Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

Post reply on HN
Print view View original

141–150 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#141

Post by laurent92 »

akersten wrote: post #99

I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actua…

Remember the time of early ActiveX, when you could execute an antivirus in the browser that would scan your entire hard drive. It was exactly the same tech that happened for Windows Update executing in-browser. It feels like we’re doing the same mistake over and over.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#142

Post by Psychlist »

anonymfus wrote: post #139
cbsks wrote: post #106

How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinkin…

> Anyone know if there is an easy way to list all the URI schemes? Settings → Apps → Default apps → Choose default apps by protocol Also there is Settings → Apps → Apps for websites , where you can control rerouting of http/https links to applications.

Windows Settings lets me choose an app, but not choose no app/remove an app. So that's not entirely useful (the obvious "just use notepad for everything" is also an obvious tell)

I'm not wildly keep on manually editing the registry, at least without someone else doing it first and reporting that it didn't break their computer :)

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#143

Post by jonnycomputer »

akersten wrote: post #138
notRobot wrote: post #113

Earlier quoted context omitted.

Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt

Yeah, that was the popup I was referencing - although it's much smaller for you than it was for me - maybe my low res laptop screen is a benefit there. It was noticable enough to clue me that something weird was afoot, but I'm sure it could be disguised further. I think a fix could be: always show a select-program prompt even for unknown schemes (perhaps with a built-in link to the add-ons store a la Windows to find…

I think so. I tried it on my imac, and I didn't notice it until my second go.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#144

Post by dannyw »

opheliate wrote: post #125

Lots of comments about whether or not the demo works consistently between browsers, but regardless, it's a cool attack vector, major props to the authors. Honestly surprised the Tor browser didn't just disable protocol handlers outright beforehand, seems like a vulnerability waiting to happen when you're that paranoid. I'm a bit confused about why so many applications have bothered to create custom protocol handlers.…

It's a more integrated experience. It's totally understandable because it's an officially supported and endorsed way of deep linking.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#145

Post by chrismorgan »

This is connected to a significant usability problem with `tel:` links: you have no way of knowing whether they’ll work, and if they don’t work, it could be in one of a few different ways. Maybe it’ll open a dialer app. Maybe it’ll do nothing at all. Maybe it’ll open an “unknown scheme” browser error page. Maybe it’ll prompt you to open it in an external app (I seem to have both Skype and Zoom willing to handle tel: links; neither is going to succeed). You largely can’t detect whether it has done something, might have done something, or has done nothing. Well, this article shows ways that you can detect likely results for some cases after trying it, but it’s not reliable and is depending on implementation details that are liable to change (especially since they’re a fingerprinting vector).

If it’s not going to work, I’d strongly prefer to not make the phone number a link—and perhaps even to present a different flow to the user (e.g. provide a form or mark an email address as the primary option). But if it is going to work, I definitely want it to be a link. It’s common to just guess from the user agent string or screen size whether it’s a mobile device, but that’s extremely flawed too—some tablets will and some won’t be able to dial, and even desktop platforms may well have some VoIP app.

Fingerprinting and usability are so often so significantly at odds. :-(

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#146

Post by dannyw »

theo-born wrote: post #129

I thought this was known for a while? But speaking of, does the website know if you do have MetaMask installed right away (without prompting you for anything)? Because that would be a real concern if it did.

Yeah it does. Browsing the Web with MetaMask is like walking around with a bag of $10,000 cash openly exposed in a crowded public street of a society with no police officers or law enforcement.

And with a blindfold on your eyes.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#147

Post by dannyw »

DoomHotel wrote: post #124

Wow, it didn't work at all on my desktop. It thinks I have 23 apps from its list installed, on both Firefox and Chrome. Pretty funny seeing that on a Linux box running CentOS 7. Even better, it detects a different app on each as the only one missing: on Firefox it says I don't have Skype installed, while on Chrome it says I don't have Hotspot Shield installed.

That's because on Linux xdg-open handles everything. What's missing is probably a timing issue.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#150

Post by fomine3 »

kdarutkin wrote: post #71

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…

The issue on Chromium bug tracker is reported by @microsoft.com. So testing on Chromium Edge would be nice.
Post reply on HN