Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

671–680 of 786 posts

Re: Firefox 85 cracks down on supercookies

#671

Post by nalekberov »

simias wrote: post #422
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

Well, I agree with you, but to be honest it's not Javascript, it's Web APIs gave a lot opportunities to surveillance capitalists.

But even if you turn off Javascript, you are not invisible or untraceable, you are just getting a little harder to be tracked. I don't wanna name anyone, but there are tons of famous websites that tracks by including tags and referencing pixel trackers.

I usually browse with JS turned off, it's blazingly fast, and, well most websites work without any significant drawbacks.

Re: Firefox 85 cracks down on supercookies

#673

Post by scrollaway »

rrdharan wrote: post #660
scrollaway wrote: post #638

Earlier quoted context omitted.

Typescript has an excellent type system and one of the best development environments the entire dev world can use. You know what ecosystem it's a part of? The JS one. That "entire" one you're talking about has produced superb work such as React, V8, is pretty much responsible for Rust existing, and so on. JS has dumb flaws. It doesn't mean anything is happening "in spite" of it. If anything, innovation is happening t…

> Typescript has an excellent type system It has a type system. "Excellent" feels a bit strong. https://blog.asana.com/2020/01/typescript-quirks/ https://www.executeprogram.com/courses/typescript/lessons/ty...

This feels like complaining about an "excellent" game because you found a couple of bugs in ...

That second article is legitimately cool though.

Re: Firefox 85 cracks down on supercookies

#674

Post by interpol_p »

mleonhard wrote: post #672

This is all pointless without a VPN. Ad company databases map 95% of IP addresses to individuals. You can buy the names, addresses, phone numbers, and email addresses of your website's visitors.

Aren't most people on dynamic IPs? I know my ISP charges an extra $5/month if you want a static IP

Re: Firefox 85 cracks down on supercookies

#675

Post by emptyparadise »

scrollaway wrote: post #586
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

Applications can exist outside of the web too.

Re: Firefox 85 cracks down on supercookies

#676

Post by interpol_p »

hsuduebc2 wrote: post #648
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Ads are frustrating but this can lead to even more irrelevant and therefore more frustrating ads.

I would rather see irrelevant ads because then I am less likely to purchase something online

Re: Firefox 85 cracks down on supercookies

#677

Post by 542458 »

interpol_p wrote: post #674
mleonhard wrote: post #672

This is all pointless without a VPN. Ad company databases map 95% of IP addresses to individuals. You can buy the names, addresses, phone numbers, and email addresses of your website's visitors.

Aren't most people on dynamic IPs? I know my ISP charges an extra $5/month if you want a static IP

I have a dynamic IP and I was curious about how often it changed (I wanted to host some minor stuff out of my house).

So I rolled my own DDNS solution, and have it send me a text every time my IP changes. I have only seen one change in the last six months, and that was when the neighbourhood’s power was cut for two hours for maintenance. Rebooting or temporarily powering off my router doesn’t seem to be enough to force a change on it’s own, I believe it’s only when larger equipment upstream from me powercycles that my IP changes.

So (at least in my experience) the “dynamic-ness” of my home IP is relatively small.

Re: Firefox 85 cracks down on supercookies

#679

Post by krackers »

legym wrote: post #142
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

In Javascript how are they able to retrieve something from the cache? Local, session, and cookies are domain locked.

I think you can just load it in a canvas so long as the image has the appropriate cross origin header [1]. So the entire attack would look like

1. On site A, make a request to eviltracker (e.g. load an image); eviltracker returns an image encoding some unique identifier. Maybe the image request contained some cookie data which the server includes as part of the image.

2. On site B, make another request to evil tracker with the same URL. Browser helpfully notices that the image has been cached, and so site B can access the information contained within that information. In such a manner, information has been transferred from site A to B. You could theoretically repeat this process again: make another non-caching request to eviltracker (maybe with some cookie set to the combined A+B info)

[1] https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabl...

Re: Firefox 85 cracks down on supercookies

#680

Post by scrollaway »

Const-me wrote: post #661
scrollaway wrote: post #586

Earlier quoted context omitted.

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

> It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. I think Basic, Pascal or Python achieved more at that. > it's the only reason many kids can do remote learning as efficiently as they can. The main reason is internets and TCP/IP, that’s essential and irreplaceable. Another important reason is h.264, equivalents do exist, but given the state of…

I've worked with python 17 years. I've taught python, javascript and typescript. There is a universe between how accessible JS is vs Python.

And TCPIP may have helped but just because it's essential part of the stack doesn't mean the remote learning could have happened without JS existing (in the time it did). The web would be a glorified FTP server if some people here had their way.

Post reply on HN