Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

fingerprintjs.com

Post reply on HN
Print view View original

71–80 of 213 posts

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#71

Post by kdarutkin »

I’m the author.

The accuracy can be low because of:

- Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable.

- Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware.

- Fullscreen mode - The demo will work faster and more accurate if the browser is not in a fullscreen mode

- Slow internet connection

- Gestures during the process

Also, we haven’t looked into Opera yet, but we may if you ask to do it.

For the technical questions or bug reports consider using Github Issues

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#72

Post by tick_tock_tick »

wnevets wrote: post #41
valve1 wrote: post #39

Earlier quoted context omitted.

Windows can sometimes say you have Skype, because it comes bundled even if you didn't install it yourself.

I've explicitly uninstalled it on Windows 10, maybe Windows is still reporting it?

Windows 10 does some garbage where it installs handlers for URL schemas that take you to the windows store install page for the app. The vulnerability is only testing if you have an handler installed for skype:// not what application is actually handling it.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#73

Post by kjrose »

As a note, this doesn't seem to work with Brave. It only got one of the applications my machine has installed, and I don't have a slow machine nor a slow internet where I am.

I'm a bit surprised it got even one of them though. I will need to review my Brave privacy settings and see if anything can be done.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#75

Post by johnvaluk »

valve1 wrote: post #58
johnvaluk wrote: post #55

This appears to depend on user interactivity. How would you silently (and accurately) use this technique to fingerprint a system for cross-browser tracking?

On Tor we show a fake captcha on the demo, which allows to collect multiple key presses and use each as a user-provided trigger.

Does that bypass any alerts that would be presented to the user by the browser?

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#76

Post by valve1 »

dathinab wrote: post #52
buggeryorkshire wrote: post #22

Earlier quoted context omitted.

Yeah makes sense if it's the schema handlers. I'd just not be as assertive if I was them that something was installed if there was overlap.

It also doesn't work at all under Chromium for Linux no idea why but the result is complete garbage.

yeah, chrome/chromium on linux not tested at all, mostly because nobody on the team is using linux. We tested it on MacOS Big Sur and a bit of Windows. Full table of what was tested here: https://github.com/fingerprintjs/external-protocol-flooding#... dathinab

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#77

Post by kdarutkin »

kdarutkin wrote: post #71

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a ful…

I also made a special branch for Chromium (Chrome, Brave, Edge, etc.) that works much slower, but should be more accurate.

It still may not work for your browser with a custom configuration. Also, it is better not to make any gestures during the process.

https://github.com/fingerprintjs/external-protocol-flooding/...

https://609d9f4d79c4f6000700782c--boring-visvesvaraya-dbefd4...

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#78

Post by pier25 »

kjrose wrote: post #73

As a note, this doesn't seem to work with Brave. It only got one of the applications my machine has installed, and I don't have a slow machine nor a slow internet where I am. I'm a bit surprised it got even one of them though. I will need to review my Brave privacy settings and see if anything can be done.

I just tried it with the latest version of Brave and it found: Skype, Zoom, VSCode, Adobe, and iTunes.

This only checks 24 apps, and it got all the ones I have installed out of those 24.

Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

#79

Post by chmod775 »

nimbius wrote: post #9

>By opening a popup window with a custom URL scheme and checking if its document is available from JavaScript code, you can detect if the application is installed on the device. in FF, unless im mistaken this assumes the user clicks anything except cancel on the popup. bug for reference and comment. https://bugzilla.mozilla.org/show_bug.cgi?id=1711084 further from the github: > the basic concept is the same. It works…

> in FF, unless im mistaken this assumes the user clicks anything except cancel on the popup. bug for reference and comment.

I'm on Firefox and didn't have to click anything. It correctly detected I have Steam installed.

The flashing popup window was quite obvious though.

Post reply on HN