Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple adds a tracker blocker to desktop Safari

techcrunch.com

Post reply on HN
Print view View original

181–190 of 301 posts

Re: Apple adds a tracker blocker to desktop Safari

#181

Post by om2 »

justinschuh wrote: post #179
om2 wrote: post #159

Earlier quoted context omitted.

The question is a bit complex than a simple reading of these files. Mac OS sandboxing allows dynamic extension of the sandbox, which would not be reflected in the profile (I'd bet Safari does more of this than Blink though). Also, as you mentioned, it's relevant to look at what's factored into separate processes, and how those processes are sandboxed. Safari's Network process has been networked since 2013, so I don't…

I don't keep up too much on Safari these days, so congrats on moving the network stack out of the content process. But looking at the current WebProcess seat-belt policy and what gets initialized, it looks like there's still far too much attack surface relative to Chrome. Things like audio/video capture and other permissioned Web APIs appear to be permitted directly inside the sandbox. And the GPU attack surface alon…

The network stack has been out of the content process for a super long time, it is not a new thing. (Ironically, Chrome engineers argued strenuously against doing it when we first started).

You're right that separate GPU process is a huge advantage for Chrome. Kudos on that, and we'll likely have to move in the same direction sooner or later.

Audio/video capture is temporary and not in currently shipping Safari. It was just the simplest path to getting WebRTC up and running. We plan to fix it before we ship. I agree with you that it's risky attack surface.

Also agree with you that we expose more mach services and for lots of them it would be better not to expose them. A tradeoff here is that Chrome (as I understand it) provides most of those facilities via brokers that are often not sandboxed themselves. It used to be many of those things were just done by the application process.

I suspect over time we'll see our respective sandbox models become more similar over time, especially on macOS.

Re: Apple adds a tracker blocker to desktop Safari

#182

Post by atestu »

mmanfrin wrote: post #156

The cynic in me sees this as cutting off Google, and then tracking within the browser so they become the source of cross-internet tracking. I'd be on the lookout for any new 'personalization' feature that comes in to the browser. E.g. WWDC 2018: 'Today we're happy to announce Siri integration with safari! She will provide personalized recommendations and results by applying machine learning to your documents and data…

They showed this on iOS Safari today:

> Siri now suggests searches in Safari based on what you were just reading. And when you confirm an appointment or a flight on a travel website, Siri asks if you want to add it to your calendar.

Search for "Smarter about you." on this page: https://www.apple.com/ios/ios-11-preview/ Looks like it's done on the device though, End-to-end encrypted with your other devices.

Re: Apple adds a tracker blocker to desktop Safari

#183

Post by ianlevesque »

mtgx wrote: post #180
tannhaeuser wrote: post #26

Thumbs up for Apple distinguishing themselves by their pro-privacy stance, as opposed to MS, who don't have anything to win by Win10's excessive "telemetry" IMHO.

It's also a real shame they're doing this before Mozilla. Mozilla already has Tracking Protection but only for Private Windows. It's like Mozilla can't even embrace its privacy stance fully.

Like their entire revenue stream comes from search deals, who all depend on advertising.

Re: Apple adds a tracker blocker to desktop Safari

#184

Post by om2 »

theprop wrote: post #149

I read https://webkit.org/blog/7675/intelligent-tracking-prevention... which details this. They're just being a little sophisticated in how they block third-party cookies. This will hardly stop other tracking scripts, tracking images, widely-used fingerprinting techniques and related js calls. So nothing remotely close to even Brave let alone a TOR or the Epic Privacy Browser.

We're trying to do the most extreme thing we can do short of blocking ads. To be more effective, you end up blocking ads, whether intentionally or as a side effect.

This blocks more than just cookies by the way, it affects all client-side state. And client-side state is still the primary and most reliable tool used for tracking, even though other methods exist, such as browser fingerprinting, behavioral fingerprinting, and IP-based tracking.

Re: Apple adds a tracker blocker to desktop Safari

#185

Post by stirlo »

Darthy wrote: post #166
ljoshua wrote: post #155

Earlier quoted context omitted.

Is it a randomized number per card per merchant, or just a randomized number per card?

It's a randomized number per original card. Every merchant sees the same number. According to some other poster, if you have several devices (like an iPhone and an Apple Watch), then you get a new number for each device. So, not only can a single merchant track you, but all merchants can cross-reference the data they have about you and track your whereabouts, purchasing habits etc. They just don't know who you are an…

Or you just use any kind of loyalty card/ account when making a payment using apple pay even once. :( I didn't realize it only randomized once and am now disappointed in the way apple marketed it.

