Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

Post reply on HN
Print view View original

151–160 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#152

Post by Semaphor »

notRobot wrote: post #113
akersten wrote: post #99

I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actua…

Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt

I have FF set up to open all popups in new tabs. That makes it a lot more noticeable ;)

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#153

Post by KirillPanov »

the_duke wrote: post #105
dathinab wrote: post #26

Earlier quoted context omitted.

You can get a lot of entropy just by fingerprinting things send over HTTP headers and things freely accessible by JS. E.g. user agent, screen dimensions, language, web GL, audio api, etc. Generally wrt. fingerprinting chrome is worse then Firefox as Firefox actively worked to reduce fingerprint-ability if possible, while chrome seems to not care much. Because of this ironically I have a less unique fingerprint on a c…

Firefox also has a lot of settings that mitigate various finger printing techniques. There are some good sample configs on Github. [1] Ironically, many of the settings can make you more unique because they disable a lot of functionality. [1] https://github.com/pyllyukko/user.js

This is why the torbrowser/firefox "try to make everybody look the same" approach is doomed.

Adding white noise is the only solution: "try to make your fingerprint on each website for each brower-restart look as different as possible (a) from your fingerprint on every other website and (b) from your fingerprint on the same website on a previous browser-restart".

That's the best you can do anyways without rejecting first-party cookies.

Brave does this, and it is the right way. I just wish Firefox would wake up and clue in to this.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#154

Post by DoctorOW »

fomine3 wrote: post #150
kdarutkin wrote: post #71

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…

The issue on Chromium bug tracker is reported by @microsoft.com. So testing on Chromium Edge would be nice.

Tried it on Chromium edge and it doesn't seem to work

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#155

Post by KirillPanov »

dannyw wrote: post #148
asddubs wrote: post #80

On my firefox (linux) it seems to think I have everything installed for some reason. Worked on tor browser though

Xdg-open

Am I the only one who utterly loathes this tool?

Seriously, it maintains (among other things, yes) the mapping from filename extensions to the path of the binary that should be used to open them.

It's a map : extension -> path.

WhyTF does MIME have to get dragged into this? Why can't I just say "*.foo is opened with /usr/bin/foobalize"? Why must I suffer the agony of trawling the interwebs to find out that blartz.foo is actually a z-content-flavor/foobalized_v3? (Yes, I understand why browsers need to start the lookup using a MIME type. I'm talking about everything else -- the galaxy of things that don't use HTTP).

And even once I've found the Magic MIME type, xdg-open still does whatever it wants, and there appears to be no way to troubleshoot it when it's being invoked by another application. Setting XDG_UTILS_DEBUG_LEVEL=999 simply prints out a list of which files its reading (I can get that from strace, thanks), with no step-by-step rundown of its decision process:

   $ XDG_UTILS_DEBUG_LEVEL=999 xdg-open ftp://foo.com
   Selected DE generic
   Checking /home/user/.config/mimeapps.list
   Checking /home/user/.local/share/applications/defaults.list and /home/user/.local/share/applications/mimeinfo.cache
   Checking /home/user/.local/share/applications/defaults.list and /home/user/.local/share/applications/mimeinfo.cache
   Checking /usr/local/share//applications/defaults.list and /usr/local/share//applications/mimeinfo.cache
   Checking /usr/local/share//applications/defaults.list and /usr/local/share//applications/mimeinfo.cache 
   Checking /usr/share//applications/defaults.list and /usr/share//applications/mimeinfo.cache
   Checking /usr/share//applications/defaults.list and /usr/share//applications/mimeinfo.cache
Okay, y'all can downvote me now, ranty time is over.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#156

Post by chii »

Semaphor wrote: post #152
notRobot wrote: post #113

Earlier quoted context omitted.

Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt

I have FF set up to open all popups in new tabs. That makes it a lot more noticeable ;)

this should be the default behaviour imho - there should never really be a situation where a new window popup is going to be better than a tab.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#157

Post by Scoundreller »

chrismorgan wrote: post #145

This is connected to a significant usability problem with `tel:` links: you have no way of knowing whether they’ll work, and if they don’t work, it could be in one of a few different ways. Maybe it’ll open a dialer app. Maybe it’ll do nothing at all. Maybe it’ll open an “unknown scheme” browser error page. Maybe it’ll prompt you to open it in an external app (I seem to have both Skype and Zoom willing to handle tel:…

Same problem with loading up news.ycombinator.com in Lynx. The browser assumes I meant nntp://news.ycombinator.com ugh.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#159

Post by graderjs »

Super clever to make this exploit work on Chrome by opening a PDF file prior to launching the custom app scheme, in order to activate the Chrome PDF viewer extension, which resets the global flag requiring a user gesture before any custom scheme launch. It didn't track me across Firefox, and Chrome on Windows 10, but it was still cool.

Weird that when I tried running it in chrome headless[0], it opened the popup window, and tried the first scheme, but then stopped, and hung.

[0]: https://comebrowsewithme.com:8002/

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#160

Post by danielmeskin »

chrismorgan wrote: post #145

This is connected to a significant usability problem with `tel:` links: you have no way of knowing whether they’ll work, and if they don’t work, it could be in one of a few different ways. Maybe it’ll open a dialer app. Maybe it’ll do nothing at all. Maybe it’ll open an “unknown scheme” browser error page. Maybe it’ll prompt you to open it in an external app (I seem to have both Skype and Zoom willing to handle tel:…

Does Skype no longer do POTS calls?
Post reply on HN