11 ms·

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover track

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most) If you're concerned as a site owner that allows third party CSS: * You should have stopped allowing this a long time ago (good on you, Reddit [0] though things like this weren't one of the stated reasons) * You have your Content-Security-Policy header set anyways, right? Really though, is there an extension that has a checkbox that says "no interactive CSS URLs"? I might make one, though still figuring out how I might detect/squash such a thing. EDIT: I figure just blocking url() for content and @font-face.src would be a good compromise not to break all sorts of background images for now. 0 - https://www.reddit.com/r/modnews/comments/66q4is/the_web_redesign_css_and_mod_tools/ https://www.reddit.com/r/modnews/comments/66q4is/the_web_red...

gsnedders 9y ago
> * Media query - So what, user agent gives this away mostly anyways It doesn't; without media queries you can't detect thing like browser window size or screen pixel density. > * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most) There's a lot of trade-offs here. Plenty of people have fonts installed for various reasons (some because none of the system fonts cover a script they want, some because they're using fonts designed to mitigate some issues caused by dyslexia, etc.), and breaking it for those people would not be good.
- kodablah 9y ago
  > It doesn't; without media queries you can't detect thing like browser window size or screen pixel density. Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess. > There's a lot of trade-offs here [...] I'll take it as an option to have a strict subset (though would prefer it as opt-out to discourage font-list-based fingerprinting as a practice, though metric-based may never leave). With downloadable fonts, I don't really like the "script they want" excuse. For accessibility reasons, I am admittedly naive, but I would assume it would be a substitute for an existing font name. Unique font names per user seem unnecessary.
  - talmand 9y ago
    >> Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess. >> Unique font names per user seem unnecessary. As a dev that has worked in CSS for over a decade, I have no idea what either of those mean. EDIT: I see the unique font names part now, totally missed that while focusing on the other parts.
    - kodablah 9y ago
      By "CSS property queries" I mean the technique in TFA using @supports + before/after-content URLs to query whether certain CSS properties are supported.
      - talmand 9y ago
        I see my problem now, I don't see @supports as a query like in terms of media queries.
- mrob 9y ago
  If somebody has fonts installed for specific reasons then presumably they don't want web pages changing them. Web pages shouldn't need any more control than selecting from "serif", "sans-serif", or "monospace". The most legible font is the font you're most familiar with. I don't want web pages to use different fonts just because some marketing drone thought it was good for branding. It's disappointing that we allowed websites to abuse fonts for vector icons.
  - kmbriedis 9y ago
    Have you heard a term 'design'? + sometimes you can't adjust the website to work well with all (or even the popular ones) sans-serif fonts
    - goialoq 9y ago
      Give one example where users benefit from the website forcing a special font. And even if that happens, the website can provide the font to the user. None of this requires the user telling the website host which fonts are installed.
rcxdude 9y ago
In the case of reddit, the custom CSS could not reference off-reddit resources (images were uploaded), so this technique would not work.
- spladug 9y ago
  Yup! And this sort of tracking is exactly why. https://github.com/reddit/reddit/blob/master/r2/r2/lib/cssfilter.py#L24-L29 https://github.com/reddit/reddit/blob/master/r2/r2/lib/cssfi... https://www.reddit.com/r/cssnews/comments/24anzb/css_change_the_filter_has_been_rewritten/ https://www.reddit.com/r/cssnews/comments/24anzb/css_change_...
oneeyedpigeon 9y ago
> not an easy fix All of this is an easy fix: disable css. In the same way that "I don't want to be tracked by javascript" can easily be resolved by disabling javascript. I'm not seriously suggesting everyone does that, but anyone who is so paranoid that they don't want a site knowing that they're reading its content might want to consider it.
- kodablah 9y ago
  While we, as devs, may get tired of the constant beat-down between site flexibility and privacy, many of our users are unaware. They will go blindly towards flexibility and we have a duty to find as much compromise as possible between those two values lest we just say "it's an easy fix, just turn off your computer". There has to be a middle ground between extremely paranoid turn everything off and extremely liberal with my anonymity (and on the internet, it's not governments who are going to help find it).
  - oneeyedpigeon 9y ago
    I guess my point is "how much anonymity is it reasonable to expect?" Should I have a problem with the fact that nigh-on every URL in the world will leave behind a little footprint when I request it? I don't see an enormous problem with a website anonymously recording the fact that I've clicked a link. ("anonymously" assuming I'm blocking their cookies, which I would if I were that paranoid)
    - philliphaydon 9y ago
      I don’t mind sites tracking to know what products sell and what doesn’t, what browsers people use or how Long I spend on the site etc. What I hate, is the fact that I go to agoda, I search for hotels in jiufen in taiwan, I look at only 2, I book one of the 2, I close it. Open up Facebook on my phone seconds later and have adverts saying: hey how about these 2 hotels in jiufen. That shit annoys me. Stop following me and tracking what I’m doing and sharing it with all these companies. It makes me want to not use the internet...
