It's not detecting many of the supported applications on my Mac in Safari.
The exploit was tested in Safari 14.0.3 and 14.1 on MacBook M1 and MacBook Pro. What version do you have?
14.1 on an M1 MBP.
Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
121–130 of 213 posts
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#122How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinkin…
Here's one way to disable it on Windows: https://www.thewindowsclub.com/how-to-prevent-launching-apps...
The Local Group Policy setting in the link only affects Windows Store apps:
"This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app."
I haven't tried the registry setting, maybe that will also block normal desktop applications? Edit: it looks like the BlockProtocolElevation setting also only affects Windows Store apps.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#123Curious: > We have generated your identifier based on 1 applications you have installed. Skype Then it told me I am ninety-something percent unique... I find that odd because pretty much every Windows machine has Skype.
You also have none of the other tested applications; I presume most of them have Word.
> You also have none of the other tested applications; I presume most of them have Word.
What makes you assume I do not have Office installed? Instead of, say, considering the possibility that the fingerprinting may not be that good.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#124Wow, it didn't work at all on my desktop. It thinks I have 23 apps from its list installed, on both Firefox and Chrome. Pretty funny seeing that on a Linux box running CentOS 7. Even better, it detects a different app on each as the only one missing: on Firefox it says I don't have Skype installed, while on Chrome it says I don't have Hotspot Shield installed.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#125Lots of comments about whether or not the demo works consistently between browsers, but regardless, it's a cool attack vector, major props to the authors. Honestly surprised the Tor browser didn't just disable protocol handlers outright beforehand, seems like a vulnerability waiting to happen when you're that paranoid.
I'm a bit confused about why so many applications have bothered to create custom protocol handlers. I can see the benefit for something like Spotify, you click a link in your browser and it takes you to the song you want in the Spotify application. But is the NordVPN application really so complex that they can't just say, "hey, open Nord and click this"? Just seems like an unnecessary UX decision. Unless there's something I'm not seeing?
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#126Earlier quoted context omitted.
On Tor we show a fake captcha on the demo, which allows to collect multiple key presses and use each as a user-provided trigger.
This is a really clever way to coerce interactivity!
Clever indeed; I only suspected this the second go-round, after I noticed the reload button flicker as I typed. I also noticed you don't have to press Enter or even type the correct phrase to get past the fake prompt. In hindsight, the easy to guess text should have been a dead give-away, but it wasn't.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#127Could be alleviated by creating yet another permission at the browser level : "allow to link to local applications"
Firefox on Android has a setting "Open links in apps" and works similar to the way you describe but it's global, either enabled for all websites or disabled for all. I agree that something similar on desktop would be useful.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#128I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…
Interesting work.
It didn't work between firefox and chromium on my linux desktop, even trying the chromium branch. But my linux desktop already puts me into a pretty small bucket of users to begin with, so someone who's doing this may not see any joy in trying to fix that.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#129I thought this was known for a while?
But speaking of, does the website know if you do have MetaMask installed right away (without prompting you for anything)? Because that would be a real concern if it did.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#130Old trick and demo doesn't work :)