15 ms·

Permission.site

728 points by valand 6y ago

axaxs 6y ago
Cool site. I'm a bit annoyed that sites can seemingly overwrite your clipboard without confirmation, on Android at least!
- skzv 6y ago
  No, it makes sense. "Copy this" buttons are common on websites, but probably require a button click to initiate. Since you clicked on a button, you provided the input necessary to copy to the clipboard.
  - judge2020 6y ago
    Copying to the clipboard is unrestricted even without a click, but reading clipboard text requires a permission popup. https://web.dev/async-clipboard/#security-and-permissions:~:text=Permissions%20for%20copy%20and%20paste%20have%20been%20added%20to%20the https://web.dev/async-clipboard/#security-and-permissions:~:...
    - axaxs 6y ago
      This is exactly what I was thinking. Theoretically, a bad actor could have a site or even inject code onto a site with an innocuous looking bash command, but upon copy injects say, rm -rf ~ \n
      - judge2020 6y ago
        This can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942 https://security.stackexchange.com/a/113630/96942
        axaxs 6y ago
        Really interesting(and terrifying) reads, thank you.
        kelnos 6y ago
        Seems like this requires you to select some text (which includes some text that's been hidden using CSS tricks) and copy it. So it's not like the website can just arbitrary write to your clipboard without your interaction? (Still, this is kinda scary and I didn't know about this.)
        input_sh 6y ago
        They can append the message to whatever you'll actually want to copy, which is how websites used to do things like this. - Copied from https://news.ycombinator.com/item?id=26590437 https://news.ycombinator.com/item?id=26590437
      - SilverRed 6y ago
        The real bug is that \n pasted in to the terminal counts as hitting enter. iTerm has fixed this but every linux terminal I have used has this issue.
        vanviegen 6y ago
        Is it still possible to paste into vim, for example? If so, how does the terminal make the distinction?
        shakna 6y ago
        Every Linux terminal I've used has a pop-up when there's a new newline. Like this, which in this case is xfce4-terminal. [0] [0] https://i.imgur.com/ubCXASQ.png https://i.imgur.com/ubCXASQ.png
        PowerBar 6y ago
        Huh, I've never gotten a prompt like that in Terminator.
        judge2020 6y ago
        Same for Windows Terminal: https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86wUU.png https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86...
        axaxs 6y ago
        Gnome-terminal, probably the largest by user base, does not sadly.
    - kelnos 6y ago
      Is it? When I click the "Write" button, it turns green, but when I click "Write (delayed)", after a while it turns red. So it seems (at least on Firefox 87) even the clipboard write API is restricted to user-action event handlers.
- mrtksn 6y ago
  It’s also a privacy issue. Google’s Firebase Dynamic links is using it non-maliciously to survive app installs for deep linking(when the app is not installed it helps you redirect the user to the correct screen after the install), however any webpage can actually put something on your clipboard and match you on an app by reading your clipboard. With iOS14 at least we can tell when apps are reading the clipboard.
- walrus01 6y ago
  Seems like a great method to social engineer people into copying to clipboard something that will install a trojan, get them to open a command prompt and paste it, in the general concept of curl piped into a shell.
kristopolous 6y ago
Hey, sorry, I'm really dumb here. How would one use this?
- I_Byte 6y ago
  It appears as though you click on each button and see what color the button turns. If the button turns red the site doesn’t have the permission to do what the button says. If the button turns green then the site can do what the button says.
  - jononomo 6y ago
    I think his question is: what's the point?
    - pfundstein 6y ago
      Mostly as a tool for developers to test various permissions on various browsers
      - hunter2_ 6y ago
        I guess this rabbit hole continues if one asks what the point of such testing could be. One thing I'd find useful is that I could take screenshots (or live demo this site) if I was doing some non-web-development thing such as doing a presentation and wanted to explain WebAuthn flow or something. Because if I was a developer doing development, I'd test browsers with what I developed.
        leipert 6y ago
        Or maybe you are a developer of that is using one of the features for the first time. Now you can check out the permission flow without having written any code. Similar to live examples in MDN.
    - PurpleFoxy 6y ago