    - 9y ago
deleted 9y ago
[deleted]
zerokernel 9y ago
> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0 Mobile/14G60 Safari/602.1 Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/604.4.7 (KHTML, like Gecko) iOS/16.0.7.121031 Mobile/15C153 Safari/9537.53 Mozilla/5.0 (Linux; Android 7.0; LG-H840 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36 A Linux in comparison: Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0 While it includes the version number, no patch level (57.0.X) is included.
- gruez 9y ago
  Firefox on the other hand, discloses very little, even on mobile: Mozilla/5.0 (Android 4.4; Mobile; rv:41.0) Gecko/41.0 Firefox/41.0
- sorenjan 9y ago
  The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.
  - yoodenvranx 9y ago
    > why should any website know all that? As a developer: Without user agent: How would I easily detect which browser breaks a certain feature on my project? If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it. If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know which browser is responsible for this.
dahart 9y ago
> If you're concerned as a user of a malicious site Or if you're concerned as a user of a regular "safe" site... Google Analytics does all of these things: link tracking, hover tracking, media query tracking. GA or something like it is being used by vast swaths of the web. I don't claim it's the majority, because I don't know, but that's what I assume, that all sites are tracking (whether or not the site even knows it.)
- _jal 9y ago
  Right, which is why GA is not allowed to load in my browsers. This is a different avenue for disclosure of a similar bundle of info.
  - r3bl 9y ago
    Just curious: Are you okay if it's something self-hosted (like Piwik) doing the same kind of tracking? In other words: Do you not want a third party (like Google) to have that data or the second party (web administrators)?
    - unethical_ban 9y ago
      IMHO I think they are different. So much of what makes the web and surveillance creepy is the ability to correlate across data sources. CCTV isn't creepy for one store owner to have - it's bad when the government has it everywhere. It's not bad for people to analyze how users interact with their site. It's bad when one entity (or a handful) can track you across the Internet. So in other words, I don't mind Piwik and have considered sending in a patch to uBlock and others with a switch to disabled "locally hosted analytics" or something similar. Like the drive to push "ethical advertising", I think it's reasonable to permit some benign tracking as a way to coerce more sites into decentralizing user analytics.
    - _jal 9y ago
      I'm fine with with self-hosted analytics, and use a log analyzer myself. My primary objection is automated profile-generation and identifier sharing - third parties don't need realtime updates on my reading habits. I like to think folks who run their own analytics aren't sharing identifiers with adtech shops, but of course can't know.
Daycrawler 9y ago
> So what, the site could route you through a server side proxy anyways There's little interest in proxying through a token system (this would require a DB read at each click, and a DB write at each page generation), which means the actual link is available client-side and the whole thing can be bypassed.
- bastawhiz 9y ago
  Most implementations that I've seen, including Google's, just put the linked URL in the query params of the redirect endpoint URL. '/redirect?url=...'
- AgentME 9y ago
  It's easy to design a system like this where the actual link isn't available client-side, and the server doesn't need to wait on a DB read and write before responding to the client: make the URL parameter be the destination URL encrypted so that only the server can read it. That kills the need for a DB read. Then the server can respond to the request before the DB write finishes since the integrity/consistency of that write is likely less critical than the response time.
  - Daycrawler 9y ago
    That's correct.
MamboJ 9y ago
Wouldn't the Tor browser solve most of these issues?
rollcat 9y ago
> * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most) Oh my. I wish this madness ended. Quoth tedu: > I don’t know a whole lot about typography and fonts, but there’s two things I know about font files. They’re ridiculously complex and their parsers have only just begun to experience life with hostile inputs. In short, I’d put fonts second on my list of files likely to pwn your browser, after Flash [...].
- jandrese 9y ago
  I've thought for some time that the only reason people have not exploited fonts to take over browsers is because even hackers don't understand how they work.
- bzbarsky 9y ago
  Note that browsers pass downloadable fonts through a sanitizer before they even consider handing them off to anything else that might need to parse the font. And browser security teams have spent years now fuzzing both those sanitizers and various font libraries... There's still a lot of attack surface here, but "only just begun to experience life with hostile inputs" isn't quite true either.
8note 9y ago
link 0 is inaccurate. Reddit retracted that statement on CSS, saying mod created styles will stick around.
jrochkind1 9y ago
Sure. I think it's mainly interesting in that CSS injection vulnerability can turn into tracking. it never occurred to me that a CSS injection vulnerability could do anything actionable before.

