15 ms·

Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

467 points by danpinto 5y ago

kjrose 5y ago
As a note, this doesn't seem to work with Brave. It only got one of the applications my machine has installed, and I don't have a slow machine nor a slow internet where I am. I'm a bit surprised it got even one of them though. I will need to review my Brave privacy settings and see if anything can be done.
- pier25 5y ago
  I just tried it with the latest version of Brave and it found: Skype, Zoom, VSCode, Adobe, and iTunes. This only checks 24 apps, and it got all the ones I have installed out of those 24.
bronzeage 5y ago
Looking at their product, I wonder how many of these kind of vulnerabilities are still open and exploited by them. Wouldn't make much sense for them to burn such a useful vulnerability which is required for their product unless they had something better.
- grishka 5y ago
  Interesting to see how their product is open source, too: https://github.com/fingerprintjs/fingerprintjs/ https://github.com/fingerprintjs/fingerprintjs/ It's as if they want browser developers to look at the code and break it as much as possible.
- harikb 5y ago
  > DISCLAIMER: FingerprintJS does not use this vulnerability in our products and does not provide third-party tracking services
- dathinab 5y ago
  You can get a lot of entropy just by fingerprinting things send over HTTP headers and things freely accessible by JS. E.g. user agent, screen dimensions, language, web GL, audio api, etc. Generally wrt. fingerprinting chrome is worse then Firefox as Firefox actively worked to reduce fingerprint-ability if possible, while chrome seems to not care much. Because of this ironically I have a less unique fingerprint on a customized Firefox browser then a "stock" Chrome browser even through much less people use Firefox... The reason (I think) why they make this public is because this can be used for more then "just" fingerprinting. I.e. this can be used by cyber attacks to find a potential attack vector to then pull of either a direct attack or some social engineering attack.
  - the_duke 5y ago
    Firefox also has a lot of settings that mitigate various finger printing techniques. There are some good sample configs on Github. [1] Ironically, many of the settings can make you more unique because they disable a lot of functionality. [1] https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js
    - KirillPanov 5y ago
      This is why the torbrowser/firefox "try to make everybody look the same" approach is doomed. Adding white noise is the only solution: "try to make your fingerprint on each website for each brower-restart look as different as possible (a) from your fingerprint on every other website and (b) from your fingerprint on the same website on a previous browser-restart". That's the best you can do anyways without rejecting first-party cookies. Brave does this, and it is the right way. I just wish Firefox would wake up and clue in to this.
harikb 5y ago
> Profiling based on installed apps > most browsers have safety mechanisms in place designed to prevent such exploits. Weaknesses in these safety mechanisms are what makes this vulnerability possible. > By specification, extensions need to be able to open custom URLs, such as mailto: links, without confirmation dialogs. The scheme flood protection conflicts with extension policies so there is a loophole that resets this flag every time any extension is triggered If true, this sounds worse revelation than the exploit itself. Disabling a flag temporarily sounds bad, regardless of whether a vulnerability exists.
jowsie 5y ago
I ran this in Chrome and then in Edge and got different identifiers.
- kdarutkin 5y ago
  Chromium results may be flaky on slow internet or because of less performant hardware (such as Virtual Machines). I've updated the demo for Chromium and made it work slower, in order to increase accuracy.
buggeryorkshire 5y ago
I've no idea whether it works, but they misidentified many apps I don't have installed (Postman, Express VPN, Notion, Figma, Hotspot Shield) It does do the popup for VSCode asking if I want to open links there, which I do have installed.
- yjftsjthsd-h 5y ago
  Yeah, it gave me quite a list of programs, including xcode and itunes, which is fascinating on a Linux box... they list 20 programs they think I have installed, of which I actually have 2. I'm not sure why it would be so inaccurate, but I feel better...
  - nolok 5y ago
    > I'm not sure why it would be so inaccurate, but I feel better... I don't think you understood the core of the issue: it's not about identifying which applications you have installed, it's about always getting the same result for the same user. If all your browsers serve the same results, you are trackable, no matter if those results are good or not.
    - filmfact 5y ago
      I think the implication is that this is far fewer bits of entropy than the authors indicate. Four bits (in isolation), are not a meaningful identifer.
      - nolok 5y ago
        It's not four, the fact that the others applications are reliably detected as not present are additional bits.
- dathinab 5y ago
  I guess (and just that), that this can happen if there are overlaps in the scheme handlers. I.e. there are some schemas which lets say XCode handles but which also some other program handles.
agilob 5y ago
Tried Chrome, Brave and Firefox, got 3 different IDs. On one of the browsers it also didn't detect slack and vscode being installed.
- dathinab 5y ago
  > didn't detect slack and vscode being installed. Is it you main browser in which you had used slack url's/ set slack to always handle the links? Or is it the opposite? Or maybe something else?
- kdarutkin 5y ago
  Hi, agilob. I've updated the demo for Chromium and made it work slower, in order to increase accuracy. See also https://news.ycombinator.com/item?id=27147325 https://news.ycombinator.com/item?id=27147325
  - agilob 5y ago
    Now I got an identifier that you saw 2 times before: >This is your identifier. It was seen 2 times among 8828 tests so far. None of these was my run. Still, didn't detect vscode :)
Operyl 5y ago
It's not detecting many of the supported applications on my Mac in Safari.
- dzhiurgis 5y ago
  It did for me and compared with Chrome identified everything to same identifier.
- kdarutkin 5y ago
  The exploit was tested in Safari 14.0.3 and 14.1 on MacBook M1 and MacBook Pro. What version do you have?
  - Operyl 5y ago
    14.1 on an M1 MBP.
    - kdarutkin 5y ago
      Wow, that's weird. The internet connection may be the issue here, or the custom configuration on Safari.
nimbius 5y ago
>By opening a popup window with a custom URL scheme and checking if its document is available from JavaScript code, you can detect if the application is installed on the device. in FF, unless im mistaken this assumes the user clicks anything except cancel on the popup. bug for reference and comment. https://bugzilla.mozilla.org/show_bug.cgi?id=1711084 https://bugzilla.mozilla.org/show_bug.cgi?id=1711084 further from the github: > the basic concept is the same. It works by asking the browser to show a confirmation dialog in a popup window. Then the JavaScript code can detect if a popup has just been opened and detect the presence of an application based on that. so...we seem to be relying on the honor system with the user? Can anyone clarify?
- dathinab 5y ago
  Basically browsers have the "I open a popup to ask" or "the user has no schema handler for that schema so I don't need to ask" or the "User already confirmed it always should open the link with given application" behaviour and they can detect it "somehow "? But I still have to look closer into it.
  - valve1 5y ago
    Browsers open pop-ups to ask "Can I run that application?" but only if that application is installed. If that application is not installed, the browser will ignore the custom URL.
    - jszymborski 5y ago
      It looks like a mitigation might be that in the event you do not have the application installed, to return a "denied" status and send a prompt to the user like "Unknown application protocol". Something like that could still would be susceptible to a timing attack though.
      - Haemm0r 5y ago
        always show the popup, but populate it "later" could work too.
matsemann 5y ago
Interesting concept. Most fingerprinting I've seen so far has for instance used the GPU to detect small differences in rendering, but also based on browser. First cross-browser I've seen, barring the obvious stuff like IP or so. Hope this won't be a post where everyone that didn't get the same identifier have to proclaim it, though. We get it, it's not perfect. FWIW I got same in Edge & Fx and it claimed it was a unique combo (different ID in Chrome, though).
jraph 5y ago
On Linux: - in Firefox, it detected Epic Games Telegram Discord Battle.net Xcode NordVPN Sketch Teamviewer Microsoft Word WhatsApp Postman Adobe Messenger Figma Hotspot Shield ExpressVPN Notion iTunes, none of which I have installed. It didn't detect VSCode though I have VSCodium. - On Chromium, it warned it would not work well on Chrome on Linux. It incorrectly detected all the apps. It seems that the browser would try to open the links with xdg-open. Clever hack anyway!
- valve1 5y ago
  Thanks for testing it on Linux. We only tested it on these browser + OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#target-browsers https://github.com/fingerprintjs/external-protocol-flooding#...
  - jraph 5y ago
    if you need more info: Firefox 88.0.1 (64 bits), Chromium 90.0.4430.93, on openSUSE Tumbleweed
- DistressedDrone 5y ago
  Using Firefox on Linux, it detected all the apps (very few of which I have) except Skype (correct, I don't have it). Security through obscurity does it again!
- psanford 5y ago
  Also Chrome on Linux. For me it says it detected 11 apps installed, but I don't have any of those apps installed. Strange. Edit: With firefox it is able to correctly detect 3 installed desktop applications.
- jeltz 5y ago
  Yup, it was broken for me too on Linux unless I somehow have managed to install both Xcode and MS Word. :)
jedberg 5y ago
Did it on Chrome, Firefox, and Safari and got the same code on all three. In all three it failed to detect some apps, but the same ones failed each time. When I did it in Safari it actually caused Apple Music to open. When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Firefox was the only one where it was silent. But still, that's an interesting hack. Very clever.
- cdubzzz 5y ago
  > When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Interesting. In my case I saw the little pop up window in all three browsers. Otherwise same results though.
  - busymom0 5y ago
    I just verified this on my machine and it was able to uniquely identify across Brave browser, Firefox and Epic browser (based on Chromium). I didn't check Safari because that's the browser I use the most and don't want to test on that. The Epic browser one was interesting. That browser comes with a built in proxy for routing connections through other countries. I use it to get around geolocked content and sometimes for a tiny sense of anonymity. But seeing this able to identify it with same identifier as Brave and Firefox was a bit more troubling. But I guess that comes with the territory of all these browsers using the same Chromium engine.
