13 ms·

Recently made this extension and interested in getting some feedback on it. Vytal can Spoof your timezone, locale, geolocation and user agent. This data can be

by _gyhb 4y ago

Recently made this extension and interested in getting some feedback on it. Vytal can Spoof your timezone, locale, geolocation and user agent. This data can be used to track you or reveal your location. Most extensions that provide anti-fingerprinting features rely on content scripts to inject script tags into webpages. There are many limitations to script tag injections which you can read about here: https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/ https://palant.info/2020/12/10/how-anti-fingerprinting-exten... Vytal utilizes the chrome.debugger API to spoof this data. This allows the data to be spoofed in frames, web workers and during the initial loading of a website. It also makes the spoofing completely undetectable. You can test and compare Vytal and other extensions on https://vytal.io https://vytal.io Unfortunately it doesn't work on Firefox since Firefox doesn't support the debugger API. Works on Brave tho.

InCityDreams 4y ago
Using Brave browser. Every page, and every reload brings up a "'Vytal' started debugging this browser" message.
0x0000000 4y ago
I'm commenting here both to remind myself to check back and try this out when I'm not on mobile, and to thank you for building this- at first glance it looks good.
- kilroy123 4y ago
  You can save a comment. Just click the timestamp (x hours ago), then click favorite.
0des 4y ago
I dont want to dislike firefox, but I am starting to find new reasons to resent it. It seems like every other week there is something new I'm finding out about that gives me pause before running updates. Every new 'feature' brings me further and further away from feeling like it's a browser I can trust to be just a browser. Something has to change. Pocket, Allo, still taking the google allowance, absolutely squandering their endowments on salary, too much focus on social signaling and politics. Just be a browser, please. I won't be going to anything chrome-like, but I do see myself spending a lot more time using and sponsoring qutebrowser, or simply passively consuming offline.
- judge2020 4y ago
  > still taking the google allowance, Doesn't Mozilla's revenue breakdown still show Google as the majority of their revenue, and pocket et al are efforts to diversify?
  - xalava 4y ago
    I wonder how that compares with Google Chrome relationship with Google...
- deleted 4y ago
  [deleted]
- jamal-kumar 4y ago
  Not having some proprietary debugger thing for this to work with when you can just set location in about:config seems like the pettiest nitpick
  - 0des 4y ago
    If wanting a browser to be just a browser is petty, then I am the pettiest. If you havent tried qutebrowser yet, give it a shot. When I say just a browser, this hits it pretty close, if you ask me.
    - jamal-kumar 4y ago
      Vim mode is pretty neat. It seems like the whole app is kind of just like a python gui app wrapper around webkit? Looks like it would be pretty good if I was using linux and a tiling wm as my main thing but these days I'm pretty bound to Windows for the type of development I'm working on. Most of my linux desktop usage these days is stuff like writing scrapers in cloud containers that need a real browser that I can control using selenium or puppeteer or whatever though, is it supporting anything like that? If this works on Windows too that would be a bonus.
      - 0des 4y ago
tauwauwau 4y ago
Just installed it, it's showing a message on top of each tab in Chrome "Vytal" started debugging this browser Is there a way to get rid of it?
- ldoughty 4y ago
  There is a note at the link that explains the command line flag you need to pass in
  - tauwauwau 4y ago
    Thanks, I will have to create a shortcut for it. This should work chrome.exe --silent-debugger-extension-api Is it safe to do? I mean I want to stop this message for Vytal only, because I know that it uses debugger API. But I would want to know if tomorrow my adblocker starts to use debugger API.
    - ibejoeb 4y ago
      Any existing extension would have to explicitly declare the appropriate permission for using the debugger API. Chrome automatically disables extensions that add new permissions until you review them.
WithinReason 4y ago
Can you explain how Firefox (or Chrome) knows my location within 20m even if I use a VPN? Brave puts me where I think the VPN exit point is. For example: https://wikishootme.toolforge.org/ https://wikishootme.toolforge.org/
- saurik 4y ago
  Many (most?) VPN mechanisms don't entirely remove access to the other routes from apps that manually request them, so even if an app isn't able to use something akin to "location services" on your device it might still easily be able to get access to your other IP addresses by sending requests with sockets manually bound to specific interfaces, and even might choose to lower the priority of information learned using interfaces that are clearly tunnel devices instead of network cards.
  - TecoAndJix 4y ago
    Also known as split tunnel, this can be used by corporate VPN solutions to lower the amount of network traffic entering a data center (so you don’t overload your undersized pipes)
    - saurik 4y ago
      No, I don't mean that. That's when you purposefully set your routing table to split some traffic to different paths. The premise here is that even if all of your traffic is supposedly going over a VPN, an app can often opt out of that and do whatever it wants.
  - TedDoesntTalk 4y ago
    > by sending requests with sockets manually bound to specific interfaces I don’t believe this is possible in client JavaScript within a web browser. Very open to be proved wrong.
    - saurik 4y ago
      I thought the complaint was that the browser was figuring it out directly and then exposing it, such as via the browser's location API, not that the website was figuring it out using non-location network mechanisms provided by the browser. (FWIW, a website that is given media recording privileges can definitely do that, though, using WebRTC. If you don't have that privilege then you can still use the WebRTC API but it doesn't return alternative candidates. But I also don't think that is what they meant.)
momirlan 4y ago
if this were true then BBC would know I'm not watching from UK.
VWWHFSfQ 4y ago
> It also makes the spoofing completely undetectable. It's my understanding that the usage of the debugger is detectable by scripts running on the page. I've actually come across content websites that will refuse to activate their features (play video) if the debugger is active. Similarly on Android some video streaming apps will refuse to load and play their content catalog if USB debugging is enabled.
- _gyhb 4y ago
  How can you detect it? Which websites refuse to activate their features if the debugger is active?
  - hericium 4y ago
    I've had the opposite experience: parts of websites broken by tracking blocker started working after popping debugger up.
  - runlevel1 4y ago
    The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
    - _gyhb 4y ago
      I'm unsure if that would work for this extension. Do you have a link to an implementation?
      - runlevel1 4y ago
        I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API. If it ignores it, you're fine. This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf https://www.usenix.org/system/files/sec21-musch.pdf The debugger timing method is described on page 10.

