7 ms·

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it

by jefftk 5y ago

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it isn't even getting as far as a permissions prompt because the default Feature Policy doesn't allow camera or mic access in cross-origin iframes. (Ex, for Chrome: https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-permissions-in-cross-origin-iframes https://sites.google.com/a/chromium.org/dev/Home/chromium-se...) Instead, I think the most likely thing happening here is that an advertiser is running a script that is trying to do fingerprinting, and which is blocked by the browser protection. (That it's an iframe running on https://[random].safeframe.googlesyndication.com https://[random].safeframe.googlesyndication.com tells us it's an ad served through Google Ad Manager, and the contents of the iframe are supplied by the advertiser.) Disclosure: I work for Google, speaking only for myself

reaperducer 5y ago
The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone You are correct, that is the author's concern. The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.
- ethbr0 5y ago
  This is a catch-22 though. If something dangerous to privacy is being widely used in the world, then putting it behind a prompt creates an avalanche of prompts, and results in user apathy. But not prompting requires you to choose a default, which either default to block and breaks things (if it was actually required) or defaults to allow.
  - Hallucinaut 5y ago
    I would happily set all browsers to always deny all ads and untrusted domains the ability to use microphone and camera at all times. So there's no need for an avalanche of alerts, it just shouldn't be permissible for a resource from an untrusted source. It may be widely used, but for a highly concentrated set of sites. I can't think of an occasion I've used it beyond Google, Microsoft, and Zoom properties. Perhaps Slack and Discord too? So there must be a better way.
    - noahtallen 5y ago
      > deny… untrusted domains the ability to use microphone and camera at all times I believe this is the default for most browsers now, right? (Or have I been spoiled by Firefox?) This is the best way, where the camera is always inaccessible, unless you enable it for a domain which needs it. Since I rarely ever see the camera/mic request option, I don’t think we’ve been conditioned to allow this type of request. (Compared to cookies, which show up on nearly every site.) If you want to disable permissions dialogues altogether, then what’s a trusted domain? Just zoom and a handful of others? If you write yourself a nice app which uses the mic, do you have to email Google to get yourself added to the list of trusted domains? That would be pretty bad for the open web, so permissions dialogues are the alternative
  - smichel17 5y ago
    The solution to this is simple, but not easy: block everything by default and do not prompt to enable it (but do show an indicator of what has been blocked). This is how Firefox tracker protection, uMatrix, noscript, and a plethora of ad blockers and other privacy tools work.
- jeffbee 5y ago
  What? In what way have you been conditioned to accept prompts?
  - fault1 5y ago
    I think there is most definitely conditioning going on. I watched my fiance click on one of the "accept all cookies" GDPR-prompts (it's become an antipattern) a few days ago. She almost automatically did it without thinking. I went to the same site on my laptop and if you clicked decline, it immediately brought up modal dialogs that made that site unusable. I can see why 99% of people would be conditioning to just hit yes.
    - jeffbee 5y ago
      And you blame Google for that, instead of some brain-dead Eurocrat?
      - mrtranscendence 5y ago
        Who said anything about blaming google for users clicking “ok” without thinking about it?
        jeffbee 5y ago
        The person to whom I replied!
        theWreckluse 5y ago
        To be fair, he said Google and others. I still don't know how much Google is responsible though.
        hetspookjee 5y ago
        Google goes way further and doesn't even serve a prompt. Instead they show you a opt-out plugin that you can download to run in your browser. Most blatant disregard of rules and feeling better than the rest behaviour if you ask me.
- jefftk 5y ago
  In this case there isn't a prompt: access to the camera and microphone is disallowed by default in cross-origin iframes. The site would have to specifically delegate permission to the ad before it could even trigger a prompt.
- denton-scratch 5y ago
  > just press "Accept" any prompt that pops up I auto-press [Accept]. I use an ad-blocker. I reject 3rd-party cookies. I disable JS by default, and re-enable it selectively for sites that refuse to work without JS. If that re-enablement involves more than a few clicks, I'll close the site - there are other fish in the sea. What am I doing wrong?
veeti 5y ago
Curiously no explanation why this sort of malicious behavior is accepted by "Google Ad Manager" in the first place. If you haven't already installed: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en https://chrome.google.com/webstore/detail/ublock-origin/cjpa...
- jefftk 5y ago
  I'm not sure it is allowed; that's not a part of the business I know much about. Since ads can run arbitrary JS it's hard to enforce policy programmatically. On the other hand, it's not clear to me that whatever this advertiser is trying to do is having any real effect, aside from causing a console message that it is being blocked. Access to the mic and camera from cross-origin iframes is blocked by default, and you can't even trigger a permissions prompt. As for installing an ad blocker, even with all the messiness of advertising, I still prefer it to paywalls.
  - ineptech 5y ago
    > Since ads can run arbitrary JS it's hard to enforce policy programmatically. Letting ads run arbitrary JS is the policy, right? It's not like that's a requirement to make the internet work, that's just a Google policy that trades money for user experience.
    - jefftk 5y ago
      Ads are allowed to run arbitrary JS, but that doesn't mean they are allowed to do arbitrary things by policy. That is, the technical restrictions are not able to be as strict as the policy. A bunch of us were working on a project where ads would be fully declarative, and so no longer able to run arbitrary JavaScript, but this received very little interest outside of Google (advertisers didn't want to move to a new format, publishers didn't care) and we moved on. (Still speaking only for myself)
      - 5y ago
deleted 5y ago
[deleted]
IsThisYou 5y ago
Is it a good idea for Google to allow random advertisers to use privacy sensitive code (like audio access or fingerprinting) in advertiser supplied iframe content? People may be visiting a trusted site and then are asked to allow audio and video, not realising that it is an iframe asking for the permission.
deleted 5y ago
[deleted]

by jefftk 5y ago

reaperducer 5y ago

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone You are correct, that is the author's concern. The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.

