It seem that Vivaldi have better protection against this than the rest. Running in Vivaldi will cause the demo down to crawl because I think it was trying to find the apps. It detected all of the apps but it failed to appear in the detected list. MacOS Big Sur Apple Silicon if you are wondering
Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
101–110 of 213 posts
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#102Curious: > We have generated your identifier based on 1 applications you have installed. Skype Then it told me I am ninety-something percent unique... I find that odd because pretty much every Windows machine has Skype.
You also have none of the other tested applications; I presume most of them have Word.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#103Results differ wildly between browsers and even between runs within the same browser. It detects application I do not have installed and does not detect applications I do have installed. For instance it detects iTunes, XCode and Sketch, but they are Mac-only application and I am on Windows. Honestly, I believe it does not work at all.
> iTunes
> they are Mac-only application
I remember installing and using iTunes on Windows 7.
It might be that Apple doesn't distribute a modern version of iTunes. But it's certainly not true in the past.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#104Curious: > We have generated your identifier based on 1 applications you have installed. Skype Then it told me I am ninety-something percent unique... I find that odd because pretty much every Windows machine has Skype.
(I work at FingerprintJS) You are likely relatively unique because you only have Skype installed, whereas a lot of visitors will have more applications out of the list. Someone who has no applications on the list installed may be even more unique, for example.
> Someone who has no applications on the list installed may be even more unique, for example.
I ran it in a VM with Firefox and nothing else installed. It correctly detected nothing and stated:
> This is your identifier. It was seen 273 times among 3830 tests so far. > That means it is 92.87% unique.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#105Looking at their product, I wonder how many of these kind of vulnerabilities are still open and exploited by them. Wouldn't make much sense for them to burn such a useful vulnerability which is required for their product unless they had something better.
You can get a lot of entropy just by fingerprinting things send over HTTP headers and things freely accessible by JS. E.g. user agent, screen dimensions, language, web GL, audio api, etc. Generally wrt. fingerprinting chrome is worse then Firefox as Firefox actively worked to reduce fingerprint-ability if possible, while chrome seems to not care much. Because of this ironically I have a less unique fingerprint on a c…
Firefox also has a lot of settings that mitigate various finger printing techniques. There are some good sample configs on Github. [1]
Ironically, many of the settings can make you more unique because they disable a lot of functionality.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#106How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)?
Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes?
Edit2: After thinking about this more, I'm afraid that removing URI schemes from the registry may break those programs. I'd much rather have a browser level setting that will only open external http:/https: resources and other URI schemes that are configured from the browser like mailto:.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#107hm, I tried this on 2 browsers and it said I was unique both times. Shouldn't the second have been a collision?
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#108Earlier quoted context omitted.
Basically browsers have the "I open a popup to ask" or "the user has no schema handler for that schema so I don't need to ask" or the "User already confirmed it always should open the link with given application" behaviour and they can detect it "somehow "? But I still have to look closer into it.
Browsers open pop-ups to ask "Can I run that application?" but only if that application is installed. If that application is not installed, the browser will ignore the custom URL.
It looks like a mitigation might be that in the event you do not have the application installed, to return a "denied" status and send a prompt to the user like "Unknown application protocol".
Something like that could still would be susceptible to a timing attack though.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#109I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actua…
On Chrome MacOS Big Sur, it doesn't require accepting the prompt, and the demo shows you can accomplish this in a small pop-under or pop-up, which a lot of inexperienced users might simply ignore.
Browser devs definitely still need to patch this vulnerability by making it an instant-return no-feedback prompt to open an application.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#110On my 86.0.1 firefox on linux it detected nothing.