11 ms·
Well-known web sites that port-scan their visitors
- henriquez 6y agoAt what point does all this surveillance capitalism tech become “unauthorized access?” Port scanning with no user consent seems borderline malicious to me. Since the late 1990s I’ve seen language in ISP acceptable use policies banning port scanning hosts without consent. If this is widely considered malicious by industry norms for decades then how can this be considered ethical for a random website to do against a user’s machine?
- Lammy 6y agoNo, see, you are the Client. They are the Server. You are Consuming their Content and this is a flow they only think about in one direction.
- dnautics 6y agoIf you want an interesting challenge, embed an agreement into your client headers, and then sue the pants off of these companies.
- mindslight 6y agoNever, because unilateral contracts and a negotiation imbalance bless it as being authorized. It's similar to how artists can end up not owning the rights to their own songs. Any legal protection that is transferable ends up as a liability to the individual, as the market will strongly incentivize trading it away. The Coase theorem applies to your personal life.
- baybal2 6y agoThings are a bit different when they use Javascripts to scan your own machine. Apparently, the language "deliberate circumvention" makes a big difference in the context of US CFAA because of some precedent.
- matheusmoreira 6y agoThe only difference is a terms of service nobody reads which "allows" them to do what they want, no matter how abusive.
- cgriswald 6y agoIn some of the cases there’s no chance to agree with the TOS or leave before you are scanned. > For example, Citibank, Ameriprise, and TIAA-CREF immediately port scanned our computers when visiting the main page of the site.
- elliekelly 6y agoPerhaps EFF could bring a private cause of action under the Computer Fraud and Abuse Act.
- HenryBemis 6y agoNatWest App on Android also tries to connect to ThreatMetrix. I use NoRoot Firewall to block it (Global Filters).
- matheusmoreira 6y agoYes. Most if not all websites with typical "by continuing to use the site you agree to..." terms will drop cookies and fingerprint the user on their first visit, breaching their own contract. They do it even if lack of consent is made explicit by including Do Not Track in the HTTP headers. These terms are obviously an attempt to get away with questionable behavior. Instead of simply not doing bad things, they insist and point people to the legalese when they complain as if it excused everything.
- MereInterest 6y agoExactly. It's very easy to be compliant with privacy law if you aren't stalking your users in the first place. The best example I've seen for doing it right was from godbolt.org, whose GDPR notice is refreshingly direct. > The Compiler Explorer team believes the Compiler Explorer site is compliant with the EU's General Data Protection Regulation (GDPR). Specifically, we store no personally identifying information, we anonymise the little data that we do have and we do not permanently store any user data.
- salawat 6y agoThe hairyness there is that there are legitimate reasons to port scan. Think of it like checking locks or oiling hinges on doors and windows. Totally benign in your own home; gets awkward elsewhere right? I still do it though occasionally when I arrive at a new place if the signage is bad though. Now, what about when your friend comes over, bringing the "house" of their laptop with them. It's on your network; seems like you should be in safe waters to do that port checking since it's in line with what you'd normally do, but their stuff isn't yours. Solution? "Hey, mind if I..." or, "Here's the guest network password". Where I draw the absolute line is where you start to get this implied consent nonsense where that interaction never takes place, or in a form where the entity doing it never has to make the fact they are consciously up front to the User in question, and provides no alternative if the user doesn't agree. Of course they implicitly do... Just don't use the website, which I practice. However it is becoming increasingly pervasive enough that I think we need to recognize the positive utility of integrating this sort of meta-layer concern into our basic social protocols in some way.
- lostmyoldone 6y agoIt's not impossible they are breaking Swedish law, as our computer security laws essentially requires you to have an explicit right to do something with regards to someone elses computing resources to be allowed to do so. As far as I understand it, there doesn't have to be any circumvention of technical protections for the possibility of a crime to occur, but only accessing computing resources having lack of some equivalent of explicit authorization. I'm unsure of a TOS that mentioned it would hold up, I would assume no as it's not something the average consumer would a) expect b) easily understand c) might not even be in the position to accept, ie when accessing a site from a computer they don't own, they might not have the authority to allow a port scan.