      I found it interesting to see what happens on safari on iOS after each permission was requested. About 1/3 did nothing, a few of them were denied without a prompt, a few of them were as expected. And a few of them had weird prompts like the pan/tilt on asking for camera permission. Was also interesting to see webauthn ask if I wanted to allow a site to use faceid which I didn’t know was even possible
kijin 6y ago
The mouseover effect on the HTTP/HTTPS toggle is very annoying. It makes it hard to ascertain which mode you're actually in while the cursor is anywhere near it.
- kevingadd 6y ago
  Yeah, I clicked that thing like 6 times before I understood. For the confused: Check the address bar, clicking it actually changes the URL of the site (to flip you into/out of secure mode)
  - Andrew_nenakhov 6y ago
    I still don't get it. Clicking the address bar or the switch toggle does nothing for me. Manually entering http://permission.site http://permission.site also doesn't help
    - MauranKilom 6y ago
      Do you maybe have HTTPS everywhere installed? Or is your browser maybe set to always choose HTTPS if possible? (The former applies to me, and clicking the toggle does nothing for me either.)
- spion 6y ago
  I wonder if this is the default behavior from some UI toolkit or is it custom...
soheil 6y ago
I had no idea you could screen share in JS.
- kmeisthax 6y ago
  Yup! Meeting apps need it.
- smaddock 6y ago
  Desktop and window capture is included for all platforms as part of WebRTC.
- joshribakoff 6y ago
  Can record to video too, sort of like logrocket
airstrike 6y ago
For some reason the regular popup works without asking for my permission, whereas the delayed one gets blocked by Firefox (86.0.1 on Windows 10)
- kristofferR 6y ago
  That's intentional. Instant popups from clicks can have totally legitimate uses (like logging into sites like Disqus/Paypal etc on external sites). Delayed popups have very few, if any, legitimate uses.
- thomasfoster96 6y ago
  This will happen in most browsers (I’m on Safari 14, macOS 11.2). The popup-blockers in most browsers will allow a popup if it is opened directly because of user input, such as a button click — a fairly simple measure which can be implemented by only allowing certain APIs to work within an event handler, for example. There are a few Web APIs which work this way — for example, you can’t make a page fullscreen unless you do so in response to user input/interaction [0]. [0]: https://developer.mozilla.org/en-US/docs/Web/API/Element/requestFullScreen https://developer.mozilla.org/en-US/docs/Web/API/Element/req...
- wnevets 6y ago
  Popups triggered by a user are considered trusted and are usually allowed https://developer.mozilla.org/en-US/docs/Web/API/Event/isTrusted https://developer.mozilla.org/en-US/docs/Web/API/Event/isTru...
walrus01 6y ago
There is no way that 'pointer lock' should be something you can just click and get your pointer hijacked. You could label that button anything or make it any clickable element. Who the hell at web browser developers thought that was a good idea to implement? Why not have a "Do you want to allow this site to take control of your pointer?" prompt, same as when a site first wants to use your microphone or camera?
- yyx 6y ago
  Maybe it's used for fullscreen games?
  - walrus01 6y ago
    I'm sure it is, and works great for that, I just think it needs one more layer of user consent and understanding before it's turned on.
  - tyingq 6y ago
    I see it in emulators, like this one: https://www.pcjs.org/software/pcx86/sys/windows/3.10/ https://www.pcjs.org/software/pcx86/sys/windows/3.10/ (click one of the Windows apps once it boots)
- alpb 6y ago
  I think lots of stuff like RDP extensions, or browser-based gaming (e.g. Stadia) are using it.
- kevingadd 6y ago
  There are a ton of use cases that demand it, so it was added a long time ago (around the same time as Fullscreen, I think). The current user experience for it (opt-out instead of opt-in) has likewise been around for ages. I think I remember seeing an explicit permission prompt very early on but they got rid of it. "You could label that button anything" sadly applies to a significant number of dangerous things a website can do, pointer lock is not near the top of the list.
- cyberdummy 6y ago
abhiminator 6y ago
Absolutely blown away by the number of things you can do from a web browser these days. All of this would've been unimaginable a mere 10 years ago, right around the time when Google Chrome was in its infancy (or just out of it, to be precise) and the web browser market was still dominated by Internet Explorer, with Opera, Firefox and Safari (back when there was a Windows version of Safari) taking up small slices of the market share. Another cool site to check out: https://coveryourtracks.eff.org https://coveryourtracks.eff.org -- a great tool to see how unique your browser's 'fingerprint' is and how well it protects you from trackers and other annoyances online.
- pfundstein 6y ago