gsnedders 9y ago

> * Media query - So what, user agent gives this away mostly anyways It doesn't; without media queries you can't detect thing like browser window size or screen pixel density. > * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most) There's a lot of trade-offs here. Plenty of people have fonts installed for various reasons (some because none of the system fonts cover a script they want, some because they're using fonts designed to mitigate some issues caused by dyslexia, etc.), and breaking it for those people would not be good.

kodablah 9y ago
> It doesn't; without media queries you can't detect thing like browser window size or screen pixel density. Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess. > There's a lot of trade-offs here [...] I'll take it as an option to have a strict subset (though would prefer it as opt-out to discourage font-list-based fingerprinting as a practice, though metric-based may never leave). With downloadable fonts, I don't really like the "script they want" excuse. For accessibility reasons, I am admittedly naive, but I would assume it would be a substitute for an existing font name. Unique font names per user seem unnecessary.
- talmand 9y ago
  >> Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess. >> Unique font names per user seem unnecessary. As a dev that has worked in CSS for over a decade, I have no idea what either of those mean. EDIT: I see the unique font names part now, totally missed that while focusing on the other parts.
  - kodablah 9y ago
    By "CSS property queries" I mean the technique in TFA using @supports + before/after-content URLs to query whether certain CSS properties are supported.
    - talmand 9y ago
      I see my problem now, I don't see @supports as a query like in terms of media queries.
mrob 9y ago
If somebody has fonts installed for specific reasons then presumably they don't want web pages changing them. Web pages shouldn't need any more control than selecting from "serif", "sans-serif", or "monospace". The most legible font is the font you're most familiar with. I don't want web pages to use different fonts just because some marketing drone thought it was good for branding. It's disappointing that we allowed websites to abuse fonts for vector icons.
- kmbriedis 9y ago
  Have you heard a term 'design'? + sometimes you can't adjust the website to work well with all (or even the popular ones) sans-serif fonts
  - goialoq 9y ago
    Give one example where users benefit from the website forcing a special font. And even if that happens, the website can provide the font to the user. None of this requires the user telling the website host which fonts are installed.

rcxdude 9y ago

In the case of reddit, the custom CSS could not reference off-reddit resources (images were uploaded), so this technique would not work.

spladug 9y ago
Yup! And this sort of tracking is exactly why. https://github.com/reddit/reddit/blob/master/r2/r2/lib/cssfilter.py#L24-L29 https://github.com/reddit/reddit/blob/master/r2/r2/lib/cssfi... https://www.reddit.com/r/cssnews/comments/24anzb/css_change_the_filter_has_been_rewritten/ https://www.reddit.com/r/cssnews/comments/24anzb/css_change_...

oneeyedpigeon 9y ago

> not an easy fix All of this is an easy fix: disable css. In the same way that "I don't want to be tracked by javascript" can easily be resolved by disabling javascript. I'm not seriously suggesting everyone does that, but anyone who is so paranoid that they don't want a site knowing that they're reading its content might want to consider it.

kodablah 9y ago
While we, as devs, may get tired of the constant beat-down between site flexibility and privacy, many of our users are unaware. They will go blindly towards flexibility and we have a duty to find as much compromise as possible between those two values lest we just say "it's an easy fix, just turn off your computer". There has to be a middle ground between extremely paranoid turn everything off and extremely liberal with my anonymity (and on the internet, it's not governments who are going to help find it).
- oneeyedpigeon 9y ago
  I guess my point is "how much anonymity is it reasonable to expect?" Should I have a problem with the fact that nigh-on every URL in the world will leave behind a little footprint when I request it? I don't see an enormous problem with a website anonymously recording the fact that I've clicked a link. ("anonymously" assuming I'm blocking their cookies, which I would if I were that paranoid)
  - philliphaydon 9y ago
    I don’t mind sites tracking to know what products sell and what doesn’t, what browsers people use or how Long I spend on the site etc. What I hate, is the fact that I go to agoda, I search for hotels in jiufen in taiwan, I look at only 2, I book one of the 2, I close it. Open up Facebook on my phone seconds later and have adverts saying: hey how about these 2 hotels in jiufen. That shit annoys me. Stop following me and tracking what I’m doing and sharing it with all these companies. It makes me want to not use the internet...
  - 9y ago

deleted 9y ago

[deleted]

zerokernel 9y ago

> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0 Mobile/14G60 Safari/602.1 Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/604.4.7 (KHTML, like Gecko) iOS/16.0.7.121031 Mobile/15C153 Safari/9537.53 Mozilla/5.0 (Linux; Android 7.0; LG-H840 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36 A Linux in comparison: Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0 While it includes the version number, no patch level (57.0.X) is included.