    - nieve 5y ago
      Firefox somewhat famously doesn't use the same Chromium engine.
- danudey 5y ago
  I "saw" the little square window in Firefox on Windows 10, but only because I was paying attention. It was down in the corner, on (for some reason) my second monitor.
  - 5y ago
rozab 5y ago
Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing with detection. [0]: https://github.com/fingerprintjs/external-protocol-flooding/blob/3076ec617f5e5ab1ad72642898ca01f40271cf41/packages/client/src/detector/detection.ts#L222 https://github.com/fingerprintjs/external-protocol-flooding/...
- kdarutkin 5y ago
  Any custom settings may affect the result. However default settings will work for the Firefox 88.0.1. Was tested on Windows, Safari and Linux. Chrome does not work on Ubuntu, since it opens everything with xdg-open and creates confirmation dialog for both installed and not-installed application
- jedberg 5y ago
  It seems that it's not very effective in Linux.
  - valve1 5y ago
    Yeah, we tested it on MacOS Big Sur mostly. Nobody on the team had linux so we didn't really test there. It can be made to work with better timings for the measurements etc.
  - samjanis 5y ago
    Linux Firefox used Schemeflood! v It's not very effective....
- kurthr 5y ago
  I find it interesting that it shows I have Skype installed... when I don't.
  - 5y ago
bryanrasmussen 5y ago
This seems less promising as a means to uniquely identify users than supercookies, Time-Based Device Fingerprinting, or other hardware based methods.
skykooler 5y ago
Interestingly, custom URL handlers seem to stick around even after the app associated with them has been uninstalled. For example, this detected Messenger's URL handler although I uninstalled it a year ago.
- rkagerer 5y ago
  Not the least bit surprised. I use Total Uninstall and almost every app leaves bits behind. I've complained to many vendors and sent technical details of missed registry keys, files, etc. Sometimes they even fix it. But on the whole, Uninstall on Windows is a bit of a myth.
mwvr 5y ago
It somehow "detected" skype and discord as being installed on my OpenBSD machine with Firefox? Hahaha.
deleted 5y ago
[deleted]
conradev 5y ago
Finding new a fingerprinting mechanism in JavaScript is like finding a new memory corruption bug in the web browser engine. They are always going to exist for architectural reasons, some are worse than others, and the really bad ones are likely kept nice and secret while they are actively exploited. In other words, I'm not surprised in the slightest, but I'm glad that this is out in the open now.
wnevets 5y ago
It though I had Skype, Spotify and Slack installed. I only have Slack installed.
- valve1 5y ago
  Windows can sometimes say you have Skype, because it comes bundled even if you didn't install it yourself.
  - wnevets 5y ago
    I've explicitly uninstalled it on Windows 10, maybe Windows is still reporting it?
    - tick_tock_tick 5y ago
      Windows 10 does some garbage where it installs handlers for URL schemas that take you to the windows store install page for the app. The vulnerability is only testing if you have an handler installed for skype:// not what application is actually handling it.
      - wnevets 5y ago
        Windows 10 must be doing something weird. Skype url handlers aren't triggering the window stores or anything else from links. https://jsfiddle.net/ourcodeworld/aqq1w0qm/ https://jsfiddle.net/ourcodeworld/aqq1w0qm/
      - wnevets 5y ago
        According to URLProtocolView[1] the handlers are still registered despite the application (and MANY others) being uninstalled. [1] https://www.nirsoft.net/utils/url_protocol_view.html https://www.nirsoft.net/utils/url_protocol_view.html
burk96 5y ago
Worked perfectly on Firefox 88.0.1 on Windows. Great to know despite my efforts to balance privacy and anonymity, there is another metric that I'm unique in. Fingerprinting is just insidious.
- sneak 5y ago
  Browsing in a VM is really one of the only safe ways to go on the modern web for privacy. So many sites break without JS, and having it enabled is an accident waiting to happen. When you need privacy, always browse in a VM or a Tails boot.
  - chithanh 5y ago
    Even in a VM you have to carefully ensure that memory deduplication is disabled, and/or some form of mitigation against Rowhammer is in place. Else you will be vulnerable to Flip Feng Shui cross-VM attacks. https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/8022.html https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events...
  - Dah00n 5y ago
    This won't work against fingerprinting unless you change the underlying hardware and / or external IP too when stating a new VM. If you don't have a unique external IP per VM you might as well not bother. It is like trying to hide from the police by changing clothes and cutting your hair but stil hold the same huge sign with your name and address in your hands.
    - sneak 5y ago
      The use of Tor or a public VPN (i.e. many hundreds of unrelated users sharing a single public IP) is implicit.
      - Dah00n 5y ago
        Since this is about fingerprinting and not hiding your identity I'm not sure this will help. If you use a public VPN you are removing some data points from the fingerprint but adding a huge new one. After all fingerprinting is about blending in and being like the average user. Adding a few privacy extensions and a VPN and you are much easier to recognise.
butz 5y ago
At least 9 of those programs could be "installed to desktop" on supported Chromium based browsers. That not only lowers your fingerprint in this particular vulnerability, but also saves quite a bit of disk space.
butz 5y ago
Test doesn't work when localStorage is disabled in browser.
difosfor 5y ago
How unique are these ids really? I imagine certain apps will be very commonly installed as well as certain groups of apps? So it's not 32bits of information. Still more information to add to the finger printing pile.. I wish we could find a way to deal with this risk that's not simply disabling all kinds of functionality. Browser APIs seem to be suffering more and more by limitations to prevent finger printing.
- Sebb767 5y ago
  > How unique are these ids really? I imagine certain apps will be very commonly installed as well as certain groups of apps? Probably worse than you think. Zoom, Skype and Slack will be very common on work computers, while game launchers like steam and epic will work quite well on gaming pcs. You can differentiate further by checking the mixing of those groups and their relative music client (Spotify, ITunes...). Of course it won't be full 32 bits, but given the amount of quite common programs with url handler, it will probably deliver quite good results.
- kdarutkin 5y ago
  We will make a detailed report with some statistics, after the vulnerability is fixed
taf2 5y ago
Interesting but only works on desktop
seumars 5y ago
Fingerprinting and profiling in general just makes me not want to use the internet sometimes. I stopped using gmail at the very least. Maybe I should start using a VPN.
Forbo 5y ago
I appear to be getting false positives with a different identifier each time I run it. It says I have 3-4 different applications installed, none of which actually are on my system. Each subsequent run comes back with a different set of applications, and a different unique identifier. Looks like I may have beaten this method of fingerprinting, although I'm not quite sure how.
tn1 5y ago
I tried it on Opera and it detected no apps installed. (On Edge however, it detects all the ones I do indeed have installed). This is interesting since I didn't really expect Opera to care about this kind of thing.
- valve1 5y ago
  Thanks for testing this on Opera, we only tested on these browser/OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#target-browsers https://github.com/fingerprintjs/external-protocol-flooding#...
johnvaluk 5y ago
This appears to depend on user interactivity. How would you silently (and accurately) use this technique to fingerprint a system for cross-browser tracking?
- valve1 5y ago
  On Tor we show a fake captcha on the demo, which allows to collect multiple key presses and use each as a user-provided trigger.
  - Ansil849 5y ago
    This is a really clever way to coerce interactivity!
    - nulbyte 5y ago
      Clever indeed; I only suspected this the second go-round, after I noticed the reload button flicker as I typed. I also noticed you don't have to press Enter or even type the correct phrase to get past the fake prompt. In hindsight, the easy to guess text should have been a dead give-away, but it wasn't.
  - johnvaluk 5y ago
    Does that bypass any alerts that would be presented to the user by the browser?
- shadowgovt 5y ago
  It would be trickier, but it's not as hard as one might want to get a user to click in such a way that the protections in place against automated behaviors can be side-stepped. I'd bet good money that this trick would be useful for anyone running either a meme generator website or a file host, for example. It'd be pretty solid in the file host in particular, because you could hide some of the obvious weird behavior behind the "We're downloading your file" delay.
gruez 5y ago
This seems wildly inaccurate for me. On firefox with resistfingerprinting it says I have 23 of the 24 applications installed (I don't, that's more incorrect than correct), and on tor browser it says 0 applications installed (also incorrect, I have a few installed).
- viseztrance 5y ago
  Strange. I have resist fingerprinting as well (running on fedora), and it correctly detected all 5 apps I had installed from the list.
anon776 5y ago
Anyone try this with tails/tor? how unique were they?
elmo2you 5y ago
Aside from profiling, can these custom URL handlers also be used as an attack vector on other installed applications? That is, assuming any of those happens to be installed and have a (input sanitation related) vulnerability. Maybe I'm just seeing ghosts here. But the idea of a web site pushing malicious links to whatever software may also be installed on the same machine, isn't a very comforting thought.
- kdarutkin 5y ago
  This is possible in theory. For example, Safari opens the Apple Music without any user prompt. The app itself is designed to handle deep links (such as opening an album or starting the song). That means you can perform a deep link forgery, in order to force the app to perform unwilling action without user confirmation.
Ansil849 5y ago
Visiting the demo website in Tor Browser (using the 'Safest' setting), the demo site displays this notice: > If you're seeing this message, that means JavaScript has been disabled on your browser, please enable JS to make this app work. Does this mean that the vulnerability does not work in Tor Browser in Safest mode? Or are there non-JS implementations of this vulnerability that would work in a browser with JS disabled?
wiiittttt 5y ago
I received different results in Firefox and Brave. Doesn't seem to be a reliable method for tracking.
kdarutkin 5y ago
I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a fullscreen mode - Slow internet connection - Gestures during the process Also, we haven’t looked into Opera yet, but we may if you ask to do it. For the technical questions or bug reports consider using Github Issues
