Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

31–40 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#31
post #7

Tried Chrome, Brave and Firefox, got 3 different IDs. On one of the browsers it also didn't detect slack and vscode being installed.

Hi, agilob. I've updated the demo for Chromium and made it work slower, in order to increase accuracy. See also https://news.ycombinator.com/item?id=27147325

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#33
post #16

Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing wit…

worked for me on firefox and tor.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#34
post #9

>By opening a popup window with a custom URL scheme and checking if its document is available from JavaScript code, you can detect if the application is installed on the device. in FF, unless im mistaken this assumes the user clicks anything except cancel on the popup. bug for reference and comment. https://bugzilla.mozilla.org/show_bug.cgi?id=1711084 further from the github: > the basic concept is the same. It works…

Basically browsers have the "I open a popup to ask" or "the user has no schema handler for that schema so I don't need to ask" or the "User already confirmed it always should open the link with given application" behaviour and they can detect it "somehow "? But I still have to look closer into it.

Browsers open pop-ups to ask "Can I run that application?" but only if that application is installed. If that application is not installed, the browser will ignore the custom URL.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#36
Finding new a fingerprinting mechanism in JavaScript is like finding a new memory corruption bug in the web browser engine.

They are always going to exist for architectural reasons, some are worse than others, and the really bad ones are likely kept nice and secret while they are actively exploited. In other words, I'm not surprised in the slightest, but I'm glad that this is out in the open now.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#38
post #17
post #16

Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing wit…

It seems that it's not very effective in Linux.

Yeah, we tested it on MacOS Big Sur mostly. Nobody on the team had linux so we didn't really test there. It can be made to work with better timings for the measurements etc.
Post reply on HN