7 ms·
I'm not sure I understand the threat here. Say I visit SiteA which references jQuery from CDNJS, then later visit SiteB which references exactly the same jQuery
by GordonS 6y ago
I'm not sure I understand the threat here. Say I visit SiteA which references jQuery from CDNJS, then later visit SiteB which references exactly the same jQuery from CDNJS - what's the problem?
- dathinab 6y agoIt can be used to track users across domains to some degree.
- mmcwilliams 6y agoNot to be dense but wasn't that always the purpose of running a CDN service for common scripts and libraries?
- daveFNbuck 6y agoThe script wouldn't have to be from a CDN to track people using the browser cache. I could infer whether you've visited a site that doesn't use CDNs or trackers by asking you to load something from that site and inferring whether you have that resource cached by the time it took you to load it.
- mmcwilliams 6y agoThis is true, but if you're running a CDN you have access to cross-domain user information just based on the headers, no?
- daveoc64 6y agoThe CDN is not the place you have to worried about. If Site A loads a specific JavaScript file for users with an administrator account, Site B can check to see if the JavaScript file is in your cache, and infer that you must have an administrator account if the file is there. The attack can happen with different types of resources (such as images).
- mmcwilliams 6y agoThis I understand, the risk of third-parties monitoring. The attacks are pretty obvious. My confusion is over what the business model of a commercial CDN is if not to track users across multiple sites? How do they pay for bandwidth?
- dathinab 6y agoThe problem is not the CDN (or arbitrary shared source domain) being able to track you but the sites which use the CDN. Furthermore a CDN can't track you as simple as you might think, it often would require thinks which need explicitly opt-in agreements on a per website basis to be legal. Furthermore due to technical limitations you can only get that permission from the user after the CDN was already used. CDNs can still track aggregated information to some degree but they can't legally act like a tracker cookie.
- GordonS 6y agoThanks, I understand the issue now - I haven't thought about CDNs from a privacy perspective before. I suppose with HTTP2 some of the benefits of serving JS through CDNs are gone anyway, so I guess it's time to stop using them.
- amelius 6y agoHow serious is this type of threat? Compared to all the info about us that is already shared by data brokers?
- ev1 6y agoThere are several data-broker-esque "services" that actually do this already with FB, Google, etc assets (favicon.ico and similar, loggedIn urls, ...) to check whether you have visited those pages, or whether you are logged in to those services by trying to request a URL that might return a large image if logged in, or fail rapidly if logged out. -- This has been a thing for a long time: https://news.ycombinator.com/item?id=15499917 https://news.ycombinator.com/item?id=15499917 If you don't use any of those sites, you're considered higher risk/fraudulent user/bot. Here's an example of a very short and easy way to see if someone is probably gay: https://pastebin.com/raw/CFaTet0K https://pastebin.com/raw/CFaTet0K On chrome, I consistently get 1-5 back after it's been cached, and 100+ on a clean visit. On Firefox with resistFingerprinting, I get 0 always.
- amelius 6y agoThank you, that was insightful. > Here's an example of a very short and easy way to see if someone is probably gay Ok, but now the resource is in my cache, so from now on they will think I'm gay?
- tzot 6y agoYou could have run this on a private window of the browser (and in that case, they would surely think you're a closeted gay).
- ev1 6y ago> Ok, but now the resource is in my cache, so from now on they will think I'm gay? This resource is just generic, so probably not, but if you actually visited grindr's site without adblocking heavily, they load googletagmanager and a significant number of other tracking services, which will almost certainly associate your advertising profile and identifiers as 'gay' I also can't believe they send/sell your information to 3 pages worth of third party monetization providers/adtech companies for something that is this critically sensitive.
- kami8845 6y agomaybe not with CDNJS, but perhaps you don't want every website to know you have AshleyMadison.com assets cached.
- Uehreka 6y agoCan websites even tell what is cached and what’s pulled fresh?
- EE84M3i 6y agoYes, using timing
- amelius 6y agoNot if the javascript starts running only after all resources have loaded.
- darepublic 6y agoNo there could still be timing attacks after. Just dynamically request a cross domain asset
- amelius 6y agoThen those requests should not be cached?
- deleted 6y ago[deleted]
- tylerhou 6y agoconst start = window.performance.now(); const t = await fetch("https://example.com/asset_that_may_be_cached.jpg"); const end = window.performance.now(); if (end - start < 10/*ms*/) { console.log("cached"); } else { console.log("not cached"); }
- Phemist 6y agoI'm guessing many websites are identifiable by which patterns of libs and specific versions they will force you to cache. One SiteA would then be able to tell that a user visited a SiteB (which, depending on the website, may or may not be problematic)
- franga2000 6y agoI'm sure some sites would be identifiable by their cached libs, but the cache is shared, so any overlapping dependencies would decrease the accuracy to unusable levels. The best you could do is know someone did not visit a site in the last ${cache_time}. There are, of course, other vectors to consider, but I can't think of any that could be abused by third parties. If anything, isolating caches would make it easier for the CDN themselves to carry out the attack you mentioned, as they would be receiving all the requests in one batch.
- notsuoh 6y agoLike a discount Bloom Filter?
- franga2000 6y agoIt would behave like one, yes.
- flak48 6y agoWhat if my website tries to load a JS file that only foxnews.com loads (maybe with a less restrictive CORS config)? I'd be able to tell if you visited Fox news recently, correct?
- franga2000 6y agoIt would be extremely unlikely for only one site to use a specific file from a public CDN (like cdnjs). As for site-specific files like JS bundles and other static assets, those would be served on a "private" CDN, usually under the same domain (like cdn.foxnews.com) and with restrictive CORS settings for this very reason (and also to prevent bandwidth stealing).
- madeofpalk 6y agoTry and load assets from another domain and observe if it was probably cached or not, and you can know that they visited the site
- convery 6y agoI guess, but that disadvantage seems massively outweigh by the benefits. Can always use something like [1] to check if a client is active on interesting sites. [1] - https://www.webdigi.co.uk/demos/how-to-detect-visitors-logged-in-to-websites https://www.webdigi.co.uk/demos/how-to-detect-visitors-logge...
- minitech 6y agoCan’t always use that. It’s much less specific compared to the potential of cache, only works when websites provide that type of redirect, doesn’t work if you block third-party cookies (I think a form of that might already be the default in some browsers), etc.
- Polylactic_acid 6y agoAre there actually any benefits though? I saw an article a few years back about how when loading jquery from Google's cdn there was about a 1% chance the user had it cached already. Since you have to have, the same library, the same cdn source and the same version of the library, it almost never is the case that the user has already grabbed this recently enough that it hasn't been kicked out. Plus the trend now is to use webpack and have all of your deps bundled in and served from the same server.