Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I recorded user behaviour on my competitor’s websites

dejanseo.com.au

Post reply on HN
Print view View original

291–300 of 329 posts

Re: How I recorded user behaviour on my competitor’s websites

#291

Post by brlewis »

scratchnsniff wrote: post #280
brlewis wrote: post #264

Earlier quoted context omitted.

I read the article, but still don't get what's Chrome-specific about this vulnerability, or what a good fix would look like. My reply to someone who proposed making the back button always go to the previous URL: https://news.ycombinator.com/item?id=17826406

The issue is that some web applications don't load what traditionally were discrete pages (e.g. PAJAX) with their own URLs. It's a trend you'll find in sites built to feel more like applications. Scroll the the bottom of an onion.com article and watch your URL update to the next page without a page refresh. This was done so modern sites built like this could still allow the user to navigate back and forward. It let's…

I could imagine blocking this behavior if it points to a site off the TLD and it's sub domains

This would not address the vulnerability in the article.

Re: How I recorded user behaviour on my competitor’s websites

#292

Post by EGreg »

rapind wrote: post #239
_bxg1 wrote: post #232

Earlier quoted context omitted.

I'm willing to give you the benefit of the doubt and assume you were just unaware of how things are supposed to be done (reporting exploits to the vendors privately and waiting for the fix before going public), but man, you did a fantastically dangerous thing even if it was unintentional. I'd never condone beating up on somebody on the internet, but I dearly hope you've learned a valuable lesson here. You've put lots…

This is the misconception I can't stand. Where we hold individuals responsible for a product / companies defect. I thoroughly disagree with the idea that it's his fault people are vulnerable. So called responsible disclosure is just a marketing spin term. Disclosing bugs privately is a favour not a responsibility. All this does is reduce the risk of bad software decisions. It doesn't solve anything. How about free ma…

I sympathize with THIS position. It’s the same blame shifting crap when “identity theft” becomes your fault, even though any cashier or clerk can “steal your identity”.

What this marketing spin does is give cover to those who design badly secured systems.

http://www.youtube.com/watch?v=CS9ptA3Ya9E

Also similar is the “jaywalking” idea, made by car manufacturers to make the default right of way to cars!

http://amp.charlotteobserver.com/opinion/op-ed/article650322...

Re: How I recorded user behaviour on my competitor’s websites

#293

Post by falcor84 »

code_duck wrote: post #127
falcor84 wrote: post #99

Earlier quoted context omitted.

It's also a big trademark violation, right?

I would say copyright violation.

Yeah, copying the content is definitely copyright violation. But I meant to say that by hosting these sites, the developer could also get sued for attempting to conduct business under the trade name of another entity. And that includes, in particular, hosting that fake Google SERP.

Re: How I recorded user behaviour on my competitor’s websites

#294

Post by sctb »

_bxg1 wrote: post #246
rapind wrote: post #239

Earlier quoted context omitted.

This is the misconception I can't stand. Where we hold individuals responsible for a product / companies defect. I thoroughly disagree with the idea that it's his fault people are vulnerable. So called responsible disclosure is just a marketing spin term. Disclosing bugs privately is a favour not a responsibility. All this does is reduce the risk of bad software decisions. It doesn't solve anything. How about free ma…

This is the most idiotic comment I've ever read on hacker news. "The free market"? What? What does that have to do with anything? Vendors are extremely incentivized to fix bugs and thereby maintain user trust. Google regularly pays out generous bounties for bugs that are reported properly. There are the odd cases where a bug is reported and the company denies it, sits on their hands or threatens the reporter. Those s…

Please don't do this.

https://news.ycombinator.com/newsguidelines.html (see "idiotic")

Re: How I recorded user behaviour on my competitor’s websites

#295

Post by brosirmandude »

markdown wrote: post #104

While we're on this topic, I have a related situation and wonder if my case is common: I built a brochure site for a mom-and-pop business a decade ago. The domain expired some time ago, and it was snapped up by someone who repopulated it with the original content scraped from the Internet Archive. It looks and behaves exactly like it did when I controlled it, except that a phrase in the frontpage content now links to…

Sounds like that old site got bought by someone building a PBN (Private Blog Network).

They buy old domains, get the old content from archive.org, and then add a link in somewhere to their "money" site, or to another site in their tiered linking structure.

It's a BS tactic that can sometimes still work, but it's a LOT of effort to really keep up with it. TBH it's much easier to just actually make a site people want to use and reach out to people who might be interested in sharing it.

Hosting/managing 100's of sites just to prop up 1-2 money sites is too labor & time intensive for most of us. That said, there are some people making good money still using these tactics, as shady as they may be.

Re: How I recorded user behaviour on my competitor’s websites

#296

Post by confiscate »

mrob wrote: post #166
LeoPanthera wrote: post #35

Earlier quoted context omitted.

It's a shame you're being downvoted, you're entirely correct. Most of the modern web is unusable with javascript disabled.

Many modern web pages work better with Javascript disabled now, because it avoids the GDPR/cookie popup spam.

fun fact

Not browsing the web at all, also avoids the GDPR/cookie popup spam.

That solution works 100% of the time. It blocks out 100% of the GDPR popup spam.

Re: How I recorded user behaviour on my competitor’s websites

#297

Post by justwalt »

Ajedi32 wrote: post #248

Surprisingly few comments about the actual attack mechanism here. IMO discussion of whether the author's PoC was ethical is interesting but far less important than the question about how to handle the actual vulnerability; this kind of attack could be used for far more damaging things than just recording user behavior. (Such as phishing.) IMO "get rid of the browser history API" (as the article author recommends) isn…

I think your fourth point is brilliant. You’d instantly gain context just by looking.

Re: How I recorded user behaviour on my competitor’s websites

#298

Post by prepend »

Syzygies wrote: post #133

The big issue here is: Who does our browser work for? People worry that self-driving cars will take us to "promoted" coffee, if we're not specific. More generally, software agents as a rule are loyal to their creators, not to us. That we put up with this is absurd. Browsers should be intelligent agents that are entirely loyal to the person browsing. For example, no site should be able to tell whether we see ads or no…

OSS is our best bet because the users can be the creators. Firefox is a mixed bag on this.

What I want is like the equivalent of fiduciary duty [0] but for AI and software. This is why I don’t like the idea of “free” agents driven by ad revenue.

Currently I have to manually review and build my own stuff. Not sustainable.

[0] https://en.wikipedia.org/wiki/Fiduciary

Re: How I recorded user behaviour on my competitor’s websites

#299

Post by Xeanort »

Ajedi32 wrote: post #248

Surprisingly few comments about the actual attack mechanism here. IMO discussion of whether the author's PoC was ethical is interesting but far less important than the question about how to handle the actual vulnerability; this kind of attack could be used for far more damaging things than just recording user behavior. (Such as phishing.) IMO "get rid of the browser history API" (as the article author recommends) isn…

To make 4. useful, links with the domain different than the open one should not be allowed to be added to History, otherwise you can bypass it with a different domain. And without 4. this new limitation could be bypassed with a redirect (from the same domain).

Re: How I recorded user behaviour on my competitor’s websites

#300

Post by dennisgorelik »

rellui wrote: post #267
wiether wrote: post #73

Earlier quoted context omitted.

Doesn't change the referer but avoid you falling in that current trap. Anyway, using a new tab for each new website you visit is the way to go I think.

Maybe it's a good trade off for this to become default behavior in browsers (in the background unseen by users).

If user does not see that she is operating in a new tab, she can still click "back" and would still be vulnerable to the "Fake Google Serp" trick.
Post reply on HN