  Screen sharing/recording was a new one for me when I saw this nifty site on an earlier HN post: https://gifcap.dev/ https://gifcap.dev/
  - abhiminator 6y ago
    I found out about screen-sharing through browser when I started using Discord app on the web. Was a very revealing moment for me when it came to insane advances in web technology.
    - cblconfederate 6y ago
      I think it even predates discord, i think appear.in offered it many years ago
- catchmeifyoucan 6y ago
  I just tried cover your tracks. What's blowing my mind are the "System Fonts" field. As a designer, I constantly download fonts, and it makes my browser extremely unique it seems.
  - gsnedders 6y ago
    This is why Safari only exposes pre-installed fonts that come with the system to web content; it removes what can be a very unique fingerprinting data point.
anonytrary 6y ago
Wow! The source code is extremely readable as well. This is great documentation. Bookmarking for sure.
simonebrunozzi 6y ago
I might have discovered a Chrome bug. 1) Turn bluetooth off. 2) Click the "bluetooth" button, then deny it. 3) Chrome crashes.
- llacb47 6y ago
  What operating system?
- techrat 6y ago
  I wonder if it's OS dependent. xUbuntu 20.04, Chrome 88 and Chromium 89, could not duplicate.
- dorianmariefr 6y ago
  https://bugs.chromium.org/p/chromium/issues/entry https://bugs.chromium.org/p/chromium/issues/entry ? They will probably fix it
BelenusMordred 6y ago
Doesn't include motion sensors, I think there might be a few other recent additions also missing. Of all the sites on Earth that I could learn this existed in the browser, it was rolling stone, with some generic static article on something I can't even remember. Why exactly does a magazine need access to my gyroscope, magnetometer and acceleration sensors? Especially considering that I'm on a desktop that thankfully doesn't have such things.
- bhrgunatha 6y ago
  My cynical guess is to help identify you to advertisers or something to sell to data brokers.
  - kube-system 6y ago
    Unless the page has some feature that obviously uses accelerometer features, it’s 100% that, no cynicism necessary. This is a not-uncommon fingerprinting technique.
- bchanudet 6y ago
  In order to experiment with WebXR without having my Oculus continously on my head, I installed the WebXR emulator extension from Mozilla. I'm stunned how often I get the permission prompt on completely unrelated websites. I guess it allows tracking scripts to do even more fingerprinting.
  - capableweb 6y ago
    > I'm stunned how often I get the permission prompt on completely unrelated websites. I have the same problem and found that the embedded Vimeo player assumes all videos could be played in VR, although the video is a normal, flat video, so any webpage embedding a Vimeo video, prompts that permission notification for me, although the actual video could be on a different page but still initialized on page load.
- yread 6y ago
  To see whether you're rolling?
imwillofficial 6y ago
This is seriously cool. A great way to self audit browser security in a user friendly way.
penguin_booze 6y ago
It was unknown to me until last week that web browsers can now share screens--I mean the whole desktop! I had to do a webex session, and I assumed I needed either Chrome or some kind of native app to do screen share. But, to my pleasant surprise, webex worked well with Firefox! Also new to me is 'pointer locking'. I wonder/wish if/when browsers would be able to transparently pass key bindings that'd otherwise be captured by the OS, like Alt+Tab. Then, just by visiting a website, I could use, for example, Citrix desktop remote login through my browser as if it were a native app.
- soylentgraham 6y ago
  Chrome remote desktop has quickly replaced teamviewer, vnc, ms remote desktop and osx screenshare for me, in one fell swoop! Most significantly for helping other developers (usually just to undo a git state :)
- tyingq 6y ago
  There is a keyboard lock api, and you can capture Alt+Tab, but only when you're already in full-screen mode. Mostly Chrome only: https://caniuse.com/mdn-api_keyboard_lock https://caniuse.com/mdn-api_keyboard_lock
sloshnmosh 6y ago
Ha! Just by coincidence when I opened the site in Safari on iOS I got a pop-up message that my SIM card had sent a text message.
uploaderwin 6y ago
It's so sad that such amazing features are often abused more than they are actually used. It's always a cat and mouse game with the browser vendors and ad makers. Like web push notifications and popups are two really useful features but the amount of abuse they have had to endure is amazing. Every shitty site from newspapers to reddit to facebook must show a dark screen and ask me to subscribe to web notifications before i can see anything. Then there are hidden APIs for which no permission is needed, like trapping of the back button (where a site gains access to my browser's back button and won't let you go back) and page close button (where it shows a popup asking you to confirm you want to leave).
