9 ms·

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window m

by 21 11y ago

What's the reason for allowing web pages to get absolute screen coordinates? This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

nxzero 11y ago
Right, never max out your window, it's a known data leak used to fingerprint users.
- gnur 11y ago
  I'd say that maximizing is more general then having a custom sized window. There are only so many resolutions in use (and I would guess 50%+ is either hd, full hd or qhd). Resizing your windows yield nearly unlimited options for browser sizes.
  - Retric 11y ago
    It's a question of consistency. A few version numbers + window sizes are going to stay the same every visit. It only takes 33 bits of information to uniquely identify everyone on the planet and you likely can get more than 1 from a maximized window.
- aidenn0 11y ago
  You can get screen resolution from JS, so I don't see how maxing out the window makes any difference.
  - detaro 11y ago
    A screen resolution is less unique than the size of a maximized window.
    - samirm 11y ago
      How so? Wouldn't there just be a one to one mapping between resolution and maximized windows size? The only way to prevent this is to not maximize windows and instead have custom sized ones, but that just makes identifying you even easier.
      - detaro 11y ago
        The laptop I'm using right now has a 1366x768 screen, a maximized browser window is 1306x768. I bet many other users of of that size are going to have browser windows that have the full 1366 px width, but then some height <768 px. Details depend on the OS, the size and position of the taskbar/dock/whatever, ... It's not much, but it adds a bit or two of data. Custom sized ones make you easier to identify only if you don't change them.
sleepychu 11y ago
How do you know the coordinates are absolute? It seems like the child windows are 'special', perhaps the web page can obtain the relative coordinates of these child panels?
- Cpoll 11y ago
  It's using window.screenY (and screenX, of course,) which gives absolute coordinates. https://developer.mozilla.org/en-US/docs/Web/API/Window/screenY https://developer.mozilla.org/en-US/docs/Web/API/Window/scre... I don't think the method you're describing exists. If you want child coordinates relative to parent coordinates, you would use both the parent and child's absolute coordinates.
  - sleepychu 11y ago
    Thanks to you (and others who've provided this information), so I guess my question now is what is the privacy leak described. I understand that the browser is confessing information about the machine to the web page but I don't understand why that represents a private piece of information. I feel like the information about where the window is located on the screen is useful for implementation and I can't think what it says about me as a user.
    - nommm-nommm 11y ago
      Nothing on its own. However it is one of the pieces of information used to create a unique fingerprint for your browser which can be used to track you as you travel across the web. IIRC Tor browser recommends never resizing the window from the browser's default window size.
    - softawre 11y ago
      https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2
- 21 11y ago
  Go to https://jsfiddle.net/hj697tbg/ https://jsfiddle.net/hj697tbg/ and move the window around for a demo.
phkahler 11y ago
>> What's the reason for allowing web pages to get absolute screen coordinates? Web developers have always pushed for more access to information about the user and their environment. Browser and tool developers are happy to provide that access. There's always some use case that sounds reasonable, but you're right that it's just a security issue waiting to happen. These holes are also being talked about in the new Wayland display server on Linux. Warping a mouse pointer, color picking, knowing your apps place on the desktop are all security violations. They are being very careful with that stuff because it's an insecure free for all with X. Every time I upload an attachment to gmail or a picture to facebook, I wonder how secure things are. Those seem to require user action, but do they really?
- TeMPOraL 11y ago
  > Web developers have always pushed for more access to information about the user and their environment. Browser and tool developers are happy to provide that access. There's always some use case that sounds reasonable, but you're right that it's just a security issue waiting to happen. I'm torn. On the one hand I understand the privacy implications; on the other hand, if you'd want to be serious about those, you'd have to get rid of JavaScript and half of CSS. Every interesting feature can be turned into a privacy/security violation; how far are we willing to go in removing them?
- digi_owl 11y ago
