8 ms·

Safari 15 IndexedDB Leaks

130 points by agust 5y ago

cakoose 5y ago
I'm viewing the page on Firefox for Android and it looks sort of like the exploit works. Anyone else?
- jtgeibel 5y ago
  It is reporting "not affected" for me on Firefox stable and nightly. It does show a list of domains at the bottom that it would check if the brower was exploitable.
  - olliej 5y ago
    I assume safari is the only effected browser but the site itself gates on a user agent check, because of course it does.
- heavyset_go 5y ago
  It looks like the page only does a User-Agent check[1]. The sites under "The demo detects the following websites:" is just a list of sites that the demo has hardcoded support for detecting[2]. [1] https://github.com/fingerprintjs/blog-indexeddb-safari-leaks-demo/blob/main/src/App.jsx https://github.com/fingerprintjs/blog-indexeddb-safari-leaks... [2] https://github.com/fingerprintjs/blog-indexeddb-safari-leaks-demo/blob/main/src/Components/SupportedWebsites.jsx https://github.com/fingerprintjs/blog-indexeddb-safari-leaks...
encryptluks2 5y ago
- cpressland 5y ago
  Software bugs have nothing to do with an organisations intentions.
  - admax88qqq 5y ago
    If they let other browers engines on iOS people could choose more privacy focused browsers.
    - jimbob45 5y ago
      I’m amazed Meta/Instagram is getting investigated for antitrust while Apple is getting away with what got MS pegged in 98. It’s easy to assume regulatory capture but I wonder if Apple is effectively untouchable by whichever party is incumbent. Apple represents such a huge chunk of the US economy that penalties would likely rock the market. Market instability has ruined the careers of many politicians over the years.
      - echelon 5y ago
        Apple and Google are the most deserving of being split up [1], but you won't see it happen. Do you know how many congresspersons likely hold Apple stock? Meanwhile Facebook is used as a platform to criticize politicians on both sides of the aisle. They all hate it. [1] As I most recently articulated here: https://news.ycombinator.com/item?id=29908253 https://news.ycombinator.com/item?id=29908253
      - petmon 5y ago
        The case against MS was abusive licensing practices. MS blocked OEMs from choosing their own default browser, and charged OEMs a license fee even if the computers weren't running Windows. That doesn't apply to Apple which does not license their OS. Android and ChromeOS both technically allow other browser engines, but in practice non-Chromium browsers are a rounding error on those platforms. You can technically allow other browser engines, but that does not create a robust browser market.
        arvinsim 5y ago
        All of that is just conjecture until Apple actually allows different browser engines.
    - 5y ago
saagarjha 5y ago
Discussion from today: https://news.ycombinator.com/item?id=29947396 https://news.ycombinator.com/item?id=29947396
aqibgatoo 5y ago
All of this hell has broken loose due to youtube hiding dislikes
- deleted 5y ago
  [deleted]
- Retr0id 5y ago
  How so?
debdut 5y ago
I never understand why WebSQL was replaced by IndexedDB, it was so much faster! Sure different implementations and all, Sqlite vulnerability and what not arguments! And still I see exploits every year on IndexedDB every year, the only thing that changed is it's slower!
- olliej 5y ago
  This I can actually answer :D Multiple reasons: * No two SQL implementations have the same dialect * There is no publicly available specification * The people in charge of the non-free specification have demonstrated no desire to: * Make the spec public and freely available * Remove (or make mandatory) any optional features * Update the spec to match the real world, unify discrepancies, and require conformance to that spec * Following the above, existing commercial vendors have no desire to create a unified specification that covers, presumably as that would ease transition between DBs? The core problem was that existing websql implementations were just shipping wrappers around sqlite. That meant no one could create an implementation without first doing a blackbox rewrite of sqlite, and would just have to hope they hadn't messed up anywhere.

130 points by agust 5y ago

cakoose 5y ago

I'm viewing the page on Firefox for Android and it looks sort of like the exploit works. Anyone else?

jtgeibel 5y ago
It is reporting "not affected" for me on Firefox stable and nightly. It does show a list of domains at the bottom that it would check if the brower was exploitable.
- olliej 5y ago
  I assume safari is the only effected browser but the site itself gates on a user agent check, because of course it does.
heavyset_go 5y ago
It looks like the page only does a User-Agent check[1]. The sites under "The demo detects the following websites:" is just a list of sites that the demo has hardcoded support for detecting[2]. [1] https://github.com/fingerprintjs/blog-indexeddb-safari-leaks-demo/blob/main/src/App.jsx https://github.com/fingerprintjs/blog-indexeddb-safari-leaks... [2] https://github.com/fingerprintjs/blog-indexeddb-safari-leaks-demo/blob/main/src/Components/SupportedWebsites.jsx https://github.com/fingerprintjs/blog-indexeddb-safari-leaks...

encryptluks2 5y ago

cpressland 5y ago
Software bugs have nothing to do with an organisations intentions.
- admax88qqq 5y ago
  If they let other browers engines on iOS people could choose more privacy focused browsers.
  - jimbob45 5y ago
    I’m amazed Meta/Instagram is getting investigated for antitrust while Apple is getting away with what got MS pegged in 98. It’s easy to assume regulatory capture but I wonder if Apple is effectively untouchable by whichever party is incumbent. Apple represents such a huge chunk of the US economy that penalties would likely rock the market. Market instability has ruined the careers of many politicians over the years.
    - echelon 5y ago
      Apple and Google are the most deserving of being split up [1], but you won't see it happen. Do you know how many congresspersons likely hold Apple stock? Meanwhile Facebook is used as a platform to criticize politicians on both sides of the aisle. They all hate it. [1] As I most recently articulated here: https://news.ycombinator.com/item?id=29908253 https://news.ycombinator.com/item?id=29908253
    - petmon 5y ago
      The case against MS was abusive licensing practices. MS blocked OEMs from choosing their own default browser, and charged OEMs a license fee even if the computers weren't running Windows. That doesn't apply to Apple which does not license their OS. Android and ChromeOS both technically allow other browser engines, but in practice non-Chromium browsers are a rounding error on those platforms. You can technically allow other browser engines, but that does not create a robust browser market.
      - arvinsim 5y ago
        All of that is just conjecture until Apple actually allows different browser engines.
  - 5y ago

saagarjha 5y ago

Discussion from today: https://news.ycombinator.com/item?id=29947396 https://news.ycombinator.com/item?id=29947396

aqibgatoo 5y ago

All of this hell has broken loose due to youtube hiding dislikes

deleted 5y ago
[deleted]
Retr0id 5y ago
How so?

debdut 5y ago

I never understand why WebSQL was replaced by IndexedDB, it was so much faster! Sure different implementations and all, Sqlite vulnerability and what not arguments! And still I see exploits every year on IndexedDB every year, the only thing that changed is it's slower!

olliej 5y ago
This I can actually answer :D Multiple reasons: * No two SQL implementations have the same dialect * There is no publicly available specification * The people in charge of the non-free specification have demonstrated no desire to: * Make the spec public and freely available * Remove (or make mandatory) any optional features * Update the spec to match the real world, unify discrepancies, and require conformance to that spec * Following the above, existing commercial vendors have no desire to create a unified specification that covers, presumably as that would ease transition between DBs? The core problem was that existing websql implementations were just shipping wrappers around sqlite. That meant no one could create an implementation without first doing a blackbox rewrite of sqlite, and would just have to hope they hadn't messed up anywhere.