- prox 6y ago
  Well, in the case of news, they need to make money. If they can’t show you ads, you are of zero value to them, only adding to costs (and I hate the practice just as much) What I want since forever is a tipjar that works well. I put a bit of credit into my tipjar. I read an article and at the halfway point it allows me to tip an amount. Should be anonymous if I want and a one or two clicks affair.
- Debug_Overload 6y ago
  Blocking notifications by default made my browsing experience so much better. The amount of "allow notifications" bullshit on the Web is insane.
  - postalrat 6y ago
    You must be visiting some shady sites.
    - Debug_Overload 6y ago
      The trend of asking for notifications is not just limited to "shady" sites, however you define that.
- jooize 6y ago
  Push notifications in Safari just suck because the discoverability method is a dialogue box that interrupts and blocks all other user actions. The browser should never let a website interrupt unless allowed by the user. Place a bell icon in the address bar and make it translucently balloon up when triggered for visibility. Side note: Browser interface should stay outside the untrusted zone of web content. Whenever it can't, interface could have an unobtrusive unimitable background pattern extending from the trusted zone into the untrusted zone. The user should always know what is browser or website.
mkarliner 6y ago
Err, I'm getting no warning for screen share. Chrome on Android.
- abraham 6y ago
  The Screen Capture API isn't supported on mobile Chrome. https://developer.mozilla.org/en-US/docs/Web/API/Screen_Capture_API#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/API/Screen_Capt...
z3t4 6y ago
There is this philosophical dilemma. Should your Stark-trek-inspired food-machine be able to load recipes from an URL, using a standard recipe-format, or should an URL on your computer device load an app that connects to the food-machine... ? eg. static web with different kinds of formats and devices - versus web-apps and API's
LeonM 6y ago
Funny, this URL reliably crashed my tab in FF 86.0.1 on Linux (with Wayland). When trying to open the debugger console I suddenly got the annoying 'firefox has to update' page, that updated to 87.0, and now it works.
aerique 6y ago
Yes, I'm going to be the guy that mention that this site does not do a thing with NoScript running. I'm always so happy with this addon and the first thing I install on a new machine.
- Jleagle 6y ago
  Always wanted to use it but don't you just have to enable it on every site you visit anyway to make them function?
  - aerique 6y ago
    No, if you just need to read some text a lot of sites function with JavaScript disabled. Also, you can permanently enable sites, so often it is a one-time flip of the switch. I think (but never really researched and enabled it) you can also have it run in whitelist mode by default, so that you can disable JS for specific sites. Best to give it a try though.
    - sanitycheck 6y ago
      ...and after that first pass of enabling only what's needed to get a site to work sufficiently well, that site tends to be significantly more pleasant to use in future. I enabled JS for just eff.org, and coveryourtracks tells me I'm still spewing 17.12 bits of fingerprint all over the internet. I suppose it'd be possible for a browser to randomly rotate stuff like user-agent through multiple common values to mitigate that.
GeneticGenesis 6y ago
So many permissions, but meanwhile autoplaying video and audio is still hidden behind a horrible heuristic model in Chrome that fundamentally prioritises internet giants like YouTube, Netflix and alike.
RootKitBeerCat 6y ago
Async - clipboard: does this mean with a button press a site can copy what’s in your memories “copy”/clipboard functionality?!
- akvadrako 6y ago
  No, it can only write to the clipboard, at least in Firefox.
- abraham 6y ago
  Yes, if the user grans the site permission. https://web.dev/async-clipboard/ https://web.dev/async-clipboard/
codykochmann 6y ago
I think so far the best setup Ive seen of this for browser restriction for a session is with running the browser in firejail. https://github.com/netblue30/firejail https://github.com/netblue30/firejail
nakovet 6y ago
I would like to be able to take a screenshot of the user page (with their permission) using native APIs, that would be amazing for sharing content, bug reporting, etc. Google has a feedback tool that leverages html2canvas.
- dorianmariefr 6y ago
  why not use html2canvas?
deleted 6y ago
[deleted]
egberts 6y ago
This is awesome. I used it to pre-configure all six web browsers’ access permission (nearly all to deny mode).
avipars 6y ago
site seems to be run by google employees
randompwd 6y ago
No way to disable Bluetooth in latest Chrome on Windows 10 (89.0.4389.90)

