Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

Post reply on HN
Print view View original

61–70 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#61

Post by tacticalmook »

nimbius wrote: post #9

>By opening a popup window with a custom URL scheme and checking if its document is available from JavaScript code, you can detect if the application is installed on the device. in FF, unless im mistaken this assumes the user clicks anything except cancel on the popup. bug for reference and comment. https://bugzilla.mozilla.org/show_bug.cgi?id=1711084 further from the github: > the basic concept is the same. It works…

> It works by asking the browser to show a confirmation dialog in a popup window. Then the JavaScript code can detect if a popup has just been opened and detect the presence of an application based on that.

> ...

> Tor Browser has confirmation dialogs disabled entirely as a privacy feature, which, ironically, exposed a more damaging vulnerability for this particular exploit. Nothing is shown while the exploit runs in the background, contrasting with other browsers that show pop-ups during the process.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#62

Post by shadowgovt »

johnvaluk wrote: post #55

This appears to depend on user interactivity. How would you silently (and accurately) use this technique to fingerprint a system for cross-browser tracking?

It would be trickier, but it's not as hard as one might want to get a user to click in such a way that the protections in place against automated behaviors can be side-stepped.

I'd bet good money that this trick would be useful for anyone running either a meme generator website or a file host, for example. It'd be pretty solid in the file host in particular, because you could hide some of the obvious weird behavior behind the "We're downloading your file" delay.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#63

Post by elmo2you »

Aside from profiling, can these custom URL handlers also be used as an attack vector on other installed applications?

That is, assuming any of those happens to be installed and have a (input sanitation related) vulnerability.

Maybe I'm just seeing ghosts here. But the idea of a web site pushing malicious links to whatever software may also be installed on the same machine, isn't a very comforting thought.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#64

Post by Ansil849 »

Visiting the demo website in Tor Browser (using the 'Safest' setting), the demo site displays this notice:

> If you're seeing this message, that means JavaScript has been disabled on your browser, please enable JS to make this app work.

Does this mean that the vulnerability does not work in Tor Browser in Safest mode? Or are there non-JS implementations of this vulnerability that would work in a browser with JS disabled?

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#65

Post by shadowgovt »

kurthr wrote: post #24
rozab wrote: post #16

Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing wit…

I find it interesting that it shows I have Skype installed... when I don't.

Do you remember ever having Skype installed? Sibling comments suggest that some apps don't properly clean up their URL handlers when uninstalled.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#66

Post by valve1 »

jraph wrote: post #12

On Linux: - in Firefox, it detected Epic Games Telegram Discord Battle.net Xcode NordVPN Sketch Teamviewer Microsoft Word WhatsApp Postman Adobe Messenger Figma Hotspot Shield ExpressVPN Notion iTunes, none of which I have installed. It didn't detect VSCode though I have VSCodium. - On Chromium, it warned it would not work well on Chrome on Linux. It incorrectly detected all the apps. It seems that the browser would…

Thanks for testing it on Linux. We only tested it on these browser + OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#...

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#67

Post by Ansil849 »

valve1 wrote: post #58
johnvaluk wrote: post #55

This appears to depend on user interactivity. How would you silently (and accurately) use this technique to fingerprint a system for cross-browser tracking?

On Tor we show a fake captcha on the demo, which allows to collect multiple key presses and use each as a user-provided trigger.

This is a really clever way to coerce interactivity!

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#68

Post by sneak »

Dah00n wrote: post #60
sneak wrote: post #42

Earlier quoted context omitted.

Browsing in a VM is really one of the only safe ways to go on the modern web for privacy. So many sites break without JS, and having it enabled is an accident waiting to happen. When you need privacy, always browse in a VM or a Tails boot.

This won't work against fingerprinting unless you change the underlying hardware and / or external IP too when stating a new VM. If you don't have a unique external IP per VM you might as well not bother. It is like trying to hide from the police by changing clothes and cutting your hair but stil hold the same huge sign with your name and address in your hands.

The use of Tor or a public VPN (i.e. many hundreds of unrelated users sharing a single public IP) is implicit.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#69

Post by viseztrance »

gruez wrote: post #56

This seems wildly inaccurate for me. On firefox with resistfingerprinting it says I have 23 of the 24 applications installed (I don't, that's more incorrect than correct), and on tor browser it says 0 applications installed (also incorrect, I have a few installed).

Strange. I have resist fingerprinting as well (running on fedora), and it correctly detected all 5 apps I had installed from the list.
Post reply on HN