Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

Post reply on HN
Print view View original

191–200 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#191

Post by lucideer »

Semaphor wrote: post #171
chii wrote: post #156

Earlier quoted context omitted.

this should be the default behaviour imho - there should never really be a situation where a new window popup is going to be better than a tab.

I have to disagree there. It makes paypal payments really ugly, that is most certainly not what a normal user wants ;)

That's on paypal, and is something they would likely have fixed already if it were the default behaviour.

As for what normal users want, I would presume most of them would want to be safer on the web.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#192

Post by worble »

zuhsetaqi wrote: post #186
Semaphor wrote: post #152

Earlier quoted context omitted.

I have FF set up to open all popups in new tabs. That makes it a lot more noticeable ;)

Which setting does this? Is it „Open links in tabs instead of windows“?

I don't know if it's available in the UI, but in about:config set browser.link.open_newwindow.restriction to 0

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#193

Post by agilob »

kdarutkin wrote: post #31
agilob wrote: post #7

Tried Chrome, Brave and Firefox, got 3 different IDs. On one of the browsers it also didn't detect slack and vscode being installed.

Hi, agilob. I've updated the demo for Chromium and made it work slower, in order to increase accuracy. See also https://news.ycombinator.com/item?id=27147325

Now I got an identifier that you saw 2 times before:

>This is your identifier. It was seen 2 times among 8828 tests so far.

None of these was my run. Still, didn't detect vscode :)

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#195

Post by finder02 »

I started a little project to mitigate risk like this - run firefox from unprivileged podman container (it will work with docker too). https://github.com/grzegorzk/ff_in_podman

I always get the same ID on the demo because 0 apps are detected :) and this makes the browser unique because not many people run browser on system with 0 apps installed.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#196

Post by adontz »

inetknght wrote: post #103
adontz wrote: post #89

Results differ wildly between browsers and even between runs within the same browser. It detects application I do not have installed and does not detect applications I do have installed. For instance it detects iTunes, XCode and Sketch, but they are Mac-only application and I am on Windows. Honestly, I believe it does not work at all.

> iTunes > they are Mac-only application I remember installing and using iTunes on Windows 7. It might be that Apple doesn't distribute a modern version of iTunes. But it's certainly not true in the past.

I do not have any iTunes installed anyway.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#197

Post by mvanaltvorst »

jedberg wrote: post #13

Did it on Chrome, Firefox, and Safari and got the same code on all three. In all three it failed to detect some apps, but the same ones failed each time. When I did it in Safari it actually caused Apple Music to open. When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Firefox was the only one where it was silent. But still, that's an interesting hack. Very clever.

Was silent for me on macOS Big Sur Safari as well, except for the fact that it opened Apple Music without any warning. The author might want to remove the iTunes check, not sure how much entropy it adds anyways given that it is automatically installed on all Macs.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#198

Post by vmception »

kdarutkin wrote: post #71

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…

reminds me why I only use Tor on Tails

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#199

Post by pimterry »

notRobot wrote: post #113
akersten wrote: post #99

I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actua…

Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt

I'm using a tiling window manager and it's very hard to miss: each attempt opens a new window that resizes the browser and takes up half the screen.

On the other hand, I guess they could automatically measure the window size in the popups and use this to detect tiling window managers, which gives them another (albeit noisy) bit for fingerprinting...

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#200

Post by h1fra »

kdarutkin wrote: post #71

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…

Got a perfect match on Chrome vs Firefox. Scary, and very easy to miss the little popup for casual user.

Wonder is it possible to replace the popup by an iframe?

Post reply on HN