- VWWHFSfQ 6y agoThis also likely violates the Computer Fraud and Abuse Act is USA.
- gruez 6y agoI can understand banks using client fingerprinting for fraud detection, but Chick-fil-A? Are they worried that people might steal $5 of restaurant vouchers?
- bdcravens 6y agoI know in the past Chick-fil-a has been criticized for its conservative views; perhaps this was related to their efforts to mitigate attacks on the website?
- kirse 6y agoYou'd be surprised, Chick-fil-a has a TON of fraud to deal with given their food's popularity. They push the "convenience" of the mobile app (and it is in some ways), but coupon fraud was also a big hidden reason driving that; basically all paper vouchers or barcode-based coupons moved over to app-only. Same for their Christmas calendars that used to be paper coupons + those receipt-based "Free Sandwich" surveys, etc... all have been clamped down with vastly increased security over the years.
- salawat 6y agoThere might be a bit more sympathy for their plight, and a self-correcting problem if they'd explain why they were doing it. Sometimes just by pointing out that it's an issue, people will start to adjust their behavior to make it not an issue anymore. There'll always be some ne'er-do-wells, but if we let that deconstruct our expectation of positive respect for one another's time and stuff, well... You reap what you sow.
- nojito 6y agoGift Card fraud is a massive underground industry.
- bootlooped 6y agoA few months ago the official Android app for Instant Pot would not let me view recipes due to my device being rooted (I just checked and they have since changed this). Up until a couple years ago, my credit union had a password length limit of 10 characters. I can use 2 factor authentication with my power utility but not with my credit card company. Companies seem to have an extremely uneven view of what calls for strict security measures and what doesn't.
- WhatIsDukkha 6y ago"""In our tests, uBlock is unable to block the port scans in the new Microsoft Edge or Google Chrome as the extension does not have adequate permissions to uncloak the DNS CNAME records.""" Seems highly relevant...
- AdmiralAsshat 6y agoAll the more reason to stay with Firefox.
- garren 6y agoAnd/or NextDNS.io - Uncloaking cloaked domains is primary what brought me to the service. Added benefits include service across all browsers, all devices, local/mobile etc.
- ray991 6y agoBut that is just swapping one privacy issue with another, as NextDNS is also free to sell user’s private metadata to data brokers. https://news.ycombinator.com/item?id=23318830 https://news.ycombinator.com/item?id=23318830
- dhimes 6y agoOne problem I seem to be having with FF (on Win 10 anyway) is it's not checking my hosts file for a domain lookup before using dns. Overriding the hosts file makes some things easier so I tend to do it. But now, my first time trying from Win, and it's not getting my page. Chrome works, ssh from WSL works, but FF uses dns first, apparently. It's the first development usage I've found that Chrome works better than FF.
- airstrike 6y agoWell, that just means Firefox is winning this war by, what, 79–1 rather than 80-0
- 6y ago
- gayprogrammer 6y agoI'm thinking that arbitrary domains should not have access to any resource on '127.0.0.1', for the same reason that browsers restrict access to resources at 'file://' without user permission.
- salawat 6y agoIt isn't just websites. It's everything really. The industry has proven to me time and again that it is not worth it to explain to user's what they are doing and why they are doing it. Doing so seems like a complete waste of time on the micro-scale, but on the macro-scale it builds confidence in the integrity of practitioners and the business they're hired by by customers, reaffirms positive social values/norms (asking for permission, politely explaining when asked a question, and respecting other's prooerty), and it increases the bar in terms of expectation, and helps educate users by shaping their expectation of what kinds of things one should expect a computer to be able to do. There wouldn't be half the computational illiteracy there is if we'd take the time to explain the basics.
- edoceo 6y agoPerhaps all well-known private subnets?
- butz 6y agoIs uBlock blocking port scanning by default, or one has to enable something in settings?
- llacb47 6y agoIt's blocking the domains that host the port-scanning scripts.
