Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 204 posts

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#41

Post by zamadatix »

djbusby wrote: post #32

When you open devtools, by default it will try to load source code maps for your JS and CSS. Very simple for a system to detect the request for the map file. If that's their vector turn off the autoloader and try from a clean IP.

Interesting to note. In Firefox "show original sources" seems to be enabled by default but in Chrome at least the settings checkbox is labeled "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons" and unchecked for me. Haven't checked Safari to see what its behavior is.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#42

Post by rezonant »

ars wrote: post #13

How can they tell that you opened dev tools?

As others have mentioned, you can simply put in a sourcemap entry in your JS, and when the browser requests that URL (which happens when Devtools opens to prepare for showing original sources), ban the IP.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#43

Post by doubleorseven »

ars wrote: post #13

How can they tell that you opened dev tools?

You create this pseudo function:

1. setTimeout to call an endpoint that will block your ip. It's set to run in 2 seconds from now. 2. Insert: debugger; 3. Clear the timeout.

Now you run this function as an interval. If the devtools is closed, debugger will be ignored and the call to this endpoint will never happen. But if it's open, the debugger will stop and the timeout will fire. Not sure if you need to patch SetTimeout to continue running while you stop but I hope you get the general idea

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#44

Post by runlevel1 »

Overview of techniques used to detect/block dev tools and some ways to circumvent them (2021): https://www.usenix.org/system/files/sec21-musch.pdf

If that's actually what's happened here, that's a real dick move.

Disclosure: I formerly worked at SendGrid

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#46

Post by birdman3131 »

arbol wrote: post #39
xnx wrote: post #33

Earlier quoted context omitted.

I believe there are multiple techniques. One of them is detecting an abrupt decrease in the viewport size.

So ctrl/CMD left/right to move your window to one half of the screen might block you!? XD

People elsewhere in the thread seemed to imply that if Viewport size != window size dev tools is likely opened.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#47

Post by runlevel1 »

Boltgolt wrote: post #35
Workaccount2 wrote: post #20

Earlier quoted context omitted.

Is there an extension or workaround that prevents sites from knowing you opened devtools (without breaking everything else on the site)?

Disabling javascript breakpoints usually does the trick. Devtools detection is often done by having a `debugger;` statement somewhere and timing of it triggered

A lot of them dynamically generate new anonymous functions to get around this. Last I looked (~1 year ago I think) neither Chrome nor Firefox supported disabling the keyword completely. Do you know if that's changed?

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#49

Post by aendruk »

Reminds me of my experiences with UnitedHealthcare’s website. If I try to log in with Firefox + uBO I get mysterious permissions errors and “something went wrong” messages for the next few hours, even after switching browsers. Use Chromium from the beginning though and it’s smooth sailing. And of course their “tech” support is beyond useless about this.
Post reply on HN