6 ms·
> You can also navigate to the site in the browser and then view the detailed data The author addresses this point (or has now addressed it) in the addendum to
by samizdis 5y ago
> You can also navigate to the site in the browser and then view the detailed data
The author addresses this point (or has now addressed it) in the addendum to point out an "observer effect" shortcoming:
This information can be seen with the web inspector in both Chrome and Safari.
Yes, but the crucial difference is that you have to navigate to an individual site in a browser window in order to see the site data in the web inspector. Whereas in the Preferences, you can get to the site data, for every website, without having to load the sites. And remember, the very act of loading a site can make the site data change, so there's an "observer effect" if you try to examine or delete it in the web inspector.
- BoorishBears 5y agoNot that I think this has actually been applied by anyone in the wild, but it'd be fun to make a site that take advantage of this You can detect developer tools being open in Chrome pretty reliably, so detect dev tools have been open then "clean up your act" before there's a chance to view anything of note
- codezero 5y agoCould you see the original cookie by inspecting the headers of the network request? This would presumably be the value before the page loads and gives access to document.cookie or a change triggered by a server-side header.
- sk5t 5y agoConsider using something like https://mitmproxy.org/ https://mitmproxy.org/ to deal with a site so devious as to detect browser-level tools being used to inspect headers/cookies/etc.
- duskwuff 5y agoThis has absolutely been used "in the wild". One particularly nasty strain of ad-block-evasion scripts would detect the developer tools being opened, and would reload the page and disable most of its features to prevent them from being analyzed.
- sroussey 5y agoWay back when, we thought about this for Firebug. One thing that came out of it was browsers started adding the console object (also because devs forgot to remove the calls on it). Even so, we added CSS and stuff to highlight elements and that was easily found. What do people look for today?
- duskwuff 5y agoThe two big ones are: 1. Watching window.innerHeight/innerWidth for sudden, large decreases, indicating that the user just opened the inspector. 2. Logging objects to the console with toString methods and checking if that method gets called.
- hutzlibu 5y ago1. should be trivial to avoid, by opening dev tools in a new window but 2. I have no idea, except the browser vendors would add a "stealth dev mode"
- petre 5y ago2. JSON.stringify(object)
- hutzlibu 5y agoBut isn't the point that you want to detect what the foreign code does? So your solution would require inject your code into the code that wants to hide from you ... ?
- lmm 5y agoI think the idea is you patch the console to display the objects without calling their toString methods.
- 5y ago
- Thorrez 5y agoDiscord does this. Try to find the login cookie. When discord loads, it copies it out of localstorage into a js var and deletes the localstorage. So if you examine localstorage it will be empty. On page unload it copies it back into localstorage. So if you want to see the value, you have to make sure no discord tabs are open in your browser. I believe one reason for this is to prevent self-xss. It's hard for a malicious person to write a snippet of js to steal the login cookie now that it's no longer in localstorage. Another reason might be to prevent bots. It's hard for someone to automate a discord account if there's no way to get the account's login cookie.
- xg15 5y agoWouldn't this cause problems with multiple tabs/windows? Like, if I have one Discord tab open (so localstorage is cleared) and I open a second one in parallel, will I be logged out in the second one?
- Thorrez 5y agoI didn't look into it too deeply. Maybe if there are multiple windows they can communicate with each other in some way.
- brabel 5y ago"in some way" --> probably postMessage to send the variable to the new tab.
- toomanybeersies 5y agoService workers would be the solution to that problem, wouldn't they?
- codezero 5y agoNot trying to defend anyone here, but I wonder if there's a non-nefarious reason for this. Specifically, there have been a lot of changes to cookies lately because malicious actors (malware/adware) figured out how to access the cookie store and infer/determine cookie information from other sites. I suspect that maybe this cookie store is kept in a more secure part of the application and only the cookies relevant to the site you visit get pulled out of it. It may even be a risk to have the information for all domains even loaded into memory for the application. With all that said, there should be some way to manage/introspect that cookie store from outside of the browser imho.
- wyager 5y agoIf the browser is designed properly (this does not apply to Safari), the UI can and should have totally different permissions from the site executor/renderer.
- dylan604 5y ago>If the browser is designed properly (this does not apply to Safari), Slow clap. Well done.
- feanaro 5y agoLet's remain serious. It is entirely within the capability of modern computers to admit a dialogue which would let the user view their cookies without magically exposing them to websites. There is no non-nefarious reason for this.
- codezero 5y agoI agree, but I suspect this was also what was believed when they originally did it and adversaries found very clever ways to find that cookie store - that part at least is true, which is why I bother mentioning it, given the complexity of browsers it is likely very daunting to redesign this kind of thing around the existing features. Anyways, I'm glad I'm not working on browsers, it seems like an ever-losing cat and mouse.
- deleted 5y ago[deleted]