by _gyhb 4y ago

InCityDreams 4y ago

Using Brave browser. Every page, and every reload brings up a "'Vytal' started debugging this browser" message.

0x0000000 4y ago

I'm commenting here both to remind myself to check back and try this out when I'm not on mobile, and to thank you for building this- at first glance it looks good.

kilroy123 4y ago
You can save a comment. Just click the timestamp (x hours ago), then click favorite.

0des 4y ago

I dont want to dislike firefox, but I am starting to find new reasons to resent it. It seems like every other week there is something new I'm finding out about that gives me pause before running updates. Every new 'feature' brings me further and further away from feeling like it's a browser I can trust to be just a browser. Something has to change. Pocket, Allo, still taking the google allowance, absolutely squandering their endowments on salary, too much focus on social signaling and politics. Just be a browser, please. I won't be going to anything chrome-like, but I do see myself spending a lot more time using and sponsoring qutebrowser, or simply passively consuming offline.

judge2020 4y ago
> still taking the google allowance, Doesn't Mozilla's revenue breakdown still show Google as the majority of their revenue, and pocket et al are efforts to diversify?
- xalava 4y ago
  I wonder how that compares with Google Chrome relationship with Google...
deleted 4y ago
[deleted]
jamal-kumar 4y ago
Not having some proprietary debugger thing for this to work with when you can just set location in about:config seems like the pettiest nitpick
- 0des 4y ago
  If wanting a browser to be just a browser is petty, then I am the pettiest. If you havent tried qutebrowser yet, give it a shot. When I say just a browser, this hits it pretty close, if you ask me.
  - jamal-kumar 4y ago
    Vim mode is pretty neat. It seems like the whole app is kind of just like a python gui app wrapper around webkit? Looks like it would be pretty good if I was using linux and a tiling wm as my main thing but these days I'm pretty bound to Windows for the type of development I'm working on. Most of my linux desktop usage these days is stuff like writing scrapers in cloud containers that need a real browser that I can control using selenium or puppeteer or whatever though, is it supporting anything like that? If this works on Windows too that would be a bonus.
    - 0des 4y ago

tauwauwau 4y ago

Just installed it, it's showing a message on top of each tab in Chrome "Vytal" started debugging this browser Is there a way to get rid of it?

ldoughty 4y ago
There is a note at the link that explains the command line flag you need to pass in
- tauwauwau 4y ago
  Thanks, I will have to create a shortcut for it. This should work chrome.exe --silent-debugger-extension-api Is it safe to do? I mean I want to stop this message for Vytal only, because I know that it uses debugger API. But I would want to know if tomorrow my adblocker starts to use debugger API.
  - ibejoeb 4y ago
    Any existing extension would have to explicitly declare the appropriate permission for using the debugger API. Chrome automatically disables extensions that add new permissions until you review them.

WithinReason 4y ago

Can you explain how Firefox (or Chrome) knows my location within 20m even if I use a VPN? Brave puts me where I think the VPN exit point is. For example: https://wikishootme.toolforge.org/ https://wikishootme.toolforge.org/

saurik 4y ago
Many (most?) VPN mechanisms don't entirely remove access to the other routes from apps that manually request them, so even if an app isn't able to use something akin to "location services" on your device it might still easily be able to get access to your other IP addresses by sending requests with sockets manually bound to specific interfaces, and even might choose to lower the priority of information learned using interfaces that are clearly tunnel devices instead of network cards.
- TecoAndJix 4y ago
  Also known as split tunnel, this can be used by corporate VPN solutions to lower the amount of network traffic entering a data center (so you don’t overload your undersized pipes)
  - saurik 4y ago
    No, I don't mean that. That's when you purposefully set your routing table to split some traffic to different paths. The premise here is that even if all of your traffic is supposedly going over a VPN, an app can often opt out of that and do whatever it wants.
- TedDoesntTalk 4y ago
  > by sending requests with sockets manually bound to specific interfaces I don’t believe this is possible in client JavaScript within a web browser. Very open to be proved wrong.
  - saurik 4y ago
    I thought the complaint was that the browser was figuring it out directly and then exposing it, such as via the browser's location API, not that the website was figuring it out using non-location network mechanisms provided by the browser. (FWIW, a website that is given media recording privileges can definitely do that, though, using WebRTC. If you don't have that privilege then you can still use the WebRTC API but it doesn't return alternative candidates. But I also don't think that is what they meant.)

momirlan 4y ago

if this were true then BBC would know I'm not watching from UK.

VWWHFSfQ 4y ago

> It also makes the spoofing completely undetectable. It's my understanding that the usage of the debugger is detectable by scripts running on the page. I've actually come across content websites that will refuse to activate their features (play video) if the debