21–30 of 213 posts
Looking at their product, I wonder how many of these kind of vulnerabilities are still open and exploited by them. Wouldn't make much sense for them to burn such a useful vulnerability which is required for their product unless they had something better.
It's as if they want browser developers to look at the code and break it as much as possible.
I've no idea whether it works, but they misidentified many apps I don't have installed (Postman, Express VPN, Notion, Figma, Hotspot Shield) It does do the popup for VSCode asking if I want to open links there, which I do have installed.
I guess (and just that), that this can happen if there are overlaps in the scheme handlers. I.e. there are some schemas which lets say XCode handles but which also some other program handles.
Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing wit…
Chrome does not work on Ubuntu, since it opens everything with xdg-open and creates confirmation dialog for both installed and not-installed application
Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing wit…
I've no idea whether it works, but they misidentified many apps I don't have installed (Postman, Express VPN, Notion, Figma, Hotspot Shield) It does do the popup for VSCode asking if I want to open links there, which I do have installed.
Yeah, it gave me quite a list of programs, including xcode and itunes, which is fascinating on a Linux box... they list 20 programs they think I have installed, of which I actually have 2. I'm not sure why it would be so inaccurate, but I feel better...
I don't think you understood the core of the issue: it's not about identifying which applications you have installed, it's about always getting the same result for the same user. If all your browsers serve the same results, you are trackable, no matter if those results are good or not.
Looking at their product, I wonder how many of these kind of vulnerabilities are still open and exploited by them. Wouldn't make much sense for them to burn such a useful vulnerability which is required for their product unless they had something better.
E.g. user agent, screen dimensions, language, web GL, audio api, etc.
Generally wrt. fingerprinting chrome is worse then Firefox as Firefox actively worked to reduce fingerprint-ability if possible, while chrome seems to not care much. Because of this ironically I have a less unique fingerprint on a customized Firefox browser then a "stock" Chrome browser even through much less people use Firefox...
The reason (I think) why they make this public is because this can be used for more then "just" fingerprinting. I.e. this can be used by cyber attacks to find a potential attack vector to then pull of either a direct attack or some social engineering attack.
It's not detecting many of the supported applications on my Mac in Safari.
I ran this in Chrome and then in Edge and got different identifiers.
I've updated the demo for Chromium and made it work slower, in order to increase accuracy.
Tried Chrome, Brave and Firefox, got 3 different IDs. On one of the browsers it also didn't detect slack and vscode being installed.
Is it you main browser in which you had used slack url's/ set slack to always handle the links?
Or is it the opposite?
Or maybe something else?