4 ms·

Not sure exactly where the proof of concept is. Is it this page? https://m417z.com/De-anonymization-via-Clickjacking-in-2019/?demo https://m417z.com/De-anonymi

Not sure exactly where the proof of concept is. Is it this page? https://m417z.com/De-anonymization-via-Clickjacking-in-2019/?demo https://m417z.com/De-anonymization-via-Clickjacking-in-2019/... I tried it in latest Firefox with uBlock & HTTPS Everywhere and it leads me to a 'captcha' page similar to Cloudflare's but there's no actual captcha box. Nothing seems to happen... Is it uBlock protecting me or is it that I've completely disabled all third party cookies?

ksml 7y ago
I think the captcha box is the Facebook comments box restyled. I'm guessing uBlock or Firefox containers are protecting you.
- pndy 7y ago
  It's most likely uBlock - [1] [1] - https://i.imgur.com/wpLgp9R.jpg https://i.imgur.com/wpLgp9R.jpg
  - Santosh83 7y ago
    In my case a comment box doesn't appear at all. I also don't have Firefox containers enabled. uBlock is blocking google-analytics.com and facebook.net domains only on that page, while Firefox's own tracker blocking is not accepting 3rd-party cookies from disqus, fb and google. https://imgur.com/a/gehE6nF https://imgur.com/a/gehE6nF Although these days I'm aware that most large tracking companies are probably going beyond just 3rd party cookies and building shadow profiles based on device fingerprinting which as it stands is effectively impossible to avoid without crippling modern browsers.
- deleted 7y ago
  [deleted]
SamuelAdams 7y ago
I use Firefox and the new Tracking Protection feature can sometimes prevent Captcha boxes from loading. Click the Shield icon by the URL, then toggle the Tracking Protection to off. The page should reload, does it display the captcha?
- Santosh83 7y ago
  You're right, turning off Firefox's tracking protection reveals the 'captcha' box (disguised FB comment box)... but it still fails since I've FB's platform feature turned off. Another window pops up informing me that I need to turn it on to record my comment, which of course I declined...
penagwin 7y ago
I have uBlock on chrome and it worked for me. Got me too, I thought it was a captcha.
dyslexit 7y ago
The author briefly touches on preventing the technique by disabling third party cookies, so yes, it's probability that. > Having tried several solutions, I came to the conclusion that blocking third party cookies is the best mitigation for clickjacking.

ksml 7y ago

I think the captcha box is the Facebook comments box restyled. I'm guessing uBlock or Firefox containers are protecting you.

pndy 7y ago
It's most likely uBlock - [1] [1] - https://i.imgur.com/wpLgp9R.jpg https://i.imgur.com/wpLgp9R.jpg
- Santosh83 7y ago
  In my case a comment box doesn't appear at all. I also don't have Firefox containers enabled. uBlock is blocking google-analytics.com and facebook.net domains only on that page, while Firefox's own tracker blocking is not accepting 3rd-party cookies from disqus, fb and google. https://imgur.com/a/gehE6nF https://imgur.com/a/gehE6nF Although these days I'm aware that most large tracking companies are probably going beyond just 3rd party cookies and building shadow profiles based on device fingerprinting which as it stands is effectively impossible to avoid without crippling modern browsers.
deleted 7y ago
[deleted]

SamuelAdams 7y ago

I use Firefox and the new Tracking Protection feature can sometimes prevent Captcha boxes from loading. Click the Shield icon by the URL, then toggle the Tracking Protection to off. The page should reload, does it display the captcha?

Santosh83 7y ago
You're right, turning off Firefox's tracking protection reveals the 'captcha' box (disguised FB comment box)... but it still fails since I've FB's platform feature turned off. Another window pops up informing me that I need to turn it on to record my comment, which of course I declined...

penagwin 7y ago

I have uBlock on chrome and it worked for me. Got me too, I thought it was a captcha.

dyslexit 7y ago

The author briefly touches on preventing the technique by disabling third party cookies, so yes, it's probability that. > Having tried several solutions, I came to the conclusion that blocking third party cookies is the best mitigation for clickjacking.