- kdarutkin 5y ago
  I also made a special branch for Chromium (Chrome, Brave, Edge, etc.) that works much slower, but should be more accurate. It still may not work for your browser with a custom configuration. Also, it is better not to make any gestures during the process. https://github.com/fingerprintjs/external-protocol-flooding/tree/feature/chrome-long-delay https://github.com/fingerprintjs/external-protocol-flooding/... https://609d9f4d79c4f6000700782c--boring-visvesvaraya-dbefd4.netlify.app/ https://609d9f4d79c4f6000700782c--boring-visvesvaraya-dbefd4...
  - Otek 5y ago
    Opera is now fully Chromium so it should be similar to others
- adontz 5y ago
  How come you happen to detect Xcode and Sketch on Windows?
- hoistbypetard 5y ago
  Interesting work. It didn't work between firefox and chromium on my linux desktop, even trying the chromium branch. But my linux desktop already puts me into a pretty small bucket of users to begin with, so someone who's doing this may not see any joy in trying to fix that.
  - 5y ago
kofejnik 5y ago
Confirmed - my ID matched in Chrome and Safari, but Firefox just said 24 of 24 and gave a different ID. Firefox wins again!
asddubs 5y ago
On my firefox (linux) it seems to think I have everything installed for some reason. Worked on tor browser though
- dannyw 5y ago
  Xdg-open
  - KirillPanov 5y ago
    Am I the only one who utterly loathes this tool? Seriously, it maintains (among other things, yes) the mapping from filename extensions to the path of the binary that should be used to open them. It's a map : extension -> path. WhyTF does MIME have to get dragged into this? Why can't I just say "*.foo is opened with /usr/bin/foobalize"? Why must I suffer the agony of trawling the interwebs to find out that blartz.foo is actually a z-content-flavor/foobalized_v3? (Yes, I understand why browsers need to start the lookup using a MIME type. I'm talking about everything else -- the galaxy of things that don't use HTTP). And even once I've found the Magic MIME type, xdg-open still does whatever it wants, and there appears to be no way to troubleshoot it when it's being invoked by another application. Setting XDG_UTILS_DEBUG_LEVEL=999 simply prints out a list of which files its reading (I can get that from strace, thanks), with no step-by-step rundown of its decision process: $ XDG_UTILS_DEBUG_LEVEL=999 xdg-open ftp://foo.com Selected DE generic Checking /home/user/.config/mimeapps.list Checking /home/user/.local/share/applications/defaults.list and /home/user/.local/share/applications/mimeinfo.cache Checking /home/user/.local/share/applications/defaults.list and /home/user/.local/share/applications/mimeinfo.cache Checking /usr/local/share//applications/defaults.list and /usr/local/share//applications/mimeinfo.cache Checking /usr/local/share//applications/defaults.list and /usr/local/share//applications/mimeinfo.cache Checking /usr/share//applications/defaults.list and /usr/share//applications/mimeinfo.cache Checking /usr/share//applications/defaults.list and /usr/share//applications/mimeinfo.cache Okay, y'all can downvote me now, ranty time is over.
    - q3k 5y ago
      No, xdg-utils are absolutely terrible. They're a mess of untested, undebuggable, underdocumented and extremely user unfriendly shell scripts that need to die and be replaced with something that actually had some serious design thought put into it. I've once had xdg-open be absolutely broken on my machine, scanning all of my $HOME because of a file with a space character in it [1]. Any attempt to use xdg-open would pin a CPU core for 100% while bash/find recursively traversed millions of files because of missing quote characters in a shell script. Truly the pinnacle of software engineering. I wouldn't be surprised if serious security bugs lurked somewhere in it, exploitable by web pages attempting to open maliciously crafted protocol URLs. [1] - https://github.com/freedesktop/xdg-utils/commit/9816ebb3e6fd9f23e993b8b7fcbd56f92d9c9197 https://github.com/freedesktop/xdg-utils/commit/9816ebb3e6fd...
Jap2-0 5y ago
On Firefox on Windows (same results on Edge) it detected three programs I do have installed, and one I do not, and failed to detect one I do have installed. There was a moderately noticeable small window in the bottom right of the screen in both. That said, at least for tracking consistency is more important than accuracy.
hirsin 5y ago
My searching is failing, but I believe a similar scheme was uncovered in a popular app using a 'strings' equivalent. It would run through intents on iOS and Android to figure out what was installed. Interesting to see if on the web too!
deleted 5y ago
[deleted]
adontz 5y ago
Results differ wildly between browsers and even between runs within the same browser. It detects application I do not have installed and does not detect applications I do have installed. For instance it detects iTunes, XCode and Sketch, but they are Mac-only application and I am on Windows. Honestly, I believe it does not work at all.
- valve1 5y ago
  Thanks for testing it on Windows. We mostly tested it on MacOS Big Sur because all devs on the team have that OS. With Windows different timings might be needed, we'll check into it tomorrow.
  - mcpherrinm 5y ago
    On my Windows/Firefox computer, it appears to have correctly identified which 6 of the applications I have installed.
- inetknght 5y ago
  > iTunes > they are Mac-only application I remember installing and using iTunes on Windows 7. It might be that Apple doesn't distribute a modern version of iTunes. But it's certainly not true in the past.
  - adontz 5y ago
    I do not have any iTunes installed anyway.
bryan_w 5y ago
Seems like this submission is a bit undercooked. It probably should have been submitted once they had some real world samples or at least gated it to their specific use case
nanis 5y ago
Curious: > We have generated your identifier based on 1 applications you have installed. Skype Then it told me I am ninety-something percent unique... I find that odd because pretty much every Windows machine has Skype.
- SavannahJS 5y ago
  (I work at FingerprintJS) You are likely relatively unique because you only have Skype installed, whereas a lot of visitors will have more applications out of the list. Someone who has no applications on the list installed may be even more unique, for example.
  - inetknght 5y ago
    > Someone who has no applications on the list installed may be even more unique, for example. I ran it in a VM with Firefox and nothing else installed. It correctly detected nothing and stated: > This is your identifier. It was seen 273 times among 3830 tests so far. > That means it is 92.87% unique.
- tinus_hn 5y ago
  You also have none of the other tested applications; I presume most of them have Word.
  - nanis 5y ago
    > You also have none of the other tested applications; I presume most of them have Word. What makes you assume I do not have Office installed? Instead of, say, considering the possibility that the fingerprinting may not be that good.
    - tinus_hn 5y ago
      The main clue is that you are not noting that it is misdetecting anything, just that you think what it is that it is detecting is not very special.
antpls 5y ago
Could be alleviated by creating yet another permission at the browser level : "allow to link to local applications"
- livre 5y ago
  Firefox on Android has a setting "Open links in apps" and works similar to the way you describe but it's global, either enabled for all websites or disabled for all. I agree that something similar on desktop would be useful.
akersten 5y ago
I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actually launch a URL scheme, sadly. I've actually never checked the "Always open Slack for slack:// links" or similar checkboxes, precisely out of predicting shenanigans like this would happen eventually :) I wouldn't be too offended if browsers changed the way they handle schemes: always open a "how would you like to handle this link" dialog for any protocol (even if unhandled - like how Windows shows the "how would you like to open this file" dialog), to disguise whether the protocol is handled or not. Not sure I have the answer for user convenience though if someone is used to things automatically opening. That's the "inconvenience" aspect of any potential mitigation, we probably have to get rid of that "remember this choice" checkbox (well, my point is that "have to" is debatable here).
- judge2020 5y ago
  On Chrome MacOS Big Sur, it doesn't require accepting the prompt, and the demo shows you can accomplish this in a small pop-under or pop-up, which a lot of inexperienced users might simply ignore. Browser devs definitely still need to patch this vulnerability by making it an instant-return no-feedback prompt to open an application.
  - akersten 5y ago
    I think my initial reaction was too harsh; after thinking through it some more I agree and think there's an easy enough fix I posted in a sibling comment. As an aside, It's actually surprising the built-in popup blocker let so many popups come from just one user action - I would have thought the heuristic was 1 click = 1 allowed popup before Firefox started denying them.
- notRobot 5y ago
  Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt https://imgur.com/a/YqbbfPt
edoceo 5y ago
Only one right answer on my machine - that's ~5% accurate. Linux/Chrome
Isthatablackgsd 5y ago
It seem that Vivaldi have better protection against this than the rest. Running in Vivaldi will cause the demo down to crawl because I think it was trying to find the apps. It detected all of the apps but it failed to appear in the detected list. MacOS Big Sur Apple Silicon if you are wondering
- kdarutkin 5y ago
  We haven't tested Vivaldi so far and the demo is not designed for it. However that doesn't mean Vivaldi is secure against this attack.
cbsks 5y ago
How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-a-custom-url-protocol-in-windows https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinking about this more, I'm afraid that removing URI schemes from the registry may break those programs. I'd much rather have a browser level setting that will only open external http:/https: resources and other URI schemes that are configured from the browser like mailto:.
- notRobot 5y ago
  Here's one way to disable it on Windows: https://www.thewindowsclub.com/how-to-prevent-launching-apps-associated-with-file-or-uri-scheme https://www.thewindowsclub.com/how-to-prevent-launching-apps...
  - cbsks 5y ago
    The Local Group Policy setting in the link only affects Windows Store apps: "This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app." I haven't tried the registry setting, maybe that will also block normal desktop applications? Edit: it looks like the BlockProtocolElevation setting also only affects Windows Store apps.
    - notRobot 5y ago
      That's unfortunate :(
- busymom0 5y ago