Re: Apple adds a tracker blocker to desktop Safari

#186

Post by justinschuh »

om2 wrote: post #181
justinschuh wrote: post #179

Earlier quoted context omitted.

I don't keep up too much on Safari these days, so congrats on moving the network stack out of the content process. But looking at the current WebProcess seat-belt policy and what gets initialized, it looks like there's still far too much attack surface relative to Chrome. Things like audio/video capture and other permissioned Web APIs appear to be permitted directly inside the sandbox. And the GPU attack surface alon…

The network stack has been out of the content process for a super long time, it is not a new thing. (Ironically, Chrome engineers argued strenuously against doing it when we first started). You're right that separate GPU process is a huge advantage for Chrome. Kudos on that, and we'll likely have to move in the same direction sooner or later. Audio/video capture is temporary and not in currently shipping Safari. It w…

> The network stack has been out of the content process for a super long time, it is not a new thing.

FWIW, Chrome's network stack doesn't live in the content process either. It's not currently sandboxed, but it's in a process that has no scripting runtime or other dynamic content, so it's still pretty high bar for exploit. The exact reasons for the current situation have to do with some legacy Windows support that has since been removed, which is why the sandboxing work is now moving forward. So, I definitely appreciate your situation with adding some sandbox exceptions for WebRTC.

> I suspect over time we'll see our respective sandbox models become more similar over time, especially on macOS.

Fair. But I will say that Chrome being cross-platform tends to naturally push us in the direction of eliminating sandbox attack surface. Our supported platforms just differ so much that it's easiest to lock down the OS as much as possible and implement narrower, origin-bound capability brokers inside Chrome. If I were more tightly bound to a given OS implementation, I expect I'd have a lot more fights about sandboxing, because it's easier for devs to just standardize on what the OS gives you.

Re: Apple adds a tracker blocker to desktop Safari

#187

Post by ksk »

lovich wrote: post #162
ksk wrote: post #107

Earlier quoted context omitted.

I don't have to "imagine" anything. Let me invite you to consider the context of my original comment before coming up with ridiculous comparisons.

Doesn't seem that ridiculous a comparison to me. You don't have a right to compel something from someone else, but that doesn't meant you just have to give up at whatever task you are trying to accomplish

When I read a comment, the first thing I do is read the ones above it so I understand the limited scope of the comment. I don't immediately rub my hands with glee and go about compiling a list of situations to which the comment doesn't apply. I guess that sort of thing appeals to some.

Complaining about losing data is in no way the same as assuming entitlement status or forcing someone to do something. The job of a police officer is to enforce laws, and exercise human judgement. The issue with the fifth amendment would be handled by lawyers in courts, not by the officers on the ground. IT jobs have completely different parameters. The comparison with police officer is entirely irrelevant and as such I don't want to continue that discussion.

Re: Apple adds a tracker blocker to desktop Safari

#188

Post by ksk »

icelancer wrote: post #172
ksk wrote: post #119

Earlier quoted context omitted.

Why is it wrong to want to make your job easier? I guess I don't see your point of view..

I would like it to be easier. I also know that I am not entitled to that. This isn't difficult to grasp for most of HN based on the comments...

The difficult thing to grasp here is your continued insistence that someone claimed they are entitled to something when they did not.

Re: Apple adds a tracker blocker to desktop Safari

#189

Post by ksk »

lovich wrote: post #164
ksk wrote: post #119

Earlier quoted context omitted.

Why is it wrong to want to make your job easier? I guess I don't see your point of view..

Why is wrong for people to want to protect something they have of value, from someone else just harvesting it from them? I can see why this is annoying but can you really not see the other side of this situation?

I don't think you quite understand this conversation. I'll prefer to not argue with you any further.

Re: Apple adds a tracker blocker to desktop Safari

#190

Post by donarb »

alternativetoo wrote: post #72
tannhaeuser wrote: post #26

Thumbs up for Apple distinguishing themselves by their pro-privacy stance, as opposed to MS, who don't have anything to win by Win10's excessive "telemetry" IMHO.

Hmmm. https://arstechnica.com/tech-policy/2017/03/isps-say-your-we... > CTIA is the main lobbyist group representing mobile broadband providers such as AT&T, Verizon Wireless, T-Mobile USA, and Sprint. It doesn't just represent them, Apple is also a member: https://www.ctia.org/about/our-members

You do know that Apple makes mobile devices, right? And so it would make sense that Apple is part of the group the supports hardware standards in the mobile device industry, they're not just a lobbying group.
Post reply on HN