Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browserball

weareinstrument.com

Post reply on HN
Print view View original

21–30 of 77 posts

Re: Browserball

#21

Post by Cpoll »

sleepychu wrote: post #9
21 wrote: post #4

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

How do you know the coordinates are absolute? It seems like the child windows are 'special', perhaps the web page can obtain the relative coordinates of these child panels?

It's using window.screenY (and screenX, of course,) which gives absolute coordinates. https://developer.mozilla.org/en-US/docs/Web/API/Window/scre...

I don't think the method you're describing exists. If you want child coordinates relative to parent coordinates, you would use both the parent and child's absolute coordinates.

Re: Browserball

#22

Post by 21 »

sleepychu wrote: post #9
21 wrote: post #4

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

How do you know the coordinates are absolute? It seems like the child windows are 'special', perhaps the web page can obtain the relative coordinates of these child panels?

Go to https://jsfiddle.net/hj697tbg/ and move the window around for a demo.

Re: Browserball

#23

Post by Retric »

gnur wrote: post #10
nxzero wrote: post #8

Earlier quoted context omitted.

Right, never max out your window, it's a known data leak used to fingerprint users.

I'd say that maximizing is more general then having a custom sized window. There are only so many resolutions in use (and I would guess 50%+ is either hd, full hd or qhd). Resizing your windows yield nearly unlimited options for browser sizes.

It's a question of consistency. A few version numbers + window sizes are going to stay the same every visit. It only takes 33 bits of information to uniquely identify everyone on the planet and you likely can get more than 1 from a maximized window.

Re: Browserball

#25

Post by ErikRogneby »

vesinisa wrote: post #19
21 wrote: post #4

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

Just use NoScript if you are concerned. JavaScript allows a large number of other ways to identify you as well. Direct ways of course include cookies / local storage / Web SQL, but other indirect ways include localization preferences, OS / browser / plugin / extension fingerprinting, HID inputs, side channel profiling etc. etc. – some combination of these allows uniquely identifying at least 80% of web users.[1][2][3…

Might as well say don't use the web. Disabling javascript will break most sites with a few rare exceptions. (like HN)

Re: Browserball

#26

Post by TazeTSchnitzel »

21 wrote: post #4

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

> What's the reason for allowing web pages to get absolute screen coordinates?

Back in the 90's, Microsoft and Netscape were all too happy to give JS developers the world with almost no regard for security consequences.

We've spent the last 20 years trying to fix their mistakes.

Re: Browserball

#27

Post by helb »

sleepychu wrote: post #9
21 wrote: post #4

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

How do you know the coordinates are absolute? It seems like the child windows are 'special', perhaps the web page can obtain the relative coordinates of these child panels?

You can get absolute position of windows or even mouse cursor without any "child window magic": http://codepen.io/anon/pen/pyVYvb

Re: Browserball

#28

Post by TeMPOraL »

phkahler wrote: post #18
21 wrote: post #4

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

>> What's the reason for allowing web pages to get absolute screen coordinates? Web developers have always pushed for more access to information about the user and their environment. Browser and tool developers are happy to provide that access. There's always some use case that sounds reasonable, but you're right that it's just a security issue waiting to happen. These holes are also being talked about in the new Way…

> Web developers have always pushed for more access to information about the user and their environment. Browser and tool developers are happy to provide that access. There's always some use case that sounds reasonable, but you're right that it's just a security issue waiting to happen.

I'm torn. On the one hand I understand the privacy implications; on the other hand, if you'd want to be serious about those, you'd have to get rid of JavaScript and half of CSS. Every interesting feature can be turned into a privacy/security violation; how far are we willing to go in removing them?

Re: Browserball

#29

Post by zbjornson »

21 wrote: post #4

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

I've used it to automatically position auxillary windows adjacent to the main window in a data analysis application. I don't see how it reveals anything private about the user... my screen resolution and window location are not secrets to me.

Re: Browserball

#30

Post by zbjornson »

cyphar wrote: post #16

I remember playing with this at least 8 years ago. It's really scary that there's enough information disclosure in browsers that it's possible to do this.

What do you see being disclosed? The origin has control over the windows it creates and nothing else.
Post reply on HN