  For MacOS, I was able to fix this by editing the info.plist inside each application which was detected. This lets me still keep the app but no longer get detected. WARNING: Do it at your own risk. I am fairly certain when I restart my computer, the Spotify app will no longer work as deleting the entry from the info.plist file most likely changes the signature of the app binary and it will no longer be valid. Simply uninstalling the app won't be enough. Rebuild LaunchServices is required to get rid of the registered URL scheme. The info.plist for Spotify for example is located at: /Applications/Spotify.app/Contents/Info.plist You can either do it through terminal or navigate to /Applications in finder, then right click the app and use "Show Package Content" option > Contents > Info.plist. Open the Info.plist in Xcode, look for CFBundleURLSchemes: <array> <dict> <key>CFBundleTypeRole</key> <string>Viewer</string> <key>CFBundleURLIconFile</key> <string></string> <key>CFBundleURLName</key> <string>Spotify Media</string> <key>CFBundleURLSchemes</key> <array> <string>spotify</string> </array> </dict> </array> I removed this array. Save the file. NOTE that if you previously had the app installed in a different directory, you might have to do it there too. Once done, you will have to run this command to "Rebuild LaunchServices" as explained on this Stack Overflow post. https://stackoverflow.com/questions/10156939/mac-show-delete-custom-url-schemes https://stackoverflow.com/questions/10156939/mac-show-delete... /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -kill -r -domain local -domain system -domain user Without the above command, the URL scheme wasn't getting unregistered and the site was still picking it up.
usmannk 5y ago
hm, I tried this on 2 browsers and it said I was unique both times. Shouldn't the second have been a collision?
throwawayay02 5y ago
On my 86.0.1 firefox on linux it detected nothing.
tempestn 5y ago
I tried it in Firefox and Tor, and got the same identifier for both, but in both cases it said, "This is your identifier. It is unique among [####] tests so far." But.. it wasn't unique for the second browser I tried. And they'd be coming from different IPs, so it wouldn't have any way to know both were coming from the same person, aside from the fingerprinting itself...
jonnycomputer 5y ago
First time had 2 apps that aren't installed. Second two attempts didn't detect those two apps. I didn't even notice the window flashing the first time round. I'd say that this is a reasonably serious privacy vulnerability.
eithed 5y ago
Got Word, Discord, Slack and Postman installed, yet those were not detected. Chrome on Windows. All, except Word, were succesfully detected in Firefox though
busymom0 5y ago
> Safari: Despite privacy being a main development focus for the Safari browser, it turned out to be the easiest browser of the four to exploit. Safari doesn’t have scheme flood protection which allows the exploit to easily enumerate all installed applications. The same-origin policy trick as used for the Firefox browser was used here as well. On iOS (and MacOS too I believe), when developing apps and requesting URL scheme, the developer has to declare every URL scheme they want their app to query in the `LSApplicationQueriesSchemes` array in info.plist of the app. This was added in iOS 9 as part of a similar vulnerability where apps and advertisement SDKs would simply query a list of URL schemes and then identify based on that across multiple apps. Something similar can be done by browsers for websites. MacOS could simply show you a popup with a checkbox list of all URL schemes the site tries to query for with options for "Allow", "Deny" or "Randomize".
DoomHotel 5y ago
Wow, it didn't work at all on my desktop. It thinks I have 23 apps from its list installed, on both Firefox and Chrome. Pretty funny seeing that on a Linux box running CentOS 7. Even better, it detects a different app on each as the only one missing: on Firefox it says I don't have Skype installed, while on Chrome it says I don't have Hotspot Shield installed.
- dannyw 5y ago
  That's because on Linux xdg-open handles everything. What's missing is probably a timing issue.
opheliate 5y ago
Lots of comments about whether or not the demo works consistently between browsers, but regardless, it's a cool attack vector, major props to the authors. Honestly surprised the Tor browser didn't just disable protocol handlers outright beforehand, seems like a vulnerability waiting to happen when you're that paranoid. I'm a bit confused about why so many applications have bothered to create custom protocol handlers. I can see the benefit for something like Spotify, you click a link in your browser and it takes you to the song you want in the Spotify application. But is the NordVPN application really so complex that they can't just say, "hey, open Nord and click this"? Just seems like an unnecessary UX decision. Unless there's something I'm not seeing?
- dannyw 5y ago
  It's a more integrated experience. It's totally understandable because it's an officially supported and endorsed way of deep linking.
- deleted 5y ago
  [deleted]
theo-born 5y ago
I thought this was known for a while? But speaking of, does the website know if you do have MetaMask installed right away (without prompting you for anything)? Because that would be a real concern if it did.
- doopy1 5y ago
  I think metamask injects web3 into every context on the page so it's pretty easy to check for that.
- dannyw 5y ago
  Yeah it does. Browsing the Web with MetaMask is like walking around with a bag of $10,000 cash openly exposed in a crowded public street of a society with no police officers or law enforcement. And with a blindfold on your eyes.
afrcnc 5y ago
Old trick and demo doesn't work :)
deleted 5y ago
[deleted]
chrismorgan 5y ago
This is connected to a significant usability problem with `tel:` links: you have no way of knowing whether they’ll work, and if they don’t work, it could be in one of a few different ways. Maybe it’ll open a dialer app. Maybe it’ll do nothing at all. Maybe it’ll open an “unknown scheme” browser error page. Maybe it’ll prompt you to open it in an external app (I seem to have both Skype and Zoom willing to handle tel: links; neither is going to succeed). You largely can’t detect whether it has done something, might have done something, or has done nothing. Well, this article shows ways that you can detect likely results for some cases after trying it, but it’s not reliable and is depending on implementation details that are liable to change (especially since they’re a fingerprinting vector). If it’s not going to work, I’d strongly prefer to not make the phone number a link—and perhaps even to present a different flow to the user (e.g. provide a form or mark an email address as the primary option). But if it is going to work, I definitely want it to be a link. It’s common to just guess from the user agent string or screen size whether it’s a mobile device, but that’s extremely flawed too—some tablets will and some won’t be able to dial, and even desktop platforms may well have some VoIP app. Fingerprinting and usability are so often so significantly at odds. :-(
- danielmeskin 5y ago
  Does Skype no longer do POTS calls?
  - chrismorgan 5y ago
    If you pay them. I say it’s not going to succeed specifically because I haven’t.
    - SahAssar 5y ago
      Right, but if you're not on a device with a built in phone connection then it's reasonable to open skype and similar apps that can do phone calls (even if they cost money).
- Scoundreller 5y ago
  Same problem with loading up news.ycombinator.com in Lynx. The browser assumes I meant nntp://news.ycombinator.com ugh.
zerof1l 5y ago
Tested on Windows and got two different identifiers. Firefox detected Postman, Chrome did not.
- kdarutkin 5y ago
  Thanks for the feedback. The accuracy is the main issue on Chrome. See also https://news.ycombinator.com/item?id=27147876 https://news.ycombinator.com/item?id=27147876
userbinator 5y ago
No mention of IE...
graderjs 5y ago
Super clever to make this exploit work on Chrome by opening a PDF file prior to launching the custom app scheme, in order to activate the Chrome PDF viewer extension, which resets the global flag requiring a user gesture before any custom scheme launch. It didn't track me across Firefox, and Chrome on Windows 10, but it was still cool. Weird that when I tried running it in chrome headless[0], it opened the popup window, and tried the first scheme, but then stopped, and hung. [0]: https://comebrowsewithme.com:8002/ https://comebrowsewithme.com:8002/
lilyball 5y ago
Why does this page declare Safari to be the easiest browser to exploit, when it also says it uses the same technique as it does in Firefox (and does not describe any scheme flooding protection in Firefox)?
- kdarutkin 5y ago
  Mostly because it took hours to make an exploit on Safari compared to days on Firefox, however the final approach ended up the same. Only Chromium has a built-in scheme anti-flooding protection.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
zzo38computer 5y ago
I would fix perhaps by the new web browser doing: - Document scripts are restricted, and can be customized and spoofed (or fully disabled) by the user. - Whether or not a link can be opened, and whether or not it is asked, depends on user settings. If it is configured to ask, it does so for both known and unknown URI schemes. - Known and unknown schemes are both considered different origins; they do not redirect to about:blank (unless it is a scheme which is handled by rendering a document, which happens to redirect to about:blank, but it does not normally do this). - Scripts cannot detect such prompts, and only one can be displayed at a time. One key combination can be used to prevent further prompts; even if a way is found, only one will work anyways. And many other improvements, because existing web browsers are bad in a lot of ways.
marsven_422 5y ago
What is the point of all this tracking? Adds to are still shit and never relevant.
est 5y ago
Browsers should by default <body onload="disableJS()">
matheusmoreira 5y ago
> Add a script on a website that will test each application from your list. This means exploitation requires Javascript, right? Tor browser users should have it disabled at all times.
- vaylian 5y ago
  Not in the default configuration
saagarjha 5y ago
Interesting to see that browsers are still vulnerable to this; I know iOS had a very similar problem a while back (apps would check for the existence of hundreds of other applications by checking whether they could open those URL schemes) and Apple clamped down on it quickly by restricting the number of queries that could be made.
finder02 5y ago
I started a little project to mitigate risk like this - run firefox from unprivileged podman container (it will work with docker too). https://github.com/grzegorzk/ff_in_podman https://github.com/grzegorzk/ff_in_podman I always get the same ID on the demo because 0 apps are detected :) and this makes the browser unique because not many people run browser on system with 0 apps installed.
deleted 5y ago
[deleted]
toomanybeersies 5y ago
> In a quick search of the web, we couldn’t find any website actively exploiting it but we still felt the need to report it as soon as possible. I've seen popup-based exploits on less-legal websites (e.g. torrents, keygens, illegal streaming of live sports and/or movies) a few times over the years. I'm unsure if they're executing this specific exploit though.

