via localhost on Android

#82

Post by bravesoul2 »

Can this cross profiles? That would be a big security issue for corps.

Quick test and if I serve on 8080 on the Userland app it can be accessed from both profiles. So probably yes.

This means an infected app on your personal profile could exchange data with a site visited from a second profile.

Re: Covert web-to-app tracking via localhost on Android

#83

Post by account42 »

matthberg wrote: post #43

A comment I wrote in another HN thread [0] covering this issue: Web apps talking to LAN resources is an attack vector which is surprisingly still left wide open by browsers these days. uBlock Origin has a filter list that prevents this called "Block Outsider Intrusion into LAN" under the "Privacy" filters [1], but it isn't enabled on a fresh install, it has to be opted into explicitly. It also has some built-in exemp…

> There are some semi-legitimate uses, like Discord using it to check if the app is installed by scanning some high-number ports (6463-6472)

I would not consider this a legitimate use. Websites have no business knowing what apps you have installed.

Re: Covert web-to-app tracking via localhost on Android

#84

Post by SecretDreams »

Workaccount2 wrote: post #68
voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

>all so that CEOs can afford an extra yacht ...and so consumers can use services/products without having to fork over money. People love the ad-model. Given the option to pay or use the "ad-supported" option, the ad-supported one wins 10 to 1. This means in many cases it doesn't even make sense to have a paid option, because the ad option is just so much more popular. As bad as crypto is, with all the negative things…

Yes, we need ads for a free internet, today. And, as a result, we also have our privacy eroded - eroded in ways we may not care about today, but will probably regret tomorrow.

If we must pay for the internet, give me an option to pay to use it where I see no ads and my privacy is preserved. Let me know what that cost is and I'll decide what I want to do.

Right now, the actual pricing is obscured so we just "accept" that the internet in its current form is how it needs to be.

Post reply on HN