gruez 9y ago
Firefox on the other hand, discloses very little, even on mobile: Mozilla/5.0 (Android 4.4; Mobile; rv:41.0) Gecko/41.0 Firefox/41.0
sorenjan 9y ago
The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.
- yoodenvranx 9y ago
  > why should any website know all that? As a developer: Without user agent: How would I easily detect which browser breaks a certain feature on my project? If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it. If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know which browser is responsible for this.

dahart 9y ago

> If you're concerned as a user of a malicious site Or if you're concerned as a user of a regular "safe" site... Google Analytics does all of these things: link tracking, hover tracking, media query tracking. GA or something like it is being used by vast swaths of the web. I don't claim it's the majority, because I don't know, but that's what I assume, that all sites are tracking (whether or not the site even knows it.)

_jal 9y ago
Right, which is why GA is not allowed to load in my browsers. This is a different avenue for disclosure of a similar bundle of info.
- r3bl 9y ago
  Just curious: Are you okay if it's something self-hosted (like Piwik) doing the same kind of tracking? In other words: Do you not want a third party (like Google) to have that data or the second party (web administrators)?
  - unethical_ban 9y ago
    IMHO I think they are different. So much of what makes the web and surveillance creepy is the ability to correlate across data sources. CCTV isn't creepy for one store owner to have - it's bad when the government has it everywhere. It's not bad for people to analyze how users interact with their site. It's bad when one entity (or a handful) can track you across the Internet. So in other words, I don't mind Piwik and have considered sending in a patch to uBlock and others with a switch to disabled "locally hosted analytics" or something similar. Like the drive to push "ethical advertising", I think it's reasonable to permit some benign tracking as a way to coerce more sites into decentralizing user analytics.
  - _jal 9y ago
    I'm fine with with self-hosted analytics, and use a log analyzer myself. My primary objection is automated profile-generation and identifier sharing - third parties don't need realtime updates on my reading habits. I like to think folks who run their own analytics aren't sharing identifiers with adtech shops, but of course can't know.

Daycrawler 9y ago

> So what, the site could route you through a server side proxy anyways There's little interest in proxying through a token system (this would require a DB read at each click, and a DB write at each page generation), which means the actual link is available client-side and the whole thing can be bypassed.

bastawhiz 9y ago
Most implementations that I've seen, including Google's, just put the linked URL in the query params of the redirect endpoint URL. '/redirect?url=...'
AgentME 9y ago
It's easy to design a system like this where the actual link isn't available client-side, and the server doesn't need to wait on a DB read and write before responding to the client: make the URL parameter be the destination URL encrypted so that only the server can read it. That kills the need for a DB read. Then the server can respond to the request before the DB write finishes since the integrity/consistency of that write is likely less critical than the response time.
- Daycrawler 9y ago
  That's correct.

MamboJ 9y ago

Wouldn't the Tor browser solve most of these issues?

rollcat 9y ago

> * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most) Oh my. I wish this madness ended. Quoth tedu: > I don’t know a whole lot about typography and fonts, but there’s two things I know about font files. They’re ridiculously complex and their parsers have only just begun to experience life with hostile inputs. In short, I’d put fonts second on my list of files likely to pwn your browser, after Flash [...].

jandrese 9y ago
I've thought for some time that the only reason people have not exploited fonts to take over browsers is because even hackers don't understand how they work.
bzbarsky 9y ago
Note that browsers pass downloadable fonts through a sanitizer before they even consider handing them off to anything else that might need to parse the font. And browser security teams have spent years now fuzzing both those sanitizers and various font libraries... There's still a lot of attack surface here, but "only just begun to experience life with hostile inputs" isn't quite true either.

8note 9y ago

link 0 is inaccurate. Reddit retracted that statement on CSS, saying mod created styles will stick around.

jrochkind1 9y ago

Sure. I think it's mainly interesting in that CSS injection vulnerability can turn into tracking. it never occurred to me that a CSS injection vulnerability could do anything actionable before.