467 points by danpinto 5y ago

As a note, this doesn't seem to work with Brave. It only got one of the applications my machine has installed, and I don't have a slow machine nor a slow internet where I am. I'm a bit surprised it got even one of them though. I will need to review my Brave privacy settings and see if anything can be done.

pier25 5y ago
I just tried it with the latest version of Brave and it found: Skype, Zoom, VSCode, Adobe, and iTunes. This only checks 24 apps, and it got all the ones I have installed out of those 24.

bronzeage 5y ago

Looking at their product, I wonder how many of these kind of vulnerabilities are still open and exploited by them. Wouldn't make much sense for them to burn such a useful vulnerability which is required for their product unless they had something better.

grishka 5y ago
Interesting to see how their product is open source, too: https://github.com/fingerprintjs/fingerprintjs/ https://github.com/fingerprintjs/fingerprintjs/ It's as if they want browser developers to look at the code and break it as much as possible.
harikb 5y ago
> DISCLAIMER: FingerprintJS does not use this vulnerability in our products and does not provide third-party tracking services
dathinab 5y ago
You can get a lot of entropy just by fingerprinting things send over HTTP headers and things freely accessible by JS. E.g. user agent, screen dimensions, language, web GL, audio api, etc. Generally wrt. fingerprinting chrome is worse then Firefox as Firefox actively worked to reduce fingerprint-ability if possible, while chrome seems to not care much. Because of this ironically I have a less unique fingerprint on a customized Firefox browser then a "stock" Chrome browser even through much less people use Firefox... The reason (I think) why they make this public is because this can be used for more then "just" fingerprinting. I.e. this can be used by cyber attacks to find a potential attack vector to then pull of either a direct attack or some social engineering attack.
- the_duke 5y ago
  Firefox also has a lot of settings that mitigate various finger printing techniques. There are some good sample configs on Github. [1] Ironically, many of the settings can make you more unique because they disable a lot of functionality. [1] https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js
  - KirillPanov 5y ago
    This is why the torbrowser/firefox "try to make everybody look the same" approach is doomed. Adding white noise is the only solution: "try to make your fingerprint on each website for each brower-restart look as different as possible (a) from your fingerprint on every other website and (b) from your fingerprint on the same website on a previous browser-restart". That's the best you can do anyways without rejecting first-party cookies. Brave does this, and it is the right way. I just wish Firefox would wake up and clue in to this.

harikb 5y ago

> Profiling based on installed apps > most browsers have safety mechanisms in place designed to prevent such exploits. Weaknesses in these safety mechanisms are what makes this vulnerability possible. > By specification, extensions need to be able to open custom URLs, such as mailto: links, without confirmation dialogs. The scheme flood protection conflicts with extension policies so there is a loophole that resets this flag every time any extension is triggered If true, this sounds worse revelation than the exploit itself. Disabling a flag temporarily sounds bad, regardless of whether a vulnerability exists.

jowsie 5y ago

I ran this in Chrome and then in Edge and got different identifiers.

kdarutkin 5y ago
Chromium results may be flaky on slow internet or because of less performant hardware (such as Virtual Machines). I've updated the demo for Chromium and made it work slower, in order to increase accuracy.

buggeryorkshire 5y ago

I've no idea whether it works, but they misidentified many apps I don't have installed (Postman, Express VPN, Notion, Figma, Hotspot Shield) It does do the popup for VSCode asking if I want to open links there, which I do have installed.

yjftsjthsd-h 5y ago
Yeah, it gave me quite a list of programs, including xcode and itunes, which is fascinating on a Linux box... they list 20 programs they think I have installed, of which I actually have 2. I'm not sure why it would be so inaccurate, but I feel better...
- nolok 5y ago
  > I'm not sure why it would be so inaccurate, but I feel better... I don't think you understood the core of the issue: it's not about identifying which applications you have installed, it's about always getting the same result for the same user. If all your browsers serve the same results, you are trackable, no matter if those results are good or not.
  - filmfact 5y ago
    I think the implication is that this is far fewer bits of entropy than the authors indicate. Four bits (in isolation), are not a meaningful identifer.
    - nolok 5y ago
      It's not four, the fact that the others applications are reliably detected as not present are additional bits.
dathinab 5y ago
I guess (and just that), that this can happen if there are overlaps in the scheme handlers. I.e. there are some schemas which lets say XCode handles but which also some other program handles.

agilob 5y ago

Tried Chrome, Brave and Firefox, got 3 different IDs. On one of the browsers it also didn't detect slack and vscode being installed.

dathinab 5y ago
> didn't detect slack and vscode being installed. Is it you main browser in which you had used slack url's/ set slack to always handle the links? Or is it the opposite? Or maybe something else?
kdarutkin 5y ago
Hi, agilob. I've updated the demo for Chromium and made it work slower, in order to increase accuracy. See also https://news.ycombinator.com/item?id=27147325 https://news.ycombinator.com/item?id=27147325
- agilob 5y ago
  Now I got an identifier that you saw 2 times before: >This is your identifier. It was seen 2 times among 8828 tests so far. None of these was my run. Still, didn't detect vscode :)

Operyl 5y ago

It's not detecting many of the supported applications on my Mac in Safari.

dzhiurgis 5y ago
It did for me and compared with Chrome identified everything to same identifier.
kdarutkin 5y ago
The exploit was tested in Safari 14.0.3 and 14.1 on MacBook M1 and MacBook Pro. What version do you have?
- Operyl 5y ago
  14.1 on an M1 MBP.
  - kdarutkin 5y ago
    Wow, that's weird. The internet connection may be the issue here, or the custom configuration on Safari.

nimbius 5y ago

>By opening a popup window with a custom URL scheme and checking if its document is available from JavaScript code, you can detect if the application is installed on the device. in FF, unless im mistaken this assumes the user clicks anything except cancel on the popup. bug for reference and comment. https://bugzilla.mozilla.org/show_bug.cgi?id=1711084 https://bugzilla.mozilla.org/show_bug.cgi?id=1711084 further from the github: > the basic concept is the same. It works by asking the browser to show a confirmation dialog in a popup window. Then the JavaScript code can detect if a popup has just been opened and detect the presence of an application based on that. so...we seem to be relying on the honor system with the user? Can anyone clarify?

dathinab 5y ago
Basically browsers have the "I open a popup to ask" or "the user has no schema handler for that schema so I don't need to ask" or the "User already confirmed it always should open the link with given application" behaviour and they can detect it "somehow "? But I still have to look closer into it.
- valve1 5y ago
  Browsers open pop-ups to ask "Can I run that application?" but only if that application is installed. If that application is not installed, the browser will ignore the custom URL.
  - jszymborski 5y ago
    It looks like a mitigation might be that in the event you do not have the application installed, to return a "denied" status and send a prompt to the user like "Unknown application protocol". Something like that could still would be susceptible to a timing attack though.
    - Haemm0r 5y ago
      always show the popup, but populate it "later" could work too.

matsemann 5y ago

Interesting concept. Most fingerprinting I've seen so far has for instance used the GPU to detect small differences in rendering, but also based on browser. First cross-browser I've seen, barring the obvious stuff like IP or so. Hope this won't be a post where everyone that didn't get the same identifier have to proclaim it, though. We get it, it's not perfect. FWIW I got same in Edge & Fx and it claimed it was a unique combo (different ID in Chrome, though).

jraph 5y ago

On Linux: - in Firefox, it detected Epic Games Telegram Discord Battle.net Xcode NordVPN Sketch Teamviewer Microsoft Word WhatsApp Postman Adobe Messenger Figma Hotspot Shield ExpressVPN Notion iTunes, none of which I have installed. It didn't detect VSCode though I have VSCodium. - On Chromium, it warned it would not work well on Chrome on Linux. It incorrectly detected all the apps. It seems that the browser would try to open the links with xdg-open. Clever hack anyway!

valve1 5y ago
Thanks for testing it on Linux. We only tested it on these browser + OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#target-browsers https://github.com/fingerprintjs/external-protocol-flooding#...
- jraph 5y ago
  if you need more info: Firefox 88.0.1 (64 bits), Chromium 90.0.4430.93, on openSUSE Tumbleweed
DistressedDrone 5y ago
Using Firefox on Linux, it detected all the apps (very few of which I have) except Skype (correct, I don't have it). Security through obscurity does it again!
psanford 5y ago
Also Chrome on Linux. For me it says it detected 11 apps installed, but I don't have any of those apps installed. Strange. Edit: With firefox it is able to correctly detect 3 installed desktop applications.
jeltz 5y ago
Yup, it was broken for me too on Linux unless I somehow have managed to install both Xcode and MS Word. :)

jedberg 5y ago

Did it on Chrome, Firefox, and Safari and got the same code on all three. In all three it failed to detect some apps, but the same ones failed each time. When I did it in Safari it actually caused Apple Music to open. When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Firefox was the only one where it was silent. But still, that's an interesting hack. Very clever.

cdubzzz 5y ago
> When I did it in Chrome it popped up a small square window where I could see it doing it's thing. Interesting. In my case I saw the little pop up window in all three browsers. Otherwise same results though.
- busymom0 5y ago
  I just verified this on my machine and it was able to uniquely identify across Brave browser, Firefox and Epic browser (based on Chromium). I didn't check Safari because that's the browser I use the most and don't want to test on that. The Epic browser one was interesting. That browser comes with a built in proxy for routing connections through other countries. I use it to get around geolocked content and sometimes for a tiny sense of anonymity. But seeing this able to identify it with same identifier as Brave and Firefox was a bit more troubling. But I guess that comes with the territory of all these browsers using the same Chromium engine.
  - nieve 5y ago
    Firefox somewhat famously doesn't use the same Chromium engine.
danudey 5y ago
I "saw" the little square window in Firefox on Windows 10, but only because I was paying attention. It was down in the corner, on (for some reason) my second monitor.
- 5y ago

rozab 5y ago

Does this actually work correctly for anyone? Got wrong results for Firefox and Chrome on Linux (it warns that Chrome probably won't work). I glanced through the source[0] and my about:config and I noticed I have the dom.block_external_protocol_in_iframes setting enabled. Looks like this could be the mechanism they use? I don't remember enabling it manually. Otherwise, it could be my tiling window manager messing with detection. [0]: https://github.com/fingerprintjs/external-protocol-flooding/blob/3076ec617f5e5ab1ad72642898ca01f40271cf41/packages/client/src/detector/detection.ts#L222 https://github.com/fingerprintjs/external-protocol-flooding/...

