Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Second Teleportation

upollo.ai

Post reply on HN
Print view View original

61–70 of 71 posts

Re: 10 Second Teleportation

#61

Post by aaron695 »

jitl wrote: post #16
aaron695 wrote: post #4

I'm missing something > strange devices show up for some of our customers' users > how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? Either - The customer has screwed up user auth big time and some X knows that.... lets go with no - OP's data is wrong or they are reading it wrong - They are explaining it badly.

What's happening is that some MiTM Palo Alto networks system is intercepting the HTML contents of the page, waiting a bit, and then rendering that HTML content again in old Chrome on a separate machine. It's like if you go to a authenticated page that only you can see, like https://news.ycombinator.com/flagged?id=aaron695 , did "View Source", copy-and-paste that source into a HTML file, and then you send me the HTML…

[dead]

Re: 10 Second Teleportation

#62

Post by koliber »

I spoke w. a Palo Alto vendor rep a few months ago. We were talking about the features of the firewall appliance one of my clients was using.

They have a feature that effectively "tests" what the user is about to load in a virtual environment, and sees if that content behaves abnormally. I forgot what they called it. It sounds like this could be it.

Re: 10 Second Teleportation

#63

Post by gsliepen »

caydenm wrote: post #28
dag11 wrote: post #6

Unrelated to the article directly, it's kinda neat that the site's text selection highlight color is randomized on every mousedown.

Josh on our team is so happy people discovered and liked his easter egg!

However, setting the highlight color to pure white in the CSS isn't very nice for people who load the page with JavaScript disabled.

Re: 10 Second Teleportation

#65

Post by internetter »

maxlin wrote: post #60

"Palo Alto Networks" is something that shows up clearer than anything else in my lighttpd logs, as they include the "we're palo alto networks doing research, contact us here(email) for us not to scan" in http request headers. They appear to do full ipv4 range scan many times a day IIRC. Funnily enough I got motivated to try to make my crawler show up the same way in my own server logs by just raw scan breadth, IE by…

> masscan

> This is an Internet-scale port scanner. It can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine.

Absolutely insane

Re: 10 Second Teleportation

#66

Post by [deleted] »

cypherpunks01 wrote: post #11
dag11 wrote: post #6

Unrelated to the article directly, it's kinda neat that the site's text selection highlight color is randomized on every mousedown.

/* Text Higlight Color /**/ :root { --highlight-color: null; } ::selection { background: var(--highlight-color); color:#FFFFFF; } ::-moz-selection { /* Code for Firefox */ color: #FFFFFF; background: var(--highlight-color); } const colors = ["#F76808", "#30A46C", "#0091FF", "#6E56CF", "#E5484D"]; window.addEventListener("mousedown", (e) => { const color = colors.shift(); document.documentElement.style.setProperty("--…

[deleted]

Re: 10 Second Teleportation

#67

Post by Sporktacular »

sandworm101 wrote: post #59
Sporktacular wrote: post #58

Earlier quoted context omitted.

What they choose to investigate is itself revealing. CDNs and large hosting providers for example would be in a position to make inferences by observing and correlating traffic from that origin. I would be trying to obfuscate it using a VPN distributed over a range of countries and IP addresses. That could appear strange to a host, depending on how they implement it.

Except that most open source material is now encrypted. They could see lots of traffic towards Twitter/Facebook/YouTube/google and lots of overseas news sources but would have little insight into actual content.

The NSA doesn't want any of the hundreds of thousands of Twitter/Facebook/YouTube/Google workers to have that insight either. And when the sites they're visiting aren't encrypted they can't browse to it because of OPSEC? That would all be at risk of side channel analysis. They aren't going to leave it chance. Count on them covering their tracks.

Re: 10 Second Teleportation

#68

Post by dredmorbius »

dang wrote: post #36
caydenm wrote: post #19

Earlier quoted context omitted.

I thought I messed it up! I had no idea this was a thing.

You can always edit it after the fact.

Explicit feedback to the submitter that a submission title (or URL) is being modified (e.g., URL canonicalisation, denumeralisation, de-howification) might help ameliorate this issue.

It's bad enough trying to proof my own comments what with being navigated away from that comment (I've a few recent typos caught well outside edit windows which nag on me as I type). Changing submitter's content without notice is ... less than optimal.

I'll note that certain edit features (e.g., year edits) do involve a confirmation, which has in fact proved useful.

Re: 10 Second Teleportation

#69

Post by m463 »

pastage wrote: post #54
m463 wrote: post #44

I remember I worked somewhere where they had something like this. Most people had windows machines, but I had a mac that I had installed. My machine wanted me to accept a client certificate from palo alto networks. I did not and kept refusing. I think they had some sort of intrusive mitm proxy that filtered everything everyone was doing/browsing.

The usual way is to require a custom CA for all clients, sounds like an ineffective setup if you can just ignore it. I.e. it should be a intermediate certificate for the proxy you need to acknowledge.

I believe it was a browser mitm dialog telling me about the untrusted connection and asking if I wanted to accept the certificate.

I suspect most of the other non-dev machines in the building had the ca installed by IT.

Post reply on HN