5 ms·
Every time Chrome adds a new API it is nearly always abused by ad networks and tracking companies to fingerprint users. If you're bored one day you should cons
by 0xy 6y ago
Every time Chrome adds a new API it is nearly always abused by ad networks and tracking companies to fingerprint users.
If you're bored one day you should consider reverse engineering some ad network code. You'll be stunned at the insidious practices used.
- strombofulous 6y agoThat sounds like a lot of fun. Do you have a good file to start with? Does Google deliver a payload to fingerprint browsers on page they serve ads to?
- 0xy 6y agoGoogle routinely allows third parties to run egregious malicious fingerprinting scripts without consequence, most notably on StackOverflow. [1] [1] https://meta.stackexchange.com/questions/331960/why-is-stack-overflow-trying-to-start-audio https://meta.stackexchange.com/questions/331960/why-is-stack...
- simcop2387 6y agoAll they have to do with this API now is just save their own fingerprints to somewhere the user can write to and they can find later. Evercookies that can survive browser reinstalls, and anything short of a meticulous search through everything in your home directory.
- searchableguy 6y agoThey need to ask for permission after the person has closed the tab again.
- sayhello 6y agoWe made sure that the activation of the API is gated by: 1) User Activation checks 2) When access to the file system is requested, a File Picker is necessary 3) When the API is in use, there are plenty of indication that it's being used We put a lot of thought in Privacy and Security, as we do for all APIs.
- sriku 6y agoIf I disable the file system API, can an "is file system API available" check be used as a bit to fingerprint my browser?
- rasz 6y agoSure, currently you can fingerprint checking available free Storage API space for example.
- or-gate 6y ago> We put a lot of thought in Privacy and Security, as we do for all APIs. but somehow, data is heavily harvested thru browsers(chrome), apps(android). Do you even test your APIs with a sample audience, like real tech ignorant people and see how they are blind to all those and just click yes, and don't care?