kdarutkin 5y ago
Any custom settings may affect the result. However default settings will work for the Firefox 88.0.1. Was tested on Windows, Safari and Linux. Chrome does not work on Ubuntu, since it opens everything with xdg-open and creates confirmation dialog for both installed and not-installed application
jedberg 5y ago
It seems that it's not very effective in Linux.
- valve1 5y ago
  Yeah, we tested it on MacOS Big Sur mostly. Nobody on the team had linux so we didn't really test there. It can be made to work with better timings for the measurements etc.
- samjanis 5y ago
  Linux Firefox used Schemeflood! v It's not very effective....
kurthr 5y ago
I find it interesting that it shows I have Skype installed... when I don't.
- 5y ago

bryanrasmussen 5y ago

This seems less promising as a means to uniquely identify users than supercookies, Time-Based Device Fingerprinting, or other hardware based methods.

skykooler 5y ago

Interestingly, custom URL handlers seem to stick around even after the app associated with them has been uninstalled. For example, this detected Messenger's URL handler although I uninstalled it a year ago.

rkagerer 5y ago
Not the least bit surprised. I use Total Uninstall and almost every app leaves bits behind. I've complained to many vendors and sent technical details of missed registry keys, files, etc. Sometimes they even fix it. But on the whole, Uninstall on Windows is a bit of a myth.

mwvr 5y ago

It somehow "detected" skype and discord as being installed on my OpenBSD machine with Firefox? Hahaha.

deleted 5y ago

[deleted]

conradev 5y ago

Finding new a fingerprinting mechanism in JavaScript is like finding a new memory corruption bug in the web browser engine. They are always going to exist for architectural reasons, some are worse than others, and the really bad ones are likely kept nice and secret while they are actively exploited. In other words, I'm not surprised in the slightest, but I'm glad that this is out in the open now.

wnevets 5y ago

It though I had Skype, Spotify and Slack installed. I only have Slack installed.

valve1 5y ago
Windows can sometimes say you have Skype, because it comes bundled even if you didn't install it yourself.
- wnevets 5y ago
  I've explicitly uninstalled it on Windows 10, maybe Windows is still reporting it?
  - tick_tock_tick 5y ago
    Windows 10 does some garbage where it installs handlers for URL schemas that take you to the windows store install page for the app. The vulnerability is only testing if you have an handler installed for skype:// not what application is actually handling it.
    - wnevets 5y ago
      Windows 10 must be doing something weird. Skype url handlers aren't triggering the window stores or anything else from links. https://jsfiddle.net/ourcodeworld/aqq1w0qm/ https://jsfiddle.net/ourcodeworld/aqq1w0qm/
    - wnevets 5y ago
      According to URLProtocolView[1] the handlers are still registered despite the application (and MANY others) being uninstalled. [1] https://www.nirsoft.net/utils/url_protocol_view.html https://www.nirsoft.net/utils/url_protocol_view.html

burk96 5y ago

Worked perfectly on Firefox 88.0.1 on Windows. Great to know despite my efforts to balance privacy and anonymity, there is another metric that I'm unique in. Fingerprinting is just insidious.

sneak 5y ago
Browsing in a VM is really one of the only safe ways to go on the modern web for privacy. So many sites break without JS, and having it enabled is an accident waiting to happen. When you need privacy, always browse in a VM or a Tails boot.
- chithanh 5y ago
  Even in a VM you have to carefully ensure that memory deduplication is disabled, and/or some form of mitigation against Rowhammer is in place. Else you will be vulnerable to Flip Feng Shui cross-VM attacks. https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/8022.html https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events...
- Dah00n 5y ago
  This won't work against fingerprinting unless you change the underlying hardware and / or external IP too when stating a new VM. If you don't have a unique external IP per VM you might as well not bother. It is like trying to hide from the police by changing clothes and cutting your hair but stil hold the same huge sign with your name and address in your hands.
  - sneak 5y ago
    The use of Tor or a public VPN (i.e. many hundreds of unrelated users sharing a single public IP) is implicit.
    - Dah00n 5y ago
      Since this is about fingerprinting and not hiding your identity I'm not sure this will help. If you use a public VPN you are removing some data points from the fingerprint but adding a huge new one. After all fingerprinting is about blending in and being like the average user. Adding a few privacy extensions and a VPN and you are much easier to recognise.

butz 5y ago

At least 9 of those programs could be "installed to desktop" on supported Chromium based browsers. That not only lowers your fingerprint in this particular vulnerability, but also saves quite a bit of disk space.

butz 5y ago

Test doesn't work when localStorage is disabled in browser.

difosfor 5y ago

How unique are these ids really? I imagine certain apps will be very commonly installed as well as certain groups of apps? So it's not 32bits of information. Still more information to add to the finger printing pile.. I wish we could find a way to deal with this risk that's not simply disabling all kinds of functionality. Browser APIs seem to be suffering more and more by limitations to prevent finger printing.

Sebb767 5y ago
> How unique are these ids really? I imagine certain apps will be very commonly installed as well as certain groups of apps? Probably worse than you think. Zoom, Skype and Slack will be very common on work computers, while game launchers like steam and epic will work quite well on gaming pcs. You can differentiate further by checking the mixing of those groups and their relative music client (Spotify, ITunes...). Of course it won't be full 32 bits, but given the amount of quite common programs with url handler, it will probably deliver quite good results.
kdarutkin 5y ago
We will make a detailed report with some statistics, after the vulnerability is fixed

taf2 5y ago

Interesting but only works on desktop

seumars 5y ago

Fingerprinting and profiling in general just makes me not want to use the internet sometimes. I stopped using gmail at the very least. Maybe I should start using a VPN.

Forbo 5y ago

I appear to be getting false positives with a different identifier each time I run it. It says I have 3-4 different applications installed, none of which actually are on my system. Each subsequent run comes back with a different set of applications, and a different unique identifier. Looks like I may have beaten this method of fingerprinting, although I'm not quite sure how.

tn1 5y ago

I tried it on Opera and it detected no apps installed. (On Edge however, it detects all the ones I do indeed have installed). This is interesting since I didn't really expect Opera to care about this kind of thing.

valve1 5y ago
Thanks for testing this on Opera, we only tested on these browser/OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#target-browsers https://github.com/fingerprintjs/external-protocol-flooding#...

johnvaluk 5y ago

This appears to depend on user interactivity. How would you silently (and accurately) use this technique to fingerprint a system for cross-browser tracking?

valve1 5y ago
On Tor we show a fake captcha on the demo, which allows to collect multiple key presses and use each as a user-provided trigger.
- Ansil849 5y ago
  This is a really clever way to coerce interactivity!
  - nulbyte 5y ago
    Clever indeed; I only suspected this the second go-round, after I noticed the reload button flicker as I typed. I also noticed you don't have to press Enter or even type the correct phrase to get past the fake prompt. In hindsight, the easy to guess text should have been a dead give-away, but it wasn't.
- johnvaluk 5y ago
  Does that bypass any alerts that would be presented to the user by the browser?
shadowgovt 5y ago
It would be trickier, but it's not as hard as one might want to get a user to click in such a way that the protections in place against automated behaviors can be side-stepped. I'd bet good money that this trick would be useful for anyone running either a meme generator website or a file host, for example. It'd be pretty solid in the file host in particular, because you could hide some of the obvious weird behavior behind the "We're downloading your file" delay.

gruez 5y ago

This seems wildly inaccurate for me. On firefox with resistfingerprinting it says I have 23 of the 24 applications installed (I don't, that's more incorrect than correct), and on tor browser it says 0 applications installed (also incorrect, I have a few installed).

viseztrance 5y ago
Strange. I have resist fingerprinting as well (running on fedora), and it correctly detected all 5 apps I had installed from the list.

anon776 5y ago

Anyone try this with tails/tor? how unique were they?

elmo2you 5y ago

Aside from profiling, can these custom URL handlers also be used as an attack vector on other installed applications? That is, assuming any of those happens to be installed and have a (input sanitation related) vulnerability. Maybe I'm just seeing ghosts here. But the idea of a web site pushing malicious links to whatever software may also be installed on the same machine, isn't a very comforting thought.

kdarutkin 5y ago
This is possible in theory. For example, Safari opens the Apple Music without any user prompt. The app itself is designed to handle deep links (such as opening an album or starting the song). That means you can perform a deep link forgery, in order to force the app to perform unwilling action without user confirmation.

