Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A web page that shows you everything the browser told it without asking

sinceyouarrived.world

Post reply on HN
Print view View original

251–260 of 309 posts

Re: A web page that shows you everything the browser told it without asking

#251

Post by brudgers »

nemothekid wrote: post #222
brudgers wrote: post #198

Earlier quoted context omitted.

Someone sets up a server that accepts connections to it and then someone sends a connection request to it. My disappointment is not with websites. It is with browsers. They have continuously prioritized dark pattern support. They have consistently removed user control. I mean it's not the websites that default to recording every keystroke, default to tracker persistence, default to phoning home with daily telemetry,…

None of the information on the website I would argue is a dark pattern. The remote server knows my IP address? Yes that's how the web works. The server knows my window's resolution? Well I think thats very useful information for the application to have for layouting. You know what other application is recording my keystrokes right now? HackerNews. "recording keystrokes" is also known as "typing in a text box"

HN does not record your key strokes until and unless you click the reply link…and then only if recording your final edited comment counts as recording your keystrokes.

On the other hand, your browser might be recording each of your keystrokes just because it can and if your browser does, those keystrokes are not going to HN.

Re: A web page that shows you everything the browser told it without asking

#253

Post by yard2010 »

sgbeal wrote: post #191
quietsegfault wrote: post #169

Earlier quoted context omitted.

> Nobody can infer when I work and when I sleep. That includes me. Are you like /severed/ or something? Surely you can infer when you work and sleep from your experience living your life as you.

> Surely you can infer when you work and sleep from your experience living your life as you. Not everybody has a schedule. Mine is essentially "eat when hungry, sleep when tired", and my sleep patterns more closely follow a 26-hour day than a 24-hour day.

This is fascinating, please do tell more about it! How does it affect your mental health? How do you deal with times day and night are flipped? How does it affect your social life?

Re: A web page that shows you everything the browser told it without asking

#255

Post by reddalo »

ryandrake wrote: post #236
cortesoft wrote: post #229

Earlier quoted context omitted.

I don’t think it is as simple as saying browsers are working for the web developer and advertisers. All the features that allow web sites and ad companies to track and target ads are features that are primarily there to give functionality that makes the web a better experience for users. JavaScript allows websites that are better experiences than not having it. I know some people disagree, but I think they are either…

I guess what I'm advocating for is that it should not be all-or-nothing, and it should not default-on: Most web sites have no business knowing my time zone. Why are browsers offering it up? That should be gated on the user's permission. Most web sites should not be able to determine what my screen resolution is, or what my operating system is. Browsers should also hold that back and only disclose it with the user's p…

> Most web sites have no business knowing my time zone.

That would work if websites only displayed dates in UTC. Which is not what most people expect. Browsers need to know your timezone so timestamps can displayed with the right setting for you.

Re: A web page that shows you everything the browser told it without asking

#256

Post by reddalo »

xg15 wrote: post #237
cortesoft wrote: post #149

Maybe it's just because I am old, or have worked on internet software for almost 30 years, but none of this seems surprising or even concerning? Someone sets up a server that accepts connections to it and then someone sends a connection request to it. There has been no agreement on anything, no expectations or rules established. No one forces the server to accept any connection request it gets, and no one forces some…

I remember some users with phpBB signatures some 20 years ago that did the "I know where your IP address lives" trick. Yeah, a bit surprised this is still being done, only today not as some silly troll move in a forum but on some professionally designed website.

Yeah I totally remember people embedding an "image" which was in fact dinamically generated with PHP, showing the reader's IP or geolocation.

Re: A web page that shows you everything the browser told it without asking

#258

Post by aucisson_masque »

noelsusman wrote: post #134

I am once again asking privacy advocates to try sounding normal for once. Trying to make a browser accessing your timezone sound nefarious isn't going to convince anyone of anything.

Agree, sending my language, if I use dark mode or time zones is all data that can be used to give me a better experience so I don’t mind.

Re: A web page that shows you everything the browser told it without asking

#259

Post by tristor »

None of the information identified for me was surprising using an up-to-date Firefox on Mac w/ a mostly default configuration. I had to unblock Javascript in NoScript for the page to work.

I get the point, but I think the EFF Panopticon page is a better representation of browser fingerprinting and how it works, because most of the things shared are really basic elements of data that aren't personally identifiable. You can absolutely fingerprint Firefox with a default config, so obviously this was vibe-coded and just doesn't do much. Cool, you did a GeoIP lookup, read the user-agent, the referrer header, and the accessibility data, exactly zero of that should be surprising to anyone that knows how you access a website.

Re: A web page that shows you everything the browser told it without asking

#260

Post by binyu »

lights0123 wrote: post #206
binyu wrote: post #194

They forgot to add timing attack on images load time which can be used to tell if you visited X website. https://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010...

Not since browsers started partitioning caches in 2020: https://developer.chrome.com/blog/http-cache-partitioning/

I don't think this protects from sidechannel/timing attacks applied to images load time completely.

Edit: Reading more thoroughly, probably it does to a great extent after all.

Post reply on HN