ethbr0 5y ago
This is a catch-22 though. If something dangerous to privacy is being widely used in the world, then putting it behind a prompt creates an avalanche of prompts, and results in user apathy. But not prompting requires you to choose a default, which either default to block and breaks things (if it was actually required) or defaults to allow.
- Hallucinaut 5y ago
  I would happily set all browsers to always deny all ads and untrusted domains the ability to use microphone and camera at all times. So there's no need for an avalanche of alerts, it just shouldn't be permissible for a resource from an untrusted source. It may be widely used, but for a highly concentrated set of sites. I can't think of an occasion I've used it beyond Google, Microsoft, and Zoom properties. Perhaps Slack and Discord too? So there must be a better way.
  - noahtallen 5y ago
    > deny… untrusted domains the ability to use microphone and camera at all times I believe this is the default for most browsers now, right? (Or have I been spoiled by Firefox?) This is the best way, where the camera is always inaccessible, unless you enable it for a domain which needs it. Since I rarely ever see the camera/mic request option, I don’t think we’ve been conditioned to allow this type of request. (Compared to cookies, which show up on nearly every site.) If you want to disable permissions dialogues altogether, then what’s a trusted domain? Just zoom and a handful of others? If you write yourself a nice app which uses the mic, do you have to email Google to get yourself added to the list of trusted domains? That would be pretty bad for the open web, so permissions dialogues are the alternative
- smichel17 5y ago
  The solution to this is simple, but not easy: block everything by default and do not prompt to enable it (but do show an indicator of what has been blocked). This is how Firefox tracker protection, uMatrix, noscript, and a plethora of ad blockers and other privacy tools work.
jeffbee 5y ago
What? In what way have you been conditioned to accept prompts?
- fault1 5y ago
  I think there is most definitely conditioning going on. I watched my fiance click on one of the "accept all cookies" GDPR-prompts (it's become an antipattern) a few days ago. She almost automatically did it without thinking. I went to the same site on my laptop and if you clicked decline, it immediately brought up modal dialogs that made that site unusable. I can see why 99% of people would be conditioning to just hit yes.
  - jeffbee 5y ago
    And you blame Google for that, instead of some brain-dead Eurocrat?
    - mrtranscendence 5y ago
      Who said anything about blaming google for users clicking “ok” without thinking about it?
      - jeffbee 5y ago
        The person to whom I replied!
        theWreckluse 5y ago
        To be fair, he said Google and others. I still don't know how much Google is responsible though.
        hetspookjee 5y ago
        Google goes way further and doesn't even serve a prompt. Instead they show you a opt-out plugin that you can download to run in your browser. Most blatant disregard of rules and feeling better than the rest behaviour if you ask me.
jefftk 5y ago
In this case there isn't a prompt: access to the camera and microphone is disallowed by default in cross-origin iframes. The site would have to specifically delegate permission to the ad before it could even trigger a prompt.
denton-scratch 5y ago
> just press "Accept" any prompt that pops up I auto-press [Accept]. I use an ad-blocker. I reject 3rd-party cookies. I disable JS by default, and re-enable it selectively for sites that refuse to work without JS. If that re-enablement involves more than a few clicks, I'll close the site - there are other fish in the sea. What am I doing wrong?

veeti 5y ago

Curiously no explanation why this sort of malicious behavior is accepted by "Google Ad Manager" in the first place. If you haven't already installed: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en https://chrome.google.com/webstore/detail/ublock-origin/cjpa...

jefftk 5y ago
I'm not sure it is allowed; that's not a part of the business I know much about. Since ads can run arbitrary JS it's hard to enforce policy programmatically. On the other hand, it's not clear to me that whatever this advertiser is trying to do is having any real effect, aside from causing a console message that it is being blocked. Access to the mic and camera from cross-origin iframes is blocked by default, and you can't even trigger a permissions prompt. As for installing an ad blocker, even with all the messiness of advertising, I still prefer it to paywalls.
- ineptech 5y ago
  > Since ads can run arbitrary JS it's hard to enforce policy programmatically. Letting ads run arbitrary JS is the policy, right? It's not like that's a requirement to make the internet work, that's just a Google policy that trades money for user experience.
  - jefftk 5y ago
    Ads are allowed to run arbitrary JS, but that doesn't mean they are allowed to do arbitrary things by policy. That is, the technical restrictions are not able to be as strict as the policy. A bunch of us were working on a project where ads would be fully declarative, and so no longer able to run arbitrary JavaScript, but this received very little interest outside of Google (advertisers didn't want to move to a new format, publishers didn't care) and we moved on. (Still speaking only for myself)
    - 5y ago

deleted 5y ago

[deleted]

IsThisYou 5y ago

Is it a good idea for Google to allow random advertisers to use privacy sensitive code (like audio access or fingerprinting) in advertiser supplied iframe content? People may be visiting a trusted site and then are asked to allow audio and video, not realising that it is an iframe asking for the permission.

deleted 5y ago

[deleted]