Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

Post reply on HN
Print view View original

161–170 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#161

Post by chrismorgan »

danielmeskin wrote: post #160
chrismorgan wrote: post #145

This is connected to a significant usability problem with `tel:` links: you have no way of knowing whether they’ll work, and if they don’t work, it could be in one of a few different ways. Maybe it’ll open a dialer app. Maybe it’ll do nothing at all. Maybe it’ll open an “unknown scheme” browser error page. Maybe it’ll prompt you to open it in an external app (I seem to have both Skype and Zoom willing to handle tel:…

Does Skype no longer do POTS calls?

If you pay them. I say it’s not going to succeed specifically because I haven’t.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#164

Post by [deleted] »

opheliate wrote: post #125

Lots of comments about whether or not the demo works consistently between browsers, but regardless, it's a cool attack vector, major props to the authors. Honestly surprised the Tor browser didn't just disable protocol handlers outright beforehand, seems like a vulnerability waiting to happen when you're that paranoid. I'm a bit confused about why so many applications have bothered to create custom protocol handlers.…

[deleted]

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#166

Post by zzo38computer »

Scoundreller wrote: post #157
chrismorgan wrote: post #145

This is connected to a significant usability problem with `tel:` links: you have no way of knowing whether they’ll work, and if they don’t work, it could be in one of a few different ways. Maybe it’ll open a dialer app. Maybe it’ll do nothing at all. Maybe it’ll open an “unknown scheme” browser error page. Maybe it’ll prompt you to open it in an external app (I seem to have both Skype and Zoom willing to handle tel:…

Same problem with loading up news.ycombinator.com in Lynx. The browser assumes I meant nntp://news.ycombinator.com ugh.

Lynx is functioning correctly (although I would prefer treating user-entered URLs as relative). However, I think that in new versions of Lynx you can turn that feature off if you want to. However, I think that they really should add a NNTP server so that you can access NNTP, too.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#167

Post by zzo38computer »

I would fix perhaps by the new web browser doing:

- Document scripts are restricted, and can be customized and spoofed (or fully disabled) by the user.

- Whether or not a link can be opened, and whether or not it is asked, depends on user settings. If it is configured to ask, it does so for both known and unknown URI schemes.

- Known and unknown schemes are both considered different origins; they do not redirect to about:blank (unless it is a scheme which is handled by rendering a document, which happens to redirect to about:blank, but it does not normally do this).

- Scripts cannot detect such prompts, and only one can be displayed at a time. One key combination can be used to prevent further prompts; even if a way is found, only one will work anyways.

And many other improvements, because existing web browsers are bad in a lot of ways.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#168

Post by [deleted] »

chii wrote: post #156
Semaphor wrote: post #152

Earlier quoted context omitted.

I have FF set up to open all popups in new tabs. That makes it a lot more noticeable ;)

this should be the default behaviour imho - there should never really be a situation where a new window popup is going to be better than a tab.

[deleted]

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#169

Post by simondotau »

Semaphor wrote: post #152
notRobot wrote: post #113

Earlier quoted context omitted.

Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt

I have FF set up to open all popups in new tabs. That makes it a lot more noticeable ;)

I do this too. It's also a massive usability win for those annoying websites (usually banking or government) that insist upon a full screen pop-up window to hide the navigation controls and URL bar.
Post reply on HN