Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

111–120 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#111
post #98
post #13

Did it on Chrome, Firefox, and Safari and got the same code on all three. In all three it failed to detect some apps, but the same ones failed each time. When I did it in Safari it actually caused Apple Music to open. When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Firefox was the only one where it was silent. But still, that's an interesting hack. Very clever.

> When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Interesting. In my case I saw the little pop up window in all three browsers. Otherwise same results though.

I just verified this on my machine and it was able to uniquely identify across Brave browser, Firefox and Epic browser (based on Chromium). I didn't check Safari because that's the browser I use the most and don't want to test on that.

The Epic browser one was interesting. That browser comes with a built in proxy for routing connections through other countries. I use it to get around geolocked content and sometimes for a tiny sense of anonymity. But seeing this able to identify it with same identifier as Brave and Firefox was a bit more troubling. But I guess that comes with the territory of all these browsers using the same Chromium engine.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#112
post #13

Did it on Chrome, Firefox, and Safari and got the same code on all three. In all three it failed to detect some apps, but the same ones failed each time. When I did it in Safari it actually caused Apple Music to open. When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Firefox was the only one where it was silent. But still, that's an interesting hack. Very clever.

I "saw" the little square window in Firefox on Windows 10, but only because I was paying attention. It was down in the corner, on (for some reason) my second monitor.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#113

I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actua…

Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss.

[0]: https://schemeflood.com/

[1]: https://imgur.com/a/YqbbfPt

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#114
post #13

Did it on Chrome, Firefox, and Safari and got the same code on all three. In all three it failed to detect some apps, but the same ones failed each time. When I did it in Safari it actually caused Apple Music to open. When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Firefox was the only one where it was silent. But still, that's an interesting hack. Very clever.

I "saw" the little square window in Firefox on Windows 10, but only because I was paying attention. It was down in the corner, on (for some reason) my second monitor.

Yep, same experience on FF. Here's a screenshot: https://imgur.com/a/YqbbfPt

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#115
post #106

How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinkin…

Here's one way to disable it on Windows: https://www.thewindowsclub.com/how-to-prevent-launching-apps...

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#116
post #9

>By opening a popup window with a custom URL scheme and checking if its document is available from JavaScript code, you can detect if the application is installed on the device. in FF, unless im mistaken this assumes the user clicks anything except cancel on the popup. bug for reference and comment. https://bugzilla.mozilla.org/show_bug.cgi?id=1711084 further from the github: > the basic concept is the same. It works…

Hi, nimbius. I’m the article author, can you please clarify your question? The demo will not work without a popup window in Chrome, Firefox and Safari. The “Get My Identifier” button is needed in order to have a single user gesture to open an additional window. However the Tor Browser demo works silently without any additional window.

On Firefox, I didn't get any popup window. I did get it on Brave browser (Chromium based).

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#117
I tried it in Firefox and Tor, and got the same identifier for both, but in both cases it said, "This is your identifier. It is unique among [####] tests so far."

But.. it wasn't unique for the second browser I tried. And they'd be coming from different IPs, so it wouldn't have any way to know both were coming from the same person, aside from the fingerprinting itself...

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#120
> Safari: Despite privacy being a main development focus for the Safari browser, it turned out to be the easiest browser of the four to exploit. Safari doesn’t have scheme flood protection which allows the exploit to easily enumerate all installed applications. The same-origin policy trick as used for the Firefox browser was used here as well.

On iOS (and MacOS too I believe), when developing apps and requesting URL scheme, the developer has to declare every URL scheme they want their app to query in the `LSApplicationQueriesSchemes` array in info.plist of the app. This was added in iOS 9 as part of a similar vulnerability where apps and advertisement SDKs would simply query a list of URL schemes and then identify based on that across multiple apps. Something similar can be done by browsers for websites. MacOS could simply show you a popup with a checkbox list of all URL schemes the site tries to query for with options for "Allow", "Deny" or "Randomize".

Post reply on HN