Live data from Hacker News

A web page that shows you everything the browser told it without asking

sinceyouarrived.world

201–210 of 309 posts

Re: A web page that shows you everything the browser told it without asking

#201
post #173

Maybe it's just because I am old, or have worked on internet software for almost 30 years, but none of this seems surprising or even concerning? Someone sets up a server that accepts connections to it and then someone sends a connection request to it. There has been no agreement on anything, no expectations or rules established. No one forces the server to accept any connection request it gets, and no one forces some…

I think a lot of us old tech folks want to still believe in those techno-libertarian ideals of the old web. However, in order to do that we largely need to ignore the capitalistic and authoritarian ideals of the modern web. Us not owing each other anything worked great in a prior era when people were largely correct in assuming most people were good actors. But as soon as the money and power of the internet became re…

I agree entirely. Those of us old enough to have experienced those dreams are naturally going to mourn the loss of the Internet as a place for wild experimentation because we know so much good came from it and there isn't any true replacement.

But it's become clear that in the absence of governance, standards of behavior, and rules both explicit and implicit, the Internet has grown toward tyranny and automated exploitation rather than freedom.

We need to set some rules and expectations that people can rely on, otherwise rules will continue to be imposed on us.

Re: A web page that shows you everything the browser told it without asking

#202
Would be nice if more people were focus on fixing these issues instead of just a bunch of "we already know", and making fun up the tone of the site.

Thanks op for reminding us of the privacy issues with our browsers. The EFF and others already told us, but the issues remain. Lets hope you're hear to stay and fight for our privacy alongside us.

Re: A web page that shows you everything the browser told it without asking

#203
post #153

Earlier quoted context omitted.

Maybe it's because I'm idealistic in addition to being old, but I think a lot of this functionality was in fact added for explicit purposes. A client sends the language header or the list of supported fonts not so that the server can "do whatever they want with this data." There is (or was) a real reason for it when we came up with these standards. The fact that website providers, or more specifically ad-networks, ha…

I don’t understand why that would be an implicit agreement, though? Why would I expect that the website would not try to figure out who I am? They are free to remember whatever they want about my request… but I am also free to modify the request however I want, if I choose to randomize the list of fonts or choose to not send it or whatever.

> Why would I expect that the website would not try to figure out who I am?

For the same reason I expect my neighbor not to kill me or steal my shit. We live in a society, with societal expectations around behaviour. I, personally, would prefer not to live in an uncivilized jungle where the only rule is "do whatever you can get away with".

Re: A web page that shows you everything the browser told it without asking

#204
post #100

Earlier quoted context omitted.

> Our tests indicate that you have strong protection against Web tracking. Gotta love Firefox with ublock origin in advanced mode, even without JavaScript disabled so the site worked.

Did you specifically re-enable javascript? Ublock origin on medium mode blocks all the tracking javascript and I'd think advanced would follow the same basic starting point.

Yeah, didn't work without it.

Re: A web page that shows you everything the browser told it without asking

#205
post #100

Earlier quoted context omitted.

> Our tests indicate that you have strong protection against Web tracking. Gotta love Firefox with ublock origin in advanced mode, even without JavaScript disabled so the site worked.

uMatrix + NoScript personally (yes, seems silly, but I find NoScript's UI more convenient for script toggling, while liking uMatrix's fine grained controls) Did you enable firefox resist fingerprinting? Also maybe letterboxing, which I think is not enabled by that flag by default, and also helps with CSS fingerprinting.

I used to use umatrix, preferred it to ublock origin advanced mode. However, isn't umatrix unsupported?

Re: A web page that shows you everything the browser told it without asking

#206
post #194

They forgot to add timing attack on images load time which can be used to tell if you visited X website. https://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010...

Not since browsers started partitioning caches in 2020: https://developer.chrome.com/blog/http-cache-partitioning/

Re: A web page that shows you everything the browser told it without asking

#207

Maybe it's just because I am old, or have worked on internet software for almost 30 years, but none of this seems surprising or even concerning? Someone sets up a server that accepts connections to it and then someone sends a connection request to it. There has been no agreement on anything, no expectations or rules established. No one forces the server to accept any connection request it gets, and no one forces some…

[flagged]

Re: A web page that shows you everything the browser told it without asking

#208
Access to the available font list might be useful for identifying devices likely issued by a particular organization. Unusual fonts that are part of an org's branding usually are installed as part of a standard device image. This allows employees to produce brand-compliant presentations, etc. I was an intern at GE in the mid-90's and we had a custom font with just one character defined - the "meatball" corporate logo.

Re: A web page that shows you everything the browser told it without asking

#209
post #177

Maybe it's just because I am old, or have worked on internet software for almost 30 years, but none of this seems surprising or even concerning? Someone sets up a server that accepts connections to it and then someone sends a connection request to it. There has been no agreement on anything, no expectations or rules established. No one forces the server to accept any connection request it gets, and no one forces some…

> You appear to be in Denver, United States. Your internet provider is Netskope Inc. We know this because your IP address — 163.xxx.xxx.32 — was the first thing your device sent us. We know the rest of it. We chose not to display it. Most pages would not have made that choice. We did not ask for your location. Your address arrived before you did. "We know the rest of it. We chose not to display it. Most pages would n…

there was a prank way back, that used simple html, css and javascript, to instruct the browser to display IP address, public, and local, popup a stream from the webcam, and place them among a crafted document intended to trigger i.e. troll people.

no data was cast to internet, it was all code executed with local user permissions to access the devices devices and logfiles displayed inline as "proof" that you are standing on stage with naught but your drawers.

people were at times moved into a panic and could be manipulated into making contact with malignant entities. there were casualties.

never underestimate the damage that can be caused by manipulating perceptions of the current situation,its not a joke, its handgun serious.

Re: A web page that shows you everything the browser told it without asking

#210

Would be nice if more people were focus on fixing these issues instead of just a bunch of "we already know", and making fun up the tone of the site. Thanks op for reminding us of the privacy issues with our browsers. The EFF and others already told us, but the issues remain. Lets hope you're hear to stay and fight for our privacy alongside us.

Thanks for that. The page isn't trying to tell anyone something they don't already know, it's trying to put it in front of the people who haven't been told. The bug reports today have been gold and the volume is meaningfully better for them.
Post reply on HN