728 points by valand 6y ago

Cool site. I'm a bit annoyed that sites can seemingly overwrite your clipboard without confirmation, on Android at least!

skzv 6y ago
No, it makes sense. "Copy this" buttons are common on websites, but probably require a button click to initiate. Since you clicked on a button, you provided the input necessary to copy to the clipboard.
- judge2020 6y ago
  Copying to the clipboard is unrestricted even without a click, but reading clipboard text requires a permission popup. https://web.dev/async-clipboard/#security-and-permissions:~:text=Permissions%20for%20copy%20and%20paste%20have%20been%20added%20to%20the https://web.dev/async-clipboard/#security-and-permissions:~:...
  - axaxs 6y ago
    This is exactly what I was thinking. Theoretically, a bad actor could have a site or even inject code onto a site with an innocuous looking bash command, but upon copy injects say, rm -rf ~ \n
    - judge2020 6y ago
      This can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942 https://security.stackexchange.com/a/113630/96942
      - axaxs 6y ago
        Really interesting(and terrifying) reads, thank you.
      - kelnos 6y ago
        Seems like this requires you to select some text (which includes some text that's been hidden using CSS tricks) and copy it. So it's not like the website can just arbitrary write to your clipboard without your interaction? (Still, this is kinda scary and I didn't know about this.)
        input_sh 6y ago
        They can append the message to whatever you'll actually want to copy, which is how websites used to do things like this. - Copied from https://news.ycombinator.com/item?id=26590437 https://news.ycombinator.com/item?id=26590437
    - SilverRed 6y ago
      The real bug is that \n pasted in to the terminal counts as hitting enter. iTerm has fixed this but every linux terminal I have used has this issue.
      - vanviegen 6y ago
        Is it still possible to paste into vim, for example? If so, how does the terminal make the distinction?
      - shakna 6y ago
        Every Linux terminal I've used has a pop-up when there's a new newline. Like this, which in this case is xfce4-terminal. [0] [0] https://i.imgur.com/ubCXASQ.png https://i.imgur.com/ubCXASQ.png
        PowerBar 6y ago
        Huh, I've never gotten a prompt like that in Terminator.
        judge2020 6y ago
        Same for Windows Terminal: https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86wUU.png https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86...
        axaxs 6y ago
        Gnome-terminal, probably the largest by user base, does not sadly.
  - kelnos 6y ago
    Is it? When I click the "Write" button, it turns green, but when I click "Write (delayed)", after a while it turns red. So it seems (at least on Firefox 87) even the clipboard write API is restricted to user-action event handlers.
mrtksn 6y ago
It’s also a privacy issue. Google’s Firebase Dynamic links is using it non-maliciously to survive app installs for deep linking(when the app is not installed it helps you redirect the user to the correct screen after the install), however any webpage can actually put something on your clipboard and match you on an app by reading your clipboard. With iOS14 at least we can tell when apps are reading the clipboard.
walrus01 6y ago
Seems like a great method to social engineer people into copying to clipboard something that will install a trojan, get them to open a command prompt and paste it, in the general concept of curl piped into a shell.

kristopolous 6y ago

Hey, sorry, I'm really dumb here. How would one use this?

I_Byte 6y ago
It appears as though you click on each button and see what color the button turns. If the button turns red the site doesn’t have the permission to do what the button says. If the button turns green then the site can do what the button says.
- jononomo 6y ago
  I think his question is: what's the point?
  - pfundstein 6y ago
    Mostly as a tool for developers to test various permissions on various browsers
    - hunter2_ 6y ago
      I guess this rabbit hole continues if one asks what the point of such testing could be. One thing I'd find useful is that I could take screenshots (or live demo this site) if I was doing some non-web-development thing such as doing a presentation and wanted to explain WebAuthn flow or something. Because if I was a developer doing development, I'd test browsers with what I developed.
      - leipert 6y ago
        Or maybe you are a developer of that is using one of the features for the first time. Now you can check out the permission flow without having written any code. Similar to live examples in MDN.
  - PurpleFoxy 6y ago
    I found it interesting to see what happens on safari on iOS after each permission was requested. About 1/3 did nothing, a few of them were denied without a prompt, a few of them were as expected. And a few of them had weird prompts like the pan/tilt on asking for camera permission. Was also interesting to see webauthn ask if I wanted to allow a site to use faceid which I didn’t know was even possible

kijin 6y ago

The mouseover effect on the HTTP/HTTPS toggle is very annoying. It makes it hard to ascertain which mode you're actually in while the cursor is anywhere near it.