  > These holes are also being talked about in the new Wayland display server on Linux. Warping a mouse pointer, color picking, knowing your apps place on the desktop are all security violations. They are being very careful with that stuff because it's an insecure free for all with X. I know the quip about how in IT paranoia is not a sickness but a job requirement, but damn it... As for web developers pushing for more information. No surprises there, its so they can more precisely fine tune the layout of the "app" (notice how they refer to what used to be called a site with a term that used to denote something running locally). That it also can be used to fingerprint the computer, and by extension the user, is a side effect, not a goal.
vesinisa 11y ago
Just use NoScript if you are concerned. JavaScript allows a large number of other ways to identify you as well. Direct ways of course include cookies / local storage / Web SQL, but other indirect ways include localization preferences, OS / browser / plugin / extension fingerprinting, HID inputs, side channel profiling etc. etc. – some combination of these allows uniquely identifying at least 80% of web users.[1][2][3] Allowing a site to execute JS in your browser is equal to trusting them, like it or not, and browser vendors are definitely in the business of adding new APIs rather than reducing attack surfaces. [1]: https://wiki.mozilla.org/Fingerprinting https://wiki.mozilla.org/Fingerprinting [2]: https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2 [3]: http://noc.to/ http://noc.to/
- ErikRogneby 11y ago
  Might as well say don't use the web. Disabling javascript will break most sites with a few rare exceptions. (like HN)
  - anc84 11y ago
    It's actually quite the opposite. Most sites will become lightning fast and distraction free.
    - beeboop 11y ago
      I have use NoScript consistently for years and I disagree with you. Essentially the only thing NoScript does is make it so when you haven't visited a website before, it doesn't automatically trust it. For the most part every single website I go to needs to have JS enabled for anything to work beyond just reading content. And even then, I would say 70% of the time, some critical piece of content on a website does not work with JS disabled, be it images or text or video or etc.
      - danielweber 11y ago
        And then starts the crazy hunt for the one thing you need to turn on to make the page work. I was trying many years ago to create a public DB/wiki telling us which things we need to turn on to get the page to work, but it got abandoned before I really started.
TazeTSchnitzel 11y ago
> What's the reason for allowing web pages to get absolute screen coordinates? Back in the 90's, Microsoft and Netscape were all too happy to give JS developers the world with almost no regard for security consequences. We've spent the last 20 years trying to fix their mistakes.
- neerdowell 11y ago
  We only spent 15 years trying to fix the mistakes. The last 5 have been spent repeating them.
  - TazeTSchnitzel 11y ago
    On the contrary, I would argue that most new web platform features have been designed with more thought for security. We generally ask for user permission first before divulging data, for example. Some new features help mitigate past mistakes, too, like Content Security Policies.
- goblinking 11y ago
  are you SURE? because WebUSB and other abomination are a rising tide of diarrhea
zbjornson 11y ago
I've used it to automatically position auxillary windows adjacent to the main window in a data analysis application. I don't see how it reveals anything private about the user... my screen resolution and window location are not secrets to me.
- catmanjan 11y ago
  But they may be unique to you, making you more identifiable/trackable. The TOR browser warns you when resizing the window that it reduces privacy. Personally I don't care either, just thought you might want to know!
  - hashmymustache 11y ago
    But just because it's unique, why does it make it trackable? The overwhelming majority of devices have one of a few common display resolutions, so what's there to link across sessions for identifying users?
    - zodPod 11y ago
      The idea is not that your resolution is unique it's that the maximized window size is unique. They can then track that you have more than one monitor, what size that monitor is, and, probably with some easy math, a jist of how many you have. That setup is probably a lot more unique than expected. That plus possibly some canvas finger printing or something similar could probably keep pretty good tabs on you. I have 3 identical 21 inch monitors and I'm browsing on the left-most monitor. Anyone else have that same setup?
empath75 11y ago
Just out of curiosity, what can someone do with this information?
- nommm-nommm 11y ago
  Create a unique fingerprint for your browser used to track you through the web.
- startling 11y ago
  Correlate your visits across unrelated websites.