- lenkite 6y agoI am still so confused on why this vulnerability exists. For AJAX, you have CORS. Why was this even permitted for web-sockets ?
- cygx 6y agoThis vulnerability predates websockets (in fact, you can exploit it even without Javascript) - they just make things more convenient. Apparently, the shit hit the fan a while ago, prompting Opera to implement 'cross network protection'[1], but other browser vendors did not follow suit. [1] https://web.archive.org/web/20121001002815/http://my.opera.com/securitygroup/blog/2012/07/03/operas-cross-network-protection https://web.archive.org/web/20121001002815/http://my.opera.c...
- jimbob45 6y agoTL;DR: Use Firefox with uBlock Origin to block the highest number of scans. Edge/Chrome/Brave let them through.
- HugoDaniel 6y agoNo info about Safari
- salawat 6y agoI'm increasingly convinced LexisNexis is an example of a pervasive monitoring/integration actor that has by this point scaled to the point their mere existence should be considered an attack. The level of data aggregation, and the lengths gone through to acquire that data are just disturbing as all hell. You can say, on the one hand that the fact they pop up everywhere is clearly a sign they provide a positive benefit to society, but nowhere I've been actually does anything to make you aware of what LexisNexis actually is, or what they provide. They're basically the Ur-example of the "Shadowy info-broker" tropeI've come across in real life. The question that seems to be boiling to the top of life lately is whether or not there is a place in the world for a legitimate business whose business is to know as much as possible about everyone else's business. The answer, from my perspective, is no, absolutely not. The market seems to deem otherwise.
- historyremade 6y agoThey are also using Dating Sites and Student Loan websites to collect data.
- homero 6y agoWow so if I use RDP or TeamViewer then what? They decline my order?
- techntoke 6y agoMy understanding is that you can use WebRTC and other methods of JavaScript to port scan a computer. Heck, you can literally run BitTorrent on a website using WebTorrent. You could force users to download and share copyrighted movies or other illegal material in the background without their knowledge when they visit your website. The state of the browsers is a disaster and security nightmare. Wasm is only going to make it worse. Soon you'll essentially be running binary blobs when you visit a website. What was supposed to be a permissioned sandbox to protect users, turned into an advertisers and malicious hackers' wet dream. I think there needs to be more alternatives to JavaScript at this point.
- jackewiehose 6y ago> Heck, you can literally run BitTorrent on a website using WebTorrent. You could force users to download and share copyrighted movies or other illegal material in the background without their knowledge when they visit your website Yes, I wrote this a few times in threads like this but for some reason this is mostly ignored. Having WebRTC enabled by default can get you in legal trouble (at least in a country like Germany where lawyers send you letters based on IP addresses).
- superkuh 6y agoLeaving javascript executing by default is the modern version of opening every email attachment.
- ringe 6y agoThis link sent me straight to a malicious ad page pretending to be Telenor
- ttrbls 6y agoI think these features are implemented in order to track the end-users, with the scope of preventing fraud
- inscartwheelies 6y agoI'm a bit confused by the ambiguity: is this a local JS browser client-side scan or a remote server-side scan?
- rocky1138 6y agoI wonder if there's a browser extension that will port scan them back.
- kstrauser 6y agoI’m surprised any web site is doing something this risky to themselves. Say I’m an attacker. I visit their website, and they attempt to open a connection to me. I accept the connection and send back a target payload to their scanner, which is certainly less well tested than their public website’s software. Even better, that seems exceptionally hard to prosecute: “wait, didn’t you go out of your way to ask the defendant to send you that data?”
- insulanus 6y agoGood thinking, but if I understand correctly, the javascript running the scan is running on your browser. So the scan is coming from the browser process, and both sides of the connection have IP address 127.0.0.1. That javascript can then report back, or take other actions in your web session. It's not a port scan in the sense of them opening a socket from their server to your computer.
- kerng 6y agoWondering if someone will take legal action. Port scanning still is legally a grey area in many jurisdictions.