kevingadd 6y ago
Yeah, I clicked that thing like 6 times before I understood. For the confused: Check the address bar, clicking it actually changes the URL of the site (to flip you into/out of secure mode)
- Andrew_nenakhov 6y ago
  I still don't get it. Clicking the address bar or the switch toggle does nothing for me. Manually entering http://permission.site http://permission.site also doesn't help
  - MauranKilom 6y ago
    Do you maybe have HTTPS everywhere installed? Or is your browser maybe set to always choose HTTPS if possible? (The former applies to me, and clicking the toggle does nothing for me either.)
spion 6y ago
I wonder if this is the default behavior from some UI toolkit or is it custom...

soheil 6y ago

I had no idea you could screen share in JS.

kmeisthax 6y ago
Yup! Meeting apps need it.
smaddock 6y ago
Desktop and window capture is included for all platforms as part of WebRTC.
joshribakoff 6y ago
Can record to video too, sort of like logrocket

airstrike 6y ago

For some reason the regular popup works without asking for my permission, whereas the delayed one gets blocked by Firefox (86.0.1 on Windows 10)

kristofferR 6y ago
That's intentional. Instant popups from clicks can have totally legitimate uses (like logging into sites like Disqus/Paypal etc on external sites). Delayed popups have very few, if any, legitimate uses.
thomasfoster96 6y ago
This will happen in most browsers (I’m on Safari 14, macOS 11.2). The popup-blockers in most browsers will allow a popup if it is opened directly because of user input, such as a button click — a fairly simple measure which can be implemented by only allowing certain APIs to work within an event handler, for example. There are a few Web APIs which work this way — for example, you can’t make a page fullscreen unless you do so in response to user input/interaction [0]. [0]: https://developer.mozilla.org/en-US/docs/Web/API/Element/requestFullScreen https://developer.mozilla.org/en-US/docs/Web/API/Element/req...
wnevets 6y ago
Popups triggered by a user are considered trusted and are usually allowed https://developer.mozilla.org/en-US/docs/Web/API/Event/isTrusted https://developer.mozilla.org/en-US/docs/Web/API/Event/isTru...

walrus01 6y ago

There is no way that 'pointer lock' should be something you can just click and get your pointer hijacked. You could label that button anything or make it any clickable element. Who the hell at web browser developers thought that was a good idea to implement? Why not have a "Do you want to allow this site to take control of your pointer?" prompt, same as when a site first wants to use your microphone or camera?

yyx 6y ago
Maybe it's used for fullscreen games?
- walrus01 6y ago
  I'm sure it is, and works great for that, I just think it needs one more layer of user consent and understanding before it's turned on.
- tyingq 6y ago
  I see it in emulators, like this one: https://www.pcjs.org/software/pcx86/sys/windows/3.10/ https://www.pcjs.org/software/pcx86/sys/windows/3.10/ (click one of the Windows apps once it boots)
alpb 6y ago
I think lots of stuff like RDP extensions, or browser-based gaming (e.g. Stadia) are using it.
kevingadd 6y ago
There are a ton of use cases that demand it, so it was added a long time ago (around the same time as Fullscreen, I think). The current user experience for it (opt-out instead of opt-in) has likewise been around for ages. I think I remember seeing an explicit permission prompt very early on but they got rid of it. "You could label that button anything" sadly applies to a significant number of dangerous things a website can do, pointer lock is not near the top of the list.
cyberdummy 6y ago

abhiminator 6y ago

Absolutely blown away by the number of things you can do from a web browser these days. All of this would've been unimaginable a mere 10 years ago, right around the time when Google Chrome was in its infancy (or just out of it, to be precise) and the web browser market was still dominated by Internet Explorer, with Opera, Firefox and Safari (back when there was a Windows version of Safari) taking up small slices of the market share. Another cool site to check out: https://coveryourtracks.eff.org https://coveryourtracks.eff.org -- a great tool to see how unique your browser's 'fingerprint' is and how well it protects you from trackers and other annoyances online.

