Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Second Teleportation

upollo.ai

Post reply on HN
Print view View original

11–20 of 71 posts

Re: 10 Second Teleportation

#11

Post by cypherpunks01 »

dag11 wrote: post #6

Unrelated to the article directly, it's kinda neat that the site's text selection highlight color is randomized on every mousedown.

  /* Text Higlight Color /**/
  :root {
    --highlight-color: null;
  }

  ::selection {
    background: var(--highlight-color);
    color:#FFFFFF;
  }
  ::-moz-selection { /* Code for Firefox */
    color: #FFFFFF;
    background: var(--highlight-color);
  }
  

  
  
    const colors = ["#F76808", "#30A46C", "#0091FF", "#6E56CF", "#E5484D"];
    window.addEventListener("mousedown", (e) => {
      const color = colors.shift();
      document.documentElement.style.setProperty("--highlight-color", color);
      colors.push(color);
    });

Re: 10 Second Teleportation

#16

Post by jitl »

aaron695 wrote: post #4

I'm missing something > strange devices show up for some of our customers' users > how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? Either - The customer has screwed up user auth big time and some X knows that.... lets go with no - OP's data is wrong or they are reading it wrong - They are explaining it badly.

What's happening is that some MiTM Palo Alto networks system is intercepting the HTML contents of the page, waiting a bit, and then rendering that HTML content again in old Chrome on a separate machine. It's like if you go to a authenticated page that only you can see, like https://news.ycombinator.com/flagged?id=aaron695, did "View Source", copy-and-paste that source into a HTML file, and then you send me the HTML file and I open the HTML file on my computer.

Re: 10 Second Teleportation

#17

Post by jitl »

mholm wrote: post #7

I wonder if this could be iCloud Private Relay? It appears that it's effectively a VPN with some redirection layers that change often, though I don't know the exact details.

From the article:

> But wait, these are different devices, they have none of the same cookies. If this were a VPN it would be the same device.

Re: 10 Second Teleportation

#18

Post by yoz »

Here's my wild guess:

Some other code running in the browser window (probably a browser extension, but possibly another script tag in the page, inserted by an intermediate firewall/proxy) is doing this. It could be corporate spyware (i.e. forced on users by the IT department), or an extension that only tends to be used by large institutions (because it relates to some expensive enterprise product). Alternatively, it could be a much more popular browser extension, but it only executes this capture when it determines that the user is within a target list of large institutions.

I'm making the same guess as the author about the execution process: that the code is shipping a huge amount of page content to a cloud server, e.g. the full DOM, and then rendering that DOM in this older Chrome version. It's not fetching the same page from the origin server, which is how it's able to do this without auth cookies.

As part of rendering, the page's script tags all get executed again, which is why Upollo is seeing this. (Note that I don't know if this re-execution of script tags is deliberate. There's a good chance that it's an unintended side-effect of loading the DOM into Chrome, but it doesn't seem to break anything so nobody's bothered to disable it.)

It's only sampling a small percentage of executions, which is why it's not continually happening for every interaction by these users.

It's waiting ten seconds so that the page's network interactions are likely to have finished by then. Waiting longer would increase the odds of the user navigating to another page before the code has had a chance to run.

The article doesn't say if there are particular kinds of pages being grabbed, but looking for commonality between them would help.

The main thing that stumps me – assuming I've understood it correctly – is why the second render is happening across such a diverse set of cloud networks.

Re: 10 Second Teleportation

#20

Post by jitl »

bloody-crow wrote: post #14

It could be a chat preview generator. Users DM links to some internal project pages in an chat tool and the tool fetches the page in the background in an attempt to render a preview.

In that case, the preview system would do (eg) GET https://example.com/private/page, but get a 401 Unauthorized response back, and have none of the page content or execute any of the scripts inlucded in that /private/page:

> * That somehow had the page content from a user

> * Would render and execute all scripts on that page as if it was that user

Post reply on HN