121–130 of 180 posts
The resource is retrieved using GET, so I wouldn’t think that is required by the http standard. If so, browsers can mitigate this kind of attack by pre-fetching these resources (even pre-fetching a fraction at random already might be enough)
It is a neat hack, though.
Call me naive but, as a dev, I don't see why this would be any better than using JS. The group of people that block JS is likely to do the same for this and, as mentioned by others, common sources of such mucking are blocked by a good ad blocker. Then, there is the whole, "how could it be integrated into an existing site with minimal fuss" issue. With JS you can specify targets and the like for actions and observatio…
This seems to me more like "wow, something cool has been done in an unusual way" material, rather than "this is something you should consider using".
Earlier quoted context omitted.
While we, as devs, may get tired of the constant beat-down between site flexibility and privacy, many of our users are unaware. They will go blindly towards flexibility and we have a duty to find as much compromise as possible between those two values lest we just say "it's an easy fix, just turn off your computer". There has to be a middle ground between extremely paranoid turn everything off and extremely liberal w…
I guess my point is "how much anonymity is it reasonable to expect?" Should I have a problem with the fact that nigh-on every URL in the world will leave behind a little footprint when I request it? I don't see an enormous problem with a website anonymously recording the fact that I've clicked a link. ("anonymously" assuming I'm blocking their cookies, which I would if I were that paranoid)
Note that cookies are mostly a convenience vis-a-vis tracking. For user tracking, there's nothing really stopping the server from vending you a version of their site with custom CSS that loads images with a fingerprint in the URL, which would still work with cookies disabled. That'll get you coherent signal on a session (gluing different sessions together would be a bit more challenging, of course, but I wouldn't be surprised if it were possible).
The obvious solution is to block the server-side pages that the CSS elements link to. This kind of tracking can be mitigated the same way any other kind of tracking is already handled by uBlock or uMatrix.
uBlock can't block manual tracking...just third-party scripts that do it. Example: You visit example-site.com example-site.com is the php server that sends you the html. It also the site that does the tracking. So when you click something it sends that data to example-site.com and then it can forward the data to a third-party tracking service. If you blocked or used host files on the server-side pages then the site e…
* user and machine readable content (text with hyperlinks, pictures, audio, video, rest)
* universal app store (javascript, css, intents, permissions...)
Every user could consume or style content as he wishes. If my IDE has dark theme, I want all web pages to have dark theme. Why do I need javascript to read news or browse pictures.
If user wants to installs app from app store he should accept software license and give permissions to that application.
This could easily be stopped by a change in browser behavior. If web browsers downloaded contacted every address specified with `url()` automatically on page load, without considering the conditions, this type of conditional requests would be impossible. Conceivably, you could solve it through a simple browser extension that looks through all of the page’s stylesheets and calls all URLs present in the CSS before the…
I'm surprised browsers wouldn't prefetch stuff like this given it's an easy performance win. Which would then also make these stats useless.
If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…
> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 l…
If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…
Oh my. I wish this madness ended. Quoth tedu:
> I don’t know a whole lot about typography and fonts, but there’s two things I know about font files. They’re ridiculously complex and their parsers have only just begun to experience life with hostile inputs. In short, I’d put fonts second on my list of files likely to pwn your browser, after Flash [...].