pfundstein 6y ago
Screen sharing/recording was a new one for me when I saw this nifty site on an earlier HN post: https://gifcap.dev/ https://gifcap.dev/
- abhiminator 6y ago
  I found out about screen-sharing through browser when I started using Discord app on the web. Was a very revealing moment for me when it came to insane advances in web technology.
  - cblconfederate 6y ago
    I think it even predates discord, i think appear.in offered it many years ago
catchmeifyoucan 6y ago
I just tried cover your tracks. What's blowing my mind are the "System Fonts" field. As a designer, I constantly download fonts, and it makes my browser extremely unique it seems.
- gsnedders 6y ago
  This is why Safari only exposes pre-installed fonts that come with the system to web content; it removes what can be a very unique fingerprinting data point.

anonytrary 6y ago

Wow! The source code is extremely readable as well. This is great documentation. Bookmarking for sure.

simonebrunozzi 6y ago

I might have discovered a Chrome bug. 1) Turn bluetooth off. 2) Click the "bluetooth" button, then deny it. 3) Chrome crashes.

llacb47 6y ago
What operating system?
techrat 6y ago
I wonder if it's OS dependent. xUbuntu 20.04, Chrome 88 and Chromium 89, could not duplicate.
dorianmariefr 6y ago
https://bugs.chromium.org/p/chromium/issues/entry https://bugs.chromium.org/p/chromium/issues/entry ? They will probably fix it

BelenusMordred 6y ago

Doesn't include motion sensors, I think there might be a few other recent additions also missing. Of all the sites on Earth that I could learn this existed in the browser, it was rolling stone, with some generic static article on something I can't even remember. Why exactly does a magazine need access to my gyroscope, magnetometer and acceleration sensors? Especially considering that I'm on a desktop that thankfully doesn't have such things.

bhrgunatha 6y ago
My cynical guess is to help identify you to advertisers or something to sell to data brokers.
- kube-system 6y ago
  Unless the page has some feature that obviously uses accelerometer features, it’s 100% that, no cynicism necessary. This is a not-uncommon fingerprinting technique.
bchanudet 6y ago
In order to experiment with WebXR without having my Oculus continously on my head, I installed the WebXR emulator extension from Mozilla. I'm stunned how often I get the permission prompt on completely unrelated websites. I guess it allows tracking scripts to do even more fingerprinting.
- capableweb 6y ago
  > I'm stunned how often I get the permission prompt on completely unrelated websites. I have the same problem and found that the embedded Vimeo player assumes all videos could be played in VR, although the video is a normal, flat video, so any webpage embedding a Vimeo video, prompts that permission notification for me, although the actual video could be on a different page but still initialized on page load.
yread 6y ago
To see whether you're rolling?

imwillofficial 6y ago

This is seriously cool. A great way to self audit browser security in a user friendly way.

penguin_booze 6y ago

It was unknown to me until last week that web browsers can now share screens--I mean the whole desktop! I had to do a webex session, and I assumed I needed either Chrome or some kind of native app to do screen share. But, to my pleasant surprise, webex worked well with Firefox! Also new to me is 'pointer locking'. I wonder/wish if/when browsers would be able to transparently pass key bindings that'd otherwise be captured by the OS, like Alt+Tab. Then, just by visiting a website, I could use, for example, Citrix desktop remote login through my browser as if it were a native app.

soylentgraham 6y ago
Chrome remote desktop has quickly replaced teamviewer, vnc, ms remote desktop and osx screenshare for me, in one fell swoop! Most significantly for helping other developers (usually just to undo a git state :)
tyingq 6y ago
There is a keyboard lock api, and you can capture Alt+Tab, but only when you're already in full-screen mode. Mostly Chrome only: https://caniuse.com/mdn-api_keyboard_lock https://caniuse.com/mdn-api_keyboard_lock

sloshnmosh 6y ago

Ha! Just by coincidence when I opened the site in Safari on iOS I got a pop-up message that my SIM card had sent a text message.

uploaderwin 6y ago

It's so sad that such amazing features are often abused more than they are actually used. It's always a cat and mouse game with the browser vendors and ad makers. Like web push notifications and popups are two really useful features but the amount of abuse they have had to endure is amazing. Every shitty site from newspapers to reddit to facebook must show a dark screen and ask me to subscribe to web notifications before i can see anything. Then there are hidden APIs for which no permission is needed, like trapping of the back button (where a site gains access to my browser's back button and won't let you go back) and page close button (where it shows a popup asking you to confirm you want to leave).

