4 ms·

How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS se

by cbsks 5y ago

How do I disable this? I don't have any need to open Skype, or any other application, from my browser. Is it a browser setting (I use Firefox) or is it an OS setting (Windows)? Edit: It looks like an OS setting. In Windows the URI schemes are configured in the registry: https://stackoverflow.com/questions/80650/how-do-i-register-a-custom-url-protocol-in-windows https://stackoverflow.com/questions/80650/how-do-i-register-... Anyone know if there is an easy way to list all the URI schemes? Edit2: After thinking about this more, I'm afraid that removing URI schemes from the registry may break those programs. I'd much rather have a browser level setting that will only open external http:/https: resources and other URI schemes that are configured from the browser like mailto:.

notRobot 5y ago
Here's one way to disable it on Windows: https://www.thewindowsclub.com/how-to-prevent-launching-apps-associated-with-file-or-uri-scheme https://www.thewindowsclub.com/how-to-prevent-launching-apps...
- cbsks 5y ago
  The Local Group Policy setting in the link only affects Windows Store apps: "This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app." I haven't tried the registry setting, maybe that will also block normal desktop applications? Edit: it looks like the BlockProtocolElevation setting also only affects Windows Store apps.
  - notRobot 5y ago
    That's unfortunate :(
busymom0 5y ago
For MacOS, I was able to fix this by editing the info.plist inside each application which was detected. This lets me still keep the app but no longer get detected. WARNING: Do it at your own risk. I am fairly certain when I restart my computer, the Spotify app will no longer work as deleting the entry from the info.plist file most likely changes the signature of the app binary and it will no longer be valid. Simply uninstalling the app won't be enough. Rebuild LaunchServices is required to get rid of the registered URL scheme. The info.plist for Spotify for example is located at: /Applications/Spotify.app/Contents/Info.plist You can either do it through terminal or navigate to /Applications in finder, then right click the app and use "Show Package Content" option > Contents > Info.plist. Open the Info.plist in Xcode, look for CFBundleURLSchemes: <array> <dict> <key>CFBundleTypeRole</key> <string>Viewer</string> <key>CFBundleURLIconFile</key> <string></string> <key>CFBundleURLName</key> <string>Spotify Media</string> <key>CFBundleURLSchemes</key> <array> <string>spotify</string> </array> </dict> </array> I removed this array. Save the file. NOTE that if you previously had the app installed in a different directory, you might have to do it there too. Once done, you will have to run this command to "Rebuild LaunchServices" as explained on this Stack Overflow post. https://stackoverflow.com/questions/10156939/mac-show-delete-custom-url-schemes https://stackoverflow.com/questions/10156939/mac-show-delete... /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -kill -r -domain local -domain system -domain user Without the above command, the URL scheme wasn't getting unregistered and the site was still picking it up.
anonymfus 5y ago
> Anyone know if there is an easy way to list all the URI schemes? Settings → Apps → Default apps → Choose default apps by protocol Also there is Settings → Apps → Apps for websites, where you can control rerouting of http/https links to applications.
- Psychlist 5y ago
  Windows Settings lets me choose an app, but not choose no app/remove an app. So that's not entirely useful (the obvious "just use notepad for everything" is also an obvious tell) I'm not wildly keep on manually editing the registry, at least without someone else doing it first and reporting that it didn't break their computer :)
nonameiguess 5y ago
You can remove any settings you persisted in Firefox regarding whether to open a uri scheme in an external application or not by going to your profile folder and deleting the handlers.json file. Do this when Firefox is not open. This will clear any history if you've ever selected "always open links of this type with <blah>" in the popup. But unfortunately, this exploit is just depending on the popup to happen at all, which I don't think you can configure from Firefox. If a uri scheme handler is registered with Windows, Firefox will ask you if you want to use it. Deleting the registered scheme handler from Windows is a matter of finding an entry in HKEY_CLASSES_ROOT in the registry with a name that matches the scheme and deleting that entry. For instance, in regedit, if you find HKEY_CLASSES_ROOT\spotify, you can delete it and no more handler for spotify://. Whether or not this breaks the program probably depends on the program. If buttons and links in the application itself use this scheme, then it probably will. If they're handled directly without delegating to the OS, then maybe not. Worst that happens is you can always just reinstall the application if it stops working. I'm looking around through Firefox docs about whether it's possible to block specific uri schemes from being handled at all but not finding anything. They do block data:// and have a strict origin policy for file://, but those are already on by default and I can't find anything related to blocking (or allowing) arbitrary uri schemes. That would be one obvious fix, though, and the researchers here did report this as a bug, so maybe an upcoming Firefox will offer this.
- nonameiguess 5y ago
  Should add the obvious ultimate way to prevent fingerprinting of this type is to just run Firefox in its own VM or container with a totally clean OS you otherwise don't touch. You could choose to share the Downloads folder between guest and host so you can still save files, but it then wouldn't be able to see what you do and don't have installed on your real host system. Of course, if you do anything to allow hardware acceleration in your browser so you're not streaming media like it's 1999, it'll still be able to fingerprint you based on the hardware, but at least it won't see what applications you have.

by cbsks 5y ago

notRobot 5y ago

Here's one way to disable it on Windows: https://www.thewindowsclub.com/how-to-prevent-launching-apps-associated-with-file-or-uri-scheme https://www.thewindowsclub.com/how-to-prevent-launching-apps...

cbsks 5y ago
The Local Group Policy setting in the link only affects Windows Store apps: "This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app." I haven't tried the registry setting, maybe that will also block normal desktop applications? Edit: it looks like the BlockProtocolElevation setting also only affects Windows Store apps.
- notRobot 5y ago
  That's unfortunate :(

busymom0 5y ago

For MacOS, I was able to fix this by editing the info.plist inside each application which was detected. This lets me still keep the app but no longer get detected. WARNING: Do it at your own risk. I am fairly certain when I restart my computer, the Spotify app will no longer work as deleting the entry from the info.plist file most likely changes the signature of the app binary and it will no longer be valid. Simply uninstalling the app won't be enough. Rebuild LaunchServices is required to get rid of the registered URL scheme. The info.plist for Spotify for example is located at: /Applications/Spotify.app/Contents/Info.plist You can either do it through terminal or navigate to /Applications in finder, then right click the app and use "Show Package Content" option > Contents > Info.plist. Open the Info.plist in Xcode, look for CFBundleURLSchemes: <array> <dict> <key>CFBundleTypeRole</key> <string>Viewer</string> <key>CFBundleURLIconFile</key> <string></string> <key>CFBundleURLName</key> <string>Spotify Media</string> <key>CFBundleURLSchemes</key> <array> <string>spotify</string> </array> </dict> </array> I removed this array. Save the file. NOTE that if you previously had the app installed in a different directory, you might have to do it there too. Once done, you will have to run this command to "Rebuild LaunchServices" as explained on this Stack Overflow post. https://stackoverflow.com/questions/10156939/mac-show-delete-custom-url-schemes https://stackoverflow.com/questions/10156939/mac-show-delete... /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -kill -r -domain local -domain system -domain user Without the above command, the URL scheme wasn't getting unregistered and the site was still picking it up.

anonymfus 5y ago

> Anyone know if there is an easy way to list all the URI schemes? Settings → Apps → Default apps → Choose default apps by protocol Also there is Settings → Apps → Apps for websites, where you can control rerouting of http/https links to applications.

Psychlist 5y ago
Windows Settings lets me choose an app, but not choose no app/remove an app. So that's not entirely useful (the obvious "just use notepad for everything" is also an obvious tell) I'm not wildly keep on manually editing the registry, at least without someone else doing it first and reporting that it didn't break their computer :)

nonameiguess 5y ago

You can remove any settings you persisted in Firefox regarding whether to open a uri scheme in an external application or not by going to your profile folder and deleting the handlers.json file. Do this when Firefox is not open. This will clear any history if you've ever selected "always open links of this type with <blah>" in the popup. But unfortunately, this exploit is just depending on the popup to happen at all, which I don't think you can configure from Firefox. If a uri scheme handler is registered with Windows, Firefox will ask you if you want to use it. Deleting the registered scheme handler from Windows is a matter of finding an entry in HKEY_CLASSES_ROOT in the registry with a name that matches the scheme and deleting that entry. For instance, in regedit, if you find HKEY_CLASSES_ROOT\spotify, you can delete it and no more handler for spotify://. Whether or not this breaks the program probably depends on the program. If buttons and links in the application itself use this scheme, then it probably will. If they're handled directly without delegating to the OS, then maybe not. Worst that happens is you can always just reinstall the application if it stops working. I'm looking around through Firefox docs about whether it's possible to block specific uri schemes from being handled at all but not finding anything. They do block data:// and have a strict origin policy for file://, but those are already on by default and I can't find anything related to blocking (or allowing) arbitrary uri schemes. That would be one obvious fix, though, and the researchers here did report this as a bug, so maybe an upcoming Firefox will offer this.

nonameiguess 5y ago
Should add the obvious ultimate way to prevent fingerprinting of this type is to just run Firefox in its own VM or container with a totally clean OS you otherwise don't touch. You could choose to share the Downloads folder between guest and host so you can still save files, but it then wouldn't be able to see what you do and don't have installed on your real host system. Of course, if you do anything to allow hardware acceleration in your browser so you're not streaming media like it's 1999, it'll still be able to fingerprint you based on the hardware, but at least it won't see what applications you have.