Ansil849 5y ago

Visiting the demo website in Tor Browser (using the 'Safest' setting), the demo site displays this notice: > If you're seeing this message, that means JavaScript has been disabled on your browser, please enable JS to make this app work. Does this mean that the vulnerability does not work in Tor Browser in Safest mode? Or are there non-JS implementations of this vulnerability that would work in a browser with JS disabled?

wiiittttt 5y ago

I received different results in Firefox and Brave. Doesn't seem to be a reliable method for tracking.

kdarutkin 5y ago

I’m the author. The accuracy can be low because of: - Custom browser settings or flags - The demo was designed for the default setup, but that doesn’t mean your custom setup is not vulnerable. - Poorly performant hardware (including virtual machines) - Some timings are just hardcoded and were tested on the MacBook hardware. - Fullscreen mode - The demo will work faster and more accurate if the browser is not in a fullscreen mode - Slow internet connection - Gestures during the process Also, we haven’t looked into Opera yet, but we may if you ask to do it. For the technical questions or bug reports consider using Github Issues

kdarutkin 5y ago
I also made a special branch for Chromium (Chrome, Brave, Edge, etc.) that works much slower, but should be more accurate. It still may not work for your browser with a custom configuration. Also, it is better not to make any gestures during the process. https://github.com/fingerprintjs/external-protocol-flooding/tree/feature/chrome-long-delay https://github.com/fingerprintjs/external-protocol-flooding/... https://609d9f4d79c4f6000700782c--boring-visvesvaraya-dbefd4.netlify.app/ https://609d9f4d79c4f6000700782c--boring-visvesvaraya-dbefd4...
- Otek 5y ago
  Opera is now fully Chromium so it should be similar to others
adontz 5y ago
How come you happen to detect Xcode and Sketch on Windows?
hoistbypetard 5y ago
Interesting work. It didn't work between firefox and chromium on my linux desktop, even trying the chromium branch. But my linux desktop already puts me into a pretty small bucket of users to begin with, so someone who's doing this may not see any joy in trying to fix that.
- 5y ago

kofejnik 5y ago

Confirmed - my ID matched in Chrome and Safari, but Firefox just said 24 of 24 and gave a different ID. Firefox wins again!

asddubs 5y ago

On my firefox (linux) it seems to think I have everything installed for some reason. Worked on tor browser though

dannyw 5y ago
Xdg-open
- KirillPanov 5y ago
  Am I the only one who utterly loathes this tool? Seriously, it maintains (among other things, yes) the mapping from filename extensions to the path of the binary that should be used to open them. It's a map : extension -> path. WhyTF does MIME have to get dragged into this? Why can't I just say "*.foo is opened with /usr/bin/foobalize"? Why must I suffer the agony of trawling the interwebs to find out that blartz.foo is actually a z-content-flavor/foobalized_v3? (Yes, I understand why browsers need to start the lookup using a MIME type. I'm talking about everything else -- the galaxy of things that don't use HTTP). And even once I've found the Magic MIME type, xdg-open still does whatever it wants, and there appears to be no way to troubleshoot it when it's being invoked by another application. Setting XDG_UTILS_DEBUG_LEVEL=999 simply prints out a list of which files its reading (I can get that from strace, thanks), with no step-by-step rundown of its decision process: $ XDG_UTILS_DEBUG_LEVEL=999 xdg-open ftp://foo.com Selected DE generic Checking /home/user/.config/mimeapps.list Checking /home/user/.local/share/applications/defaults.list and /home/user/.local/share/applications/mimeinfo.cache Checking /home/user/.local/share/applications/defaults.list and /home/user/.local/share/applications/mimeinfo.cache Checking /usr/local/share//applications/defaults.list and /usr/local/share//applications/mimeinfo.cache Checking /usr/local/share//applications/defaults.list and /usr/local/share//applications/mimeinfo.cache Checking /usr/share//applications/defaults.list and /usr/share//applications/mimeinfo.cache Checking /usr/share//applications/defaults.list and /usr/share//applications/mimeinfo.cache Okay, y'all can downvote me now, ranty time is over.
  - q3k 5y ago
    No, xdg-utils are absolutely terrible. They're a mess of untested, undebuggable, underdocumented and extremely user unfriendly shell scripts that need to die and be replaced with something that actually had some serious design thought put into it. I've once had xdg-open be absolutely broken on my machine, scanning all of my $HOME because of a file with a space character in it [1]. Any attempt to use xdg-open would pin a CPU core for 100% while bash/find recursively traversed millions of files because of missing quote characters in a shell script. Truly the pinnacle of software engineering. I wouldn't be surprised if serious security bugs lurked somewhere in it, exploitable by web pages attempting to open maliciously crafted protocol URLs. [1] - https://github.com/freedesktop/xdg-utils/commit/9816ebb3e6fd9f23e993b8b7fcbd56f92d9c9197 https://github.com/freedesktop/xdg-utils/commit/9816ebb3e6fd...

Jap2-0 5y ago

On Firefox on Windows (same results on Edge) it detected three programs I do have installed, and one I do not, and failed to detect one I do have installed. There was a moderately noticeable small window in the bottom right of the screen in both. That said, at least for tracking consistency is more important than accuracy.

hirsin 5y ago

My searching is failing, but I believe a similar scheme was uncovered in a popular app using a 'strings' equivalent. It would run through intents on iOS and Android to figure out what was installed. Interesting to see if on the web too!

deleted 5y ago

[deleted]

adontz 5y ago

Results differ wildly between browsers and even between runs within the same browser. It detects application I do not have installed and does not detect applications I do have installed. For instance it detects iTunes, XCode and Sketch, but they are Mac-only application and I am on Windows. Honestly, I believe it does not work at all.

valve1 5y ago
Thanks for testing it on Windows. We mostly tested it on MacOS Big Sur because all devs on the team have that OS. With Windows different timings might be needed, we'll check into it tomorrow.
- mcpherrinm 5y ago
  On my Windows/Firefox computer, it appears to have correctly identified which 6 of the applications I have installed.
inetknght 5y ago
> iTunes > they are Mac-only application I remember installing and using iTunes on Windows 7. It might be that Apple doesn't distribute a modern version of iTunes. But it's certainly not true in the past.
- adontz 5y ago
  I do not have any iTunes installed anyway.

bryan_w 5y ago

Seems like this submission is a bit undercooked. It probably should have been submitted once they had some real world samples or at least gated it to their specific use case

nanis 5y ago

Curious: > We have generated your identifier based on 1 applications you have installed. Skype Then it told me I am ninety-something percent unique... I find that odd because pretty much every Windows machine has Skype.

SavannahJS 5y ago
(I work at FingerprintJS) You are likely relatively unique because you only have Skype installed, whereas a lot of visitors will have more applications out of the list. Someone who has no applications on the list installed may be even more unique, for example.
- inetknght 5y ago
  > Someone who has no applications on the list installed may be even more unique, for example. I ran it in a VM with Firefox and nothing else installed. It correctly detected nothing and stated: > This is your identifier. It was seen 273 times among 3830 tests so far. > That means it is 92.87% unique.
tinus_hn 5y ago
You also have none of the other tested applications; I presume most of them have Word.
- nanis 5y ago
  > You also have none of the other tested applications; I presume most of them have Word. What makes you assume I do not have Office installed? Instead of, say, considering the possibility that the fingerprinting may not be that good.
  - tinus_hn 5y ago
    The main clue is that you are not noting that it is misdetecting anything, just that you think what it is that it is detecting is not very special.

antpls 5y ago

Could be alleviated by creating yet another permission at the browser level : "allow to link to local applications"

livre 5y ago
Firefox on Android has a setting "Open links in apps" and works similar to the way you describe but it's global, either enabled for all websites or disabled for all. I agree that something similar on desktop would be useful.

akersten 5y ago

I'm going to close a website as soon as I get an unprompted popup that says "Firefox is trying to open Slack." It's clever but somewhat obvious (in both a to-the-user-that-its-happening and a "well of course it's possible" sense). So it's cute, but not practical, and I won't lose sleep over it. I'll probably be more inconvenienced by the mitigations that will surely result that make it that much more painful to actually launch a URL scheme, sadly. I've actually never checked the "Always open Slack for slack:// links" or similar checkboxes, precisely out of predicting shenanigans like this would happen eventually :) I wouldn't be too offended if browsers changed the way they handle schemes: always open a "how would you like to handle this link" dialog for any protocol (even if unhandled - like how Windows shows the "how would you like to open this file" dialog), to disguise whether the protocol is handled or not. Not sure I have the answer for user convenience though if someone is used to things automatically opening. That's the "inconvenience" aspect of any potential mitigation, we probably have to get rid of that "remember this choice" checkbox (well, my point is that "have to" is debatable here).

judge2020 5y ago
On Chrome MacOS Big Sur, it doesn't require accepting the prompt, and the demo shows you can accomplish this in a small pop-under or pop-up, which a lot of inexperienced users might simply ignore. Browser devs definitely still need to patch this vulnerability by making it an instant-return no-feedback prompt to open an application.
- akersten 5y ago
  I think my initial reaction was too harsh; after thinking through it some more I agree and think there's an easy enough fix I posted in a sibling comment. As an aside, It's actually surprising the built-in popup blocker let so many popups come from just one user action - I would have thought the heuristic was 1 click = 1 allowed popup before Firefox started denying them.
notRobot 5y ago
Note: I just tried the demo [0], and no obvious prompt showed up, instead it was a tiny window [1] on the bottom right of my screen, which only showed up for a couple seconds and is easy to miss. [0]: https://schemeflood.com/ https://schemeflood.com/ [1]: https://imgur.com/a/YqbbfPt https://imgur.com/a/YqbbfPt

edoceo 5y ago

Only one right answer on my machine - that's ~5% accurate. Linux/Chrome

Isthatablackgsd 5y ago

It seem that Vivaldi have better protection against this than the rest. Running in Vivaldi will cause the demo down to crawl because I think it was trying to find the apps. It detected all of the apps but it failed to appear in the detected list. MacOS Big Sur Apple Silicon if you are wondering

kdarutkin 5y ago
We haven't tested Vivaldi so far and the demo is not designed for it. However that doesn't mean Vivaldi is secure against this attack.

cbsks 5y ago

How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-a-custom-url-protocol-in-windows https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinking about this more, I'm afraid that removing URI schemes from the registry may break those programs. I'd much rather have a browser level setting that will only open external http:/https: resources and other URI schemes that are configured from the browser like mailto:.