prox 6y ago
Well, in the case of news, they need to make money. If they can’t show you ads, you are of zero value to them, only adding to costs (and I hate the practice just as much) What I want since forever is a tipjar that works well. I put a bit of credit into my tipjar. I read an article and at the halfway point it allows me to tip an amount. Should be anonymous if I want and a one or two clicks affair.
Debug_Overload 6y ago
Blocking notifications by default made my browsing experience so much better. The amount of "allow notifications" bullshit on the Web is insane.
- postalrat 6y ago
  You must be visiting some shady sites.
  - Debug_Overload 6y ago
    The trend of asking for notifications is not just limited to "shady" sites, however you define that.
jooize 6y ago
Push notifications in Safari just suck because the discoverability method is a dialogue box that interrupts and blocks all other user actions. The browser should never let a website interrupt unless allowed by the user. Place a bell icon in the address bar and make it translucently balloon up when triggered for visibility. Side note: Browser interface should stay outside the untrusted zone of web content. Whenever it can't, interface could have an unobtrusive unimitable background pattern extending from the trusted zone into the untrusted zone. The user should always know what is browser or website.

mkarliner 6y ago

Err, I'm getting no warning for screen share. Chrome on Android.

abraham 6y ago
The Screen Capture API isn't supported on mobile Chrome. https://developer.mozilla.org/en-US/docs/Web/API/Screen_Capture_API#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/API/Screen_Capt...

z3t4 6y ago

There is this philosophical dilemma. Should your Stark-trek-inspired food-machine be able to load recipes from an URL, using a standard recipe-format, or should an URL on your computer device load an app that connects to the food-machine... ? eg. static web with different kinds of formats and devices - versus web-apps and API's

LeonM 6y ago

Funny, this URL reliably crashed my tab in FF 86.0.1 on Linux (with Wayland). When trying to open the debugger console I suddenly got the annoying 'firefox has to update' page, that updated to 87.0, and now it works.

aerique 6y ago

Yes, I'm going to be the guy that mention that this site does not do a thing with NoScript running. I'm always so happy with this addon and the first thing I install on a new machine.

Jleagle 6y ago
Always wanted to use it but don't you just have to enable it on every site you visit anyway to make them function?
- aerique 6y ago
  No, if you just need to read some text a lot of sites function with JavaScript disabled. Also, you can permanently enable sites, so often it is a one-time flip of the switch. I think (but never really researched and enabled it) you can also have it run in whitelist mode by default, so that you can disable JS for specific sites. Best to give it a try though.
  - sanitycheck 6y ago
    ...and after that first pass of enabling only what's needed to get a site to work sufficiently well, that site tends to be significantly more pleasant to use in future. I enabled JS for just eff.org, and coveryourtracks tells me I'm still spewing 17.12 bits of fingerprint all over the internet. I suppose it'd be possible for a browser to randomly rotate stuff like user-agent through multiple common values to mitigate that.

GeneticGenesis 6y ago

So many permissions, but meanwhile autoplaying video and audio is still hidden behind a horrible heuristic model in Chrome that fundamentally prioritises internet giants like YouTube, Netflix and alike.

RootKitBeerCat 6y ago

Async - clipboard: does this mean with a button press a site can copy what’s in your memories “copy”/clipboard functionality?!

akvadrako 6y ago
No, it can only write to the clipboard, at least in Firefox.
abraham 6y ago
Yes, if the user grans the site permission. https://web.dev/async-clipboard/ https://web.dev/async-clipboard/

codykochmann 6y ago

I think so far the best setup Ive seen of this for browser restriction for a session is with running the browser in firejail. https://github.com/netblue30/firejail https://github.com/netblue30/firejail

nakovet 6y ago

I would like to be able to take a screenshot of the user page (with their permission) using native APIs, that would be amazing for sharing content, bug reporting, etc. Google has a feedback tool that leverages html2canvas.

dorianmariefr 6y ago
why not use html2canvas?

deleted 6y ago

[deleted]

egberts 6y ago

This is awesome. I used it to pre-configure all six web browsers’ access permission (nearly all to deny mode).

avipars 6y ago

site seems to be run by google employees

randompwd 6y ago

No way to disable Bluetooth in latest Chrome on Windows 10 (89.0.4389.90)