by 21 11y ago

nxzero 11y ago

Right, never max out your window, it's a known data leak used to fingerprint users.

gnur 11y ago
I'd say that maximizing is more general then having a custom sized window. There are only so many resolutions in use (and I would guess 50%+ is either hd, full hd or qhd). Resizing your windows yield nearly unlimited options for browser sizes.
- Retric 11y ago
  It's a question of consistency. A few version numbers + window sizes are going to stay the same every visit. It only takes 33 bits of information to uniquely identify everyone on the planet and you likely can get more than 1 from a maximized window.
aidenn0 11y ago
You can get screen resolution from JS, so I don't see how maxing out the window makes any difference.
- detaro 11y ago
  A screen resolution is less unique than the size of a maximized window.
  - samirm 11y ago
    How so? Wouldn't there just be a one to one mapping between resolution and maximized windows size? The only way to prevent this is to not maximize windows and instead have custom sized ones, but that just makes identifying you even easier.
    - detaro 11y ago
      The laptop I'm using right now has a 1366x768 screen, a maximized browser window is 1306x768. I bet many other users of of that size are going to have browser windows that have the full 1366 px width, but then some height <768 px. Details depend on the OS, the size and position of the taskbar/dock/whatever, ... It's not much, but it adds a bit or two of data. Custom sized ones make you easier to identify only if you don't change them.

sleepychu 11y ago

How do you know the coordinates are absolute? It seems like the child windows are 'special', perhaps the web page can obtain the relative coordinates of these child panels?

Cpoll 11y ago
It's using window.screenY (and screenX, of course,) which gives absolute coordinates. https://developer.mozilla.org/en-US/docs/Web/API/Window/screenY https://developer.mozilla.org/en-US/docs/Web/API/Window/scre... I don't think the method you're describing exists. If you want child coordinates relative to parent coordinates, you would use both the parent and child's absolute coordinates.
- sleepychu 11y ago
  Thanks to you (and others who've provided this information), so I guess my question now is what is the privacy leak described. I understand that the browser is confessing information about the machine to the web page but I don't understand why that represents a private piece of information. I feel like the information about where the window is located on the screen is useful for implementation and I can't think what it says about me as a user.
  - nommm-nommm 11y ago
    Nothing on its own. However it is one of the pieces of information used to create a unique fingerprint for your browser which can be used to track you as you travel across the web. IIRC Tor browser recommends never resizing the window from the browser's default window size.
  - softawre 11y ago
    https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2
21 11y ago
Go to https://jsfiddle.net/hj697tbg/ https://jsfiddle.net/hj697tbg/ and move the window around for a demo.

phkahler 11y ago

>> What's the reason for allowing web pages to get absolute screen coordinates? Web developers have always pushed for more access to information about the user and their environment. Browser and tool developers are happy to provide that access. There's always some use case that sounds reasonable, but you're right that it's just a security issue waiting to happen. These holes are also being talked about in the new Wayland display server on Linux. Warping a mouse pointer, color picking, knowing your apps place on the desktop are all security violations. They are being very careful with that stuff because it's an insecure free for all with X. Every time I upload an attachment to gmail or a picture to facebook, I wonder how secure things are. Those seem to require user action, but do they really?

TeMPOraL 11y ago
> Web developers have always pushed for more access to information about the user and their environment. Browser and tool developers are happy to provide that access. There's always some use case that sounds reasonable, but you're right that it's just a security issue waiting to happen. I'm torn. On the one hand I understand the privacy implications; on the other hand, if you'd want to be serious about those, you'd have to get rid of JavaScript and half of CSS. Every interesting feature can be turned into a privacy/security violation; how far are we willing to go in removing them?
digi_owl 11y ago
> These holes are also being talked about in the new Wayland display server on Linux. Warping a mouse pointer, color picking, knowing your apps place on the desktop are all security violations. They are being very careful with that stuff because it's an insecure free for all with X. I know the quip about how in IT paranoia is not a sickness but a job requirement, but damn it... As for web developers pushing for more information. No surprises there, its so they can more precisely fine tune the layout of the "app" (notice how they refer to what used to be called a site with a term that used to denote something running locally). That it also can be used to fingerprint the computer, and by extension the user, is a side effect, not a goal.

