141–150 of 280 posts
Earlier quoted context omitted.
this is why we need hardware switches for microphones
fwiw, there's a switch in every ext. mic. jack. plug in an un-wired connector, cut of the wiring post, smooth with a nail-file or put on a crowning drop of glue so it won't rip your bag and you're done.
Earlier quoted context omitted.
Because ads can use Javascript which is notorious for how hard it is to vet code and how easy it is to hide functionality.
But why do they need that? What purpose does an ad with javascript serve?
And given that we are talking about sometimes eight figures worth of ad buying... no network will want to risk offending such clients.
Earlier quoted context omitted.
The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone You are correct, that is the author's concern. The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.
This is a catch-22 though. If something dangerous to privacy is being widely used in the world, then putting it behind a prompt creates an avalanche of prompts, and results in user apathy. But not prompting requires you to choose a default, which either default to block and breaks things (if it was actually required) or defaults to allow.
This is how Firefox tracker protection, uMatrix, noscript, and a plethora of ad blockers and other privacy tools work.
Earlier quoted context omitted.
If a website cannot survive without ads, maybe it doesn't need to actually exist in the first place. The world will go on.
I do think the world would go on, but it's a world I would like less. Some things would move behind paywalls, others would move to the boundary of whatever was considered advertising (sponsored content? Product placement?)
Earlier quoted context omitted.
Has anyone seen any well done research showing these effects?
I've heard it from more folks than I'd like to. And counting them all as crazy or paranoid is less believable than the alternative.
Earlier quoted context omitted.
I've heard similar stories many times but every time it seems to be baader-meinhof effect/frequency illusion or that the linking is not via audio but something else. People have man-in-the-middle checked advertising traffic to see if they either stream audio or send spoken keywords to ad servers and they do not seem to do that. It's more likely that it saw your phone and your friends at similar locations and your fri…
Would it have to be audio? It could do TTS on the phone then send the text back.
Earlier quoted context omitted.
That doesn't protect your microphone from being exposed though.
Well tape the microphone too. With thick soft tape.
I can’t remember the last time I used the built-in mic on a laptop, much less the last time I bought a laptop with a mic that was actually worth using.
Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.
Aren’t they? They’re quite literally distributing malware.
This is not google, but a third party ad network serving ads through google. Google tries to sandbox the creatives in an attempt to prevent issues exactly like this, and develops browser features to prevent issues exactly like this. This is likely a script that somehow avoided google's malware scanning pipelines. This is definitely not google's malintent. Disclaimer: Ex googler, worked in ads, dealed with problems li…
> This is likely a script that somehow avoided google's malware scanning pipelines. Why wouldn't google just block access to those API's? I mean I guess that's what this sandbox did.
A static analysis is often relatively easy to circumvent, something like base64Decode(encodedMaliciousScript) can by-pass them.
Google does various runtime/dynamic analysis to figure out issues, but scripts can do interesting things to circumvent those too (like targeting specific devices through user agent and so on).
It's an arms race, often, where google catches up pretty fast, but bad actors move faster.
Feature Policy check addresses these but ad system and chrome features don't always move at the same speed, and often time there are trade offs that needs to be addressed first before it can be widely deployed.