Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Covert web-to-app tracking via localhost on Android

localmess.github.io

Post reply on HN
Print view View original

291–300 of 356 posts

Re: Covert web-to-app tracking via localhost on Android

#291

Post by b0a04gl »

webrtc was supposed to be for real-time comms, not fingerprinting people based on what random apps they have running on localhost. the fact that a browser sandbox still leaks this info is wild. like, you’re telling me port 43800 says more about me than a cookie ever could? and of course, this all runs under the radar—no prompt, no opt-in, just “oh hey, we’re just scanning your machine real quick.” insane. might as well call it metascan™.

kinda makes me nostalgic for simpler times—when tracking meant throwing 200 trackers into a tag and hoping one stuck. now it’s full-on black ops.

i swear, i’m two updates away from running every browser in a docker container inside a faraday cage.

Re: Covert web-to-app tracking via localhost on Android

#292

Post by xmodem »

iforgotpassword wrote: post #280
n_plus_1_acc wrote: post #269

Earlier quoted context omitted.

What about "This website would like to connect to the Instagram App and may share your browsing history and other personal details."

Why should that message show up when I'm trying to make a video call in my browser? I'm just trying to call my nephew.

There are already permissions dialogs for using the camera/microphone. I don't think it'd be absurd to implicitly grant WebRTC permissions alongside that.

Re: Covert web-to-app tracking via localhost on Android

#293

Post by Doxin »

gbalduzzi wrote: post #288
nedt wrote: post #287

Earlier quoted context omitted.

It's already enough to just have plain ads. Like we have them on the streets, at the bus station, newspapers, etc. No tracking needed at all, just give out the message. If you need to target people to it in the context of the place or content you are showing it with. But you don't need to know anything about the user seeing the ad. Targeting by user doesn't work anyway.

> Targeting by user doesn't work anyway. How did you reach this conclusion? The main problem is that it works way better than traditional marketing medium. It's the reason Google and Facebook are so massive, why would publishers choose to pay them if it doesn't work?

> why would publishers choose to pay them if it doesn't work?

Because they believe it works and it's impossible to prove otherwise?

Re: Covert web-to-app tracking via localhost on Android

#296

Post by Vinnl »

selcuka wrote: post #261
afavour wrote: post #237

Earlier quoted context omitted.

Because users understand what “microphone access” entails. “Use WebRTC?” means nothing to the average user.

Fair point, but "cookies" didn't mean anything to the average user either, and "cookie consent" banners are the norm now.

I think very few people would argue that cookie consent banners in the form in which they are the norm are a good thing just like permission prompts for microphone access are.

Re: Covert web-to-app tracking via localhost on Android

#297

Post by Vinnl »

b0a04gl wrote: post #291

webrtc was supposed to be for real-time comms, not fingerprinting people based on what random apps they have running on localhost. the fact that a browser sandbox still leaks this info is wild. like, you’re telling me port 43800 says more about me than a cookie ever could? and of course, this all runs under the radar—no prompt, no opt-in, just “oh hey, we’re just scanning your machine real quick.” insane. might as we…

Well, primarily it's the other apps that are saying a lot about you. I think this story emphasises yet again that websites are better for your privacy than apps. (Especially in a browser that has e.g. uBlock Origin, such as Firefox for Android.)

Re: Covert web-to-app tracking via localhost on Android

#298

Post by spencerflem »

b0a04gl wrote: post #291

webrtc was supposed to be for real-time comms, not fingerprinting people based on what random apps they have running on localhost. the fact that a browser sandbox still leaks this info is wild. like, you’re telling me port 43800 says more about me than a cookie ever could? and of course, this all runs under the radar—no prompt, no opt-in, just “oh hey, we’re just scanning your machine real quick.” insane. might as we…

The person working on Arcan runs the browser on a separate machine via Remote Desktop with it set to wipe and re-image itself between sessions.

Re: Covert web-to-app tracking via localhost on Android

#299

Post by owebmaster »

b0a04gl wrote: post #291

webrtc was supposed to be for real-time comms, not fingerprinting people based on what random apps they have running on localhost. the fact that a browser sandbox still leaks this info is wild. like, you’re telling me port 43800 says more about me than a cookie ever could? and of course, this all runs under the radar—no prompt, no opt-in, just “oh hey, we’re just scanning your machine real quick.” insane. might as we…

> webrtc was supposed to be for real-time comms, not fingerprinting people based on what random apps they have running on localhost

Native Apps are doing that, not webrtc. Just prove the web is safer and all that BS about native apps being better is, well, BS.

Post reply on HN