notRobot 5y ago
Here's one way to disable it on Windows: https://www.thewindowsclub.com/how-to-prevent-launching-apps-associated-with-file-or-uri-scheme https://www.thewindowsclub.com/how-to-prevent-launching-apps...
- cbsks 5y ago
  The Local Group Policy setting in the link only affects Windows Store apps: "This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app." I haven't tried the registry setting, maybe that will also block normal desktop applications? Edit: it looks like the BlockProtocolElevation setting also only affects Windows Store apps.
  - notRobot 5y ago
    That's unfortunate :(
busymom0 5y ago
For MacOS, I was able to fix this by editing the info.plist inside each application which was detected. This lets me still keep the app but no longer get detected. WARNING: Do it at your own risk. I am fairly certain when I restart my computer, the Spotify app will no longer work as deleting the entry from the info.plist file most likely changes the signature of the app binary and it will no longer be valid. Simply uninstalling the app won't be enough. Rebuild LaunchServices is required to get rid of the registered URL scheme. The info.plist for Spotify for example is located at: /Applications/Spotify.app/Contents/Info.plist You can either do it through terminal or navigate to /Applications in finder, then right click the app and use "Show Package Content" option > Contents > Info.plist. Open the Info.plist in Xcode, look for CFBundleURLSchemes: <array> <dict> <key>CFBundleTypeRole</key> <string>Viewer</string> <key>CFBundleURLIconFile</key> <string></string> <key>CFBundleURLName</key> <string>Spotify Media</string> <key>CFBundleURLSchemes</key> <array> <string>spotify</string> </array> </dict> </array> I removed this array. Save the file. NOTE that if you previously had the app installed in a different directory, you might have to do it there too. Once done, you will have to run this command to "Rebuild LaunchServices" as explained on this Stack Overflow post. https://stackoverflow.com/questions/10156939/mac-show-delete-custom-url-schemes https://stackoverflow.com/questions/10156939/mac-show-delete... /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -kill -r -domain local -domain system -domain user Without the above command, the URL scheme wasn't getting unregistered and the site was still picking it up.

usmannk 5y ago

hm, I tried this on 2 browsers and it said I was unique both times. Shouldn't the second have been a collision?

throwawayay02 5y ago

On my 86.0.1 firefox on linux it detected nothing.

tempestn 5y ago

I tried it in Firefox and Tor, and got the same identifier for both, but in both cases it said, "This is your identifier. It is unique among [####] tests so far." But.. it wasn't unique for the second browser I tried. And they'd be coming from different IPs, so it wouldn't have any way to know both were coming from the same person, aside from the fingerprinting itself...

jonnycomputer 5y ago

First time had 2 apps that aren't installed. Second two attempts didn't detect those two apps. I didn't even notice the window flashing the first time round. I'd say that this is a reasonably serious privacy vulnerability.

eithed 5y ago

Got Word, Discord, Slack and Postman installed, yet those were not detected. Chrome on Windows. All, except Word, were succesfully detected in Firefox though

busymom0 5y ago

> Safari: Despite privacy being a main development focus for the Safari browser, it turned out to be the easiest browser of the four to exploit. Safari doesn’t have scheme flood protection which allows the exploit to easily enumerate all installed applications. The same-origin policy trick as used for the Firefox browser was used here as well. On iOS (and MacOS too I believe), when developing apps and requesting URL scheme, the developer has to declare every URL scheme they want their app to query in the `LSApplicationQueriesSchemes` array in info.plist of the app. This was added in iOS 9 as part of a similar vulnerability where apps and advertisement SDKs would simply query a list of URL schemes and then identify based on that across multiple apps. Something similar can be done by browsers for websites. MacOS could simply show you a popup with a checkbox list of all URL schemes the site tries to query for with options for "Allow", "Deny" or "Randomize".

DoomHotel 5y ago

Wow, it didn't work at all on my desktop. It thinks I have 23 apps from its list installed, on both Firefox and Chrome. Pretty funny seeing that on a Linux box running CentOS 7. Even better, it detects a different app on each as the only one missing: on Firefox it says I don't have Skype installed, while on Chrome it says I don't have Hotspot Shield installed.

dannyw 5y ago
That's because on Linux xdg-open handles everything. What's missing is probably a timing issue.

opheliate 5y ago

Lots of comments about whether or not the demo works consistently between browsers, but regardless, it's a cool attack vector, major props to the authors. Honestly surprised the Tor browser didn't just disable protocol handlers outright beforehand, seems like a vulnerability waiting to happen when you're that paranoid. I'm a bit confused about why so many applications have bothered to create custom protocol handlers. I can see the benefit for something like Spotify, you click a link in your browser and it takes you to the song you want in the Spotify application. But is the NordVPN application really so complex that they can't just say, "hey, open Nord and click this"? Just seems like an unnecessary UX decision. Unless there's something I'm not seeing?

dannyw 5y ago
It's a more integrated experience. It's totally understandable because it's an officially supported and endorsed way of deep linking.
deleted 5y ago
[deleted]

theo-born 5y ago

I thought this was known for a while? But speaking of, does the website know if you do have MetaMask installed right away (without prompting you for anything)? Because that would be a real concern if it did.

doopy1 5y ago
I think metamask injects web3 into every context on the page so it's pretty easy to check for that.
dannyw 5y ago
Yeah it does. Browsing the Web with MetaMask is like walking around with a bag of $10,000 cash openly exposed in a crowded public street of a society with no police officers or law enforcement. And with a blindfold on your eyes.

afrcnc 5y ago

Old trick and demo doesn't work :)

deleted 5y ago

[deleted]

chrismorgan 5y ago

This is connected to a significant usability problem with `tel:` links: you have no way of knowing whether they’ll work, and if they don’t work, it could be in one of a few different ways. Maybe it’ll open a dialer app. Maybe it’ll do nothing at all. Maybe it’ll open an “unknown scheme” browser error page. Maybe it’ll prompt you to open it in an external app (I seem to have both Skype and Zoom willing to handle tel: links; neither is going to succeed). You largely can’t detect whether it has done something, might have done something, or has done nothing. Well, this article shows ways that you can detect likely results for some cases after trying it, but it’s not reliable and is depending on implementation details that are liable to change (especially since they’re a fingerprinting vector). If it’s not going to work, I’d strongly prefer to not make the phone number a link—and perhaps even to present a different flow to the user (e.g. provide a form or mark an email address as the primary option). But if it is going to work, I definitely want it to be a link. It’s common to just guess from the user agent string or screen size whether it’s a mobile device, but that’s extremely flawed too—some tablets will and some won’t be able to dial, and even desktop platforms may well have some VoIP app. Fingerprinting and usability are so often so significantly at odds. :-(

danielmeskin 5y ago
Does Skype no longer do POTS calls?
- chrismorgan 5y ago
  If you pay them. I say it’s not going to succeed specifically because I haven’t.
  - SahAssar 5y ago
    Right, but if you're not on a device with a built in phone connection then it's reasonable to open skype and similar apps that can do phone calls (even if they cost money).
Scoundreller 5y ago
Same problem with loading up news.ycombinator.com in Lynx. The browser assumes I meant nntp://news.ycombinator.com ugh.

zerof1l 5y ago

Tested on Windows and got two different identifiers. Firefox detected Postman, Chrome did not.

kdarutkin 5y ago
Thanks for the feedback. The accuracy is the main issue on Chrome. See also https://news.ycombinator.com/item?id=27147876 https://news.ycombinator.com/item?id=27147876

userbinator 5y ago

No mention of IE...

graderjs 5y ago

Super clever to make this exploit work on Chrome by opening a PDF file prior to launching the custom app scheme, in order to activate the Chrome PDF viewer extension, which resets the global flag requiring a user gesture before any custom scheme launch. It didn't track me across Firefox, and Chrome on Windows 10, but it was still cool. Weird that when I tried running it in chrome headless[0], it opened the popup window, and tried the first scheme, but then stopped, and hung. [0]: https://comebrowsewithme.com:8002/ https://comebrowsewithme.com:8002/

lilyball 5y ago

Why does this page declare Safari to be the easiest browser to exploit, when it also says it uses the same technique as it does in Firefox (and does not describe any scheme flooding protection in Firefox)?

kdarutkin 5y ago
Mostly because it took hours to make an exploit on Safari compared to days on Firefox, however the final approach ended up the same. Only Chromium has a built-in scheme anti-flooding protection.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

zzo38computer 5y ago

I would fix perhaps by the new web browser doing: - Document scripts are restricted, and can be customized and spoofed (or fully disabled) by the user. - Whether or not a link can be opened, and whether or not it is asked, depends on user settings. If it is configured to ask, it does so for both known and unknown URI schemes. - Known and unknown schemes are both considered different origins; they do not redirect to about:blank (unless it is a scheme which is handled by rendering a document, which happens to redirect to about:blank, but it does not normally do this). - Scripts cannot detect such prompts, and only one can be displayed at a time. One key combination can be used to prevent further prompts; even if a way is found, only one will work anyways. And many other improvements, because existing web browsers are bad in a lot of ways.

marsven_422 5y ago

What is the point of all this tracking? Adds to are still shit and never relevant.

est 5y ago

Browsers should by default <body onload="disableJS()">

matheusmoreira 5y ago

> Add a script on a website that will test each application from your list. This means exploitation requires Javascript, right? Tor browser users should have it disabled at all times.

vaylian 5y ago
Not in the default configuration

saagarjha 5y ago

Interesting to see that browsers are still vulnerable to this; I know iOS had a very similar problem a while back (apps would check for the existence of hundreds of other applications by checking whether they could open those URL schemes) and Apple clamped down on it quickly by restricting the number of queries that could be made.

finder02 5y ago

I started a little project to mitigate risk like this - run firefox from unprivileged podman container (it will work with docker too). https://github.com/grzegorzk/ff_in_podman https://github.com/grzegorzk/ff_in_podman I always get the same ID on the demo because 0 apps are detected :) and this makes the browser unique because not many people run browser on system with 0 apps installed.

deleted 5y ago

[deleted]

toomanybeersies 5y ago

> In a quick search of the web, we couldn’t find any website actively exploiting it but we still felt the need to report it as soon as possible. I've seen popup-based exploits on less-legal websites (e.g. torrents, keygens, illegal streaming of live sports and/or movies) a few times over the years. I'm unsure if they're executing this specific exploit though.