Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

Post reply on HN
Print view View original

201–210 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#201

Post by q3k »

KirillPanov wrote: post #155
dannyw wrote: post #148

Earlier quoted context omitted.

Xdg-open

Am I the only one who utterly loathes this tool? Seriously, it maintains (among other things, yes) the mapping from filename extensions to the path of the binary that should be used to open them. It's a map : extension -> path. WhyTF does MIME have to get dragged into this? Why can't I just say "*.foo is opened with /usr/bin/foobalize"? Why must I suffer the agony of trawling the interwebs to find out that blartz.foo…

No, xdg-utils are absolutely terrible. They're a mess of untested, undebuggable, underdocumented and extremely user unfriendly shell scripts that need to die and be replaced with something that actually had some serious design thought put into it.

I've once had xdg-open be absolutely broken on my machine, scanning all of my $HOME because of a file with a space character in it [1]. Any attempt to use xdg-open would pin a CPU core for 100% while bash/find recursively traversed millions of files because of missing quote characters in a shell script. Truly the pinnacle of software engineering.

I wouldn't be surprised if serious security bugs lurked somewhere in it, exploitable by web pages attempting to open maliciously crafted protocol URLs.

[1] - https://github.com/freedesktop/xdg-utils/commit/9816ebb3e6fd...

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#202

Post by nonameiguess »

kdarutkin wrote: post #71

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…

It appears to just detect the presence of an installed scheme handler, not the application itself. This does tell you that the application was at one point installed and the uninstaller for it lies and doesn't completely uninstall, but none of the applications it thinks I have are applications I still have (just Spotify and Skype, but still).

Good to know who the offenders are, Spotify and Skype. Everything else I uninstalled was actually uninstalled.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#203

Post by nonameiguess »

nonameiguess wrote: post #202
kdarutkin wrote: post #71

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…

It appears to just detect the presence of an installed scheme handler, not the application itself. This does tell you that the application was at one point installed and the uninstaller for it lies and doesn't completely uninstall, but none of the applications it thinks I have are applications I still have (just Spotify and Skype, but still). Good to know who the offenders are, Spotify and Skype. Everything else I un…

For what it's worth, I went to the Registry Editor, deleted the entries in HKEY_CLASSES_ROOT for Skype and Spotify completely, and these are still showing up as installed.

Makes me wonder if Windows is somehow pre-installing custom scheme handlers for these, whether you have them or not. As far as I know, Skype comes with Windows, so there is no way to test a fresh installation that never had it at all, but Spotify? Is there anyone using a completely clean fresh Windows installation that can test if this demo thinks it is installed even though it isn't?

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#204

Post by Haemm0r »

jszymborski wrote: post #108
valve1 wrote: post #34

Earlier quoted context omitted.

Browsers open pop-ups to ask "Can I run that application?" but only if that application is installed. If that application is not installed, the browser will ignore the custom URL.

It looks like a mitigation might be that in the event you do not have the application installed, to return a "denied" status and send a prompt to the user like "Unknown application protocol". Something like that could still would be susceptible to a timing attack though.

always show the popup, but populate it "later" could work too.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#205

Post by swiley »

pimterry wrote: post #199
notRobot wrote: post #113

Earlier quoted context omitted.

Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt

I'm using a tiling window manager and it's very hard to miss: each attempt opens a new window that resizes the browser and takes up half the screen. On the other hand, I guess they could automatically measure the window size in the popups and use this to detect tiling window managers, which gives them another (albeit noisy) bit for fingerprinting...

The large number of incompatible desktop Linux configurations have underrated security benefits.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#206

Post by kdarutkin »

h1fra wrote: post #200
kdarutkin wrote: post #71

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…

Got a perfect match on Chrome vs Firefox. Scary, and very easy to miss the little popup for casual user. Wonder is it possible to replace the popup by an iframe?

It is possible on Tor Browser. Chrome and Firefox show a confirmation popup in the main frame.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#207

Post by toomanybeersies »

> In a quick search of the web, we couldn’t find any website actively exploiting it but we still felt the need to report it as soon as possible.

I've seen popup-based exploits on less-legal websites (e.g. torrents, keygens, illegal streaming of live sports and/or movies) a few times over the years. I'm unsure if they're executing this specific exploit though.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#208

Post by nonameiguess »

cbsks wrote: post #106

How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinkin…

You can remove any settings you persisted in Firefox regarding whether to open a uri scheme in an external application or not by going to your profile folder and deleting the handlers.json file. Do this when Firefox is not open. This will clear any history if you've ever selected "always open links of this type with " in the popup.

But unfortunately, this exploit is just depending on the popup to happen at all, which I don't think you can configure from Firefox. If a uri scheme handler is registered with Windows, Firefox will ask you if you want to use it. Deleting the registered scheme handler from Windows is a matter of finding an entry in HKEY_CLASSES_ROOT in the registry with a name that matches the scheme and deleting that entry. For instance, in regedit, if you find HKEY_CLASSES_ROOT\spotify, you can delete it and no more handler for spotify://.

Whether or not this breaks the program probably depends on the program. If buttons and links in the application itself use this scheme, then it probably will. If they're handled directly without delegating to the OS, then maybe not. Worst that happens is you can always just reinstall the application if it stops working.

I'm looking around through Firefox docs about whether it's possible to block specific uri schemes from being handled at all but not finding anything. They do block data:// and have a strict origin policy for file://, but those are already on by default and I can't find anything related to blocking (or allowing) arbitrary uri schemes. That would be one obvious fix, though, and the researchers here did report this as a bug, so maybe an upcoming Firefox will offer this.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#209

Post by nonameiguess »

nonameiguess wrote: post #208
cbsks wrote: post #106

How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinkin…

You can remove any settings you persisted in Firefox regarding whether to open a uri scheme in an external application or not by going to your profile folder and deleting the handlers.json file. Do this when Firefox is not open. This will clear any history if you've ever selected "always open links of this type with " in the popup. But unfortunately, this exploit is just depending on the popup to happen at all, which…

Should add the obvious ultimate way to prevent fingerprinting of this type is to just run Firefox in its own VM or container with a totally clean OS you otherwise don't touch. You could choose to share the Downloads folder between guest and host so you can still save files, but it then wouldn't be able to see what you do and don't have installed on your real host system.

Of course, if you do anything to allow hardware acceleration in your browser so you're not streaming media like it's 1999, it'll still be able to fingerprint you based on the hardware, but at least it won't see what applications you have.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#210

Post by Dah00n »

sneak wrote: post #68
Dah00n wrote: post #60

Earlier quoted context omitted.

This won't work against fingerprinting unless you change the underlying hardware and / or external IP too when stating a new VM. If you don't have a unique external IP per VM you might as well not bother. It is like trying to hide from the police by changing clothes and cutting your hair but stil hold the same huge sign with your name and address in your hands.

The use of Tor or a public VPN (i.e. many hundreds of unrelated users sharing a single public IP) is implicit.

Since this is about fingerprinting and not hiding your identity I'm not sure this will help. If you use a public VPN you are removing some data points from the fingerprint but adding a huge new one. After all fingerprinting is about blending in and being like the average user. Adding a few privacy extensions and a VPN and you are much easier to recognise.
Post reply on HN