vesinisa 11y ago

Just use NoScript if you are concerned. JavaScript allows a large number of other ways to identify you as well. Direct ways of course include cookies / local storage / Web SQL, but other indirect ways include localization preferences, OS / browser / plugin / extension fingerprinting, HID inputs, side channel profiling etc. etc. – some combination of these allows uniquely identifying at least 80% of web users.[1][2][3] Allowing a site to execute JS in your browser is equal to trusting them, like it or not, and browser vendors are definitely in the business of adding new APIs rather than reducing attack surfaces. [1]: https://wiki.mozilla.org/Fingerprinting https://wiki.mozilla.org/Fingerprinting [2]: https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2 [3]: http://noc.to/ http://noc.to/

ErikRogneby 11y ago
Might as well say don't use the web. Disabling javascript will break most sites with a few rare exceptions. (like HN)
- anc84 11y ago
  It's actually quite the opposite. Most sites will become lightning fast and distraction free.
  - beeboop 11y ago
    I have use NoScript consistently for years and I disagree with you. Essentially the only thing NoScript does is make it so when you haven't visited a website before, it doesn't automatically trust it. For the most part every single website I go to needs to have JS enabled for anything to work beyond just reading content. And even then, I would say 70% of the time, some critical piece of content on a website does not work with JS disabled, be it images or text or video or etc.
    - danielweber 11y ago
      And then starts the crazy hunt for the one thing you need to turn on to make the page work. I was trying many years ago to create a public DB/wiki telling us which things we need to turn on to get the page to work, but it got abandoned before I really started.

TazeTSchnitzel 11y ago

> What's the reason for allowing web pages to get absolute screen coordinates? Back in the 90's, Microsoft and Netscape were all too happy to give JS developers the world with almost no regard for security consequences. We've spent the last 20 years trying to fix their mistakes.

neerdowell 11y ago
We only spent 15 years trying to fix the mistakes. The last 5 have been spent repeating them.
- TazeTSchnitzel 11y ago
  On the contrary, I would argue that most new web platform features have been designed with more thought for security. We generally ask for user permission first before divulging data, for example. Some new features help mitigate past mistakes, too, like Content Security Policies.
goblinking 11y ago
are you SURE? because WebUSB and other abomination are a rising tide of diarrhea

zbjornson 11y ago

I've used it to automatically position auxillary windows adjacent to the main window in a data analysis application. I don't see how it reveals anything private about the user... my screen resolution and window location are not secrets to me.

catmanjan 11y ago
But they may be unique to you, making you more identifiable/trackable. The TOR browser warns you when resizing the window that it reduces privacy. Personally I don't care either, just thought you might want to know!
- hashmymustache 11y ago
  But just because it's unique, why does it make it trackable? The overwhelming majority of devices have one of a few common display resolutions, so what's there to link across sessions for identifying users?
  - zodPod 11y ago
    The idea is not that your resolution is unique it's that the maximized window size is unique. They can then track that you have more than one monitor, what size that monitor is, and, probably with some easy math, a jist of how many you have. That setup is probably a lot more unique than expected. That plus possibly some canvas finger printing or something similar could probably keep pretty good tabs on you. I have 3 identical 21 inch monitors and I'm browsing on the left-most monitor. Anyone else have that same setup?

empath75 11y ago

Just out of curiosity, what can someone do with this information?

nommm-nommm 11y ago
Create a unique fingerprint for your browser used to track you through the web.
startling 11y ago
Correlate your visits across unrelated websites.