[deleted]
Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
131–140 of 213 posts
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#132Earlier quoted context omitted.
Here's one way to disable it on Windows: https://www.thewindowsclub.com/how-to-prevent-launching-apps...
The Local Group Policy setting in the link only affects Windows Store apps: "This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app." I haven't tried…
That's unfortunate :(
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#133How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinkin…
For MacOS, I was able to fix this by editing the info.plist inside each application which was detected. This lets me still keep the app but no longer get detected.
WARNING: Do it at your own risk. I am fairly certain when I restart my computer, the Spotify app will no longer work as deleting the entry from the info.plist file most likely changes the signature of the app binary and it will no longer be valid.
Simply uninstalling the app won't be enough. Rebuild LaunchServices is required to get rid of the registered URL scheme.
The info.plist for Spotify for example is located at:
/Applications/Spotify.app/Contents/Info.plist
You can either do it through terminal or navigate to /Applications in finder, then right click the app and use "Show Package Content" option > Contents > Info.plist.
Open the Info.plist in Xcode, look for CFBundleURLSchemes:
CFBundleTypeRole Viewer CFBundleURLIconFile CFBundleURLName Spotify Media CFBundleURLSchemes spotify
I removed this array. Save the file.
NOTE that if you previously had the app installed in a different directory, you might have to do it there too.
Once done, you will have to run this command to "Rebuild LaunchServices" as explained on this Stack Overflow post.
https://stackoverflow.com/questions/10156939/mac-show-delete...
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -kill -r -domain local -domain system -domain user
Without the above command, the URL scheme wasn't getting unregistered and the site was still picking it up.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#134I thought this was known for a while? But speaking of, does the website know if you do have MetaMask installed right away (without prompting you for anything)? Because that would be a real concern if it did.
I think metamask injects web3 into every context on the page so it's pretty easy to check for that.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#135Earlier quoted context omitted.
I've explicitly uninstalled it on Windows 10, maybe Windows is still reporting it?
Windows 10 does some garbage where it installs handlers for URL schemas that take you to the windows store install page for the app. The vulnerability is only testing if you have an handler installed for skype:// not what application is actually handling it.
According to URLProtocolView[1] the handlers are still registered despite the application (and MANY others) being uninstalled.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#136On Linux: - in Firefox, it detected Epic Games Telegram Discord Battle.net Xcode NordVPN Sketch Teamviewer Microsoft Word WhatsApp Postman Adobe Messenger Figma Hotspot Shield ExpressVPN Notion iTunes, none of which I have installed. It didn't detect VSCode though I have VSCodium. - On Chromium, it warned it would not work well on Chrome on Linux. It incorrectly detected all the apps. It seems that the browser would…
Also Chrome on Linux. For me it says it detected 11 apps installed, but I don't have any of those apps installed. Strange.
Edit: With firefox it is able to correctly detect 3 installed desktop applications.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#137I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…
FWIW - it worked perfectly on Firefox for Linux, but Chrome claimed I had...pretty much everything installed, so it broke horribly.
EDIT: the "special branch" also didn't work
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#138I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actua…
Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt
Yeah, that was the popup I was referencing - although it's much smaller for you than it was for me - maybe my low res laptop screen is a benefit there. It was noticable enough to clue me that something weird was afoot, but I'm sure it could be disguised further.
I think a fix could be: always show a select-program prompt even for unknown schemes (perhaps with a built-in link to the add-ons store a la Windows to find a program to open the "file" ;) ), never fail to a different page context than a successful launch would go to, and make the don't-ask-again checkbox domain specific to prevent random domains doing drive-by automatic launch detection. That seems to solve it without being too disruptive to existing convenience.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#139How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinkin…
> Anyone know if there is an easy way to list all the URI schemes?
Settings → Apps → Default apps → Choose default apps by protocol
Also there is Settings → Apps → Apps for websites, where you can control rerouting of http/https links to applications.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#140I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actua…
On Chrome MacOS Big Sur, it doesn't require accepting the prompt, and the demo shows you can accomplish this in a small pop-under or pop-up, which a lot of inexperienced users might simply ignore. Browser devs definitely still need to patch this vulnerability by making it an instant-return no-feedback prompt to open an application.
I think my initial reaction was too harsh; after thinking through it some more I agree and think there's an easy enough fix I posted in a sibling comment.
As an aside, It's actually surprising the built-in popup blocker let so many popups come from just one user action - I would have thought the heuristic was 1 click = 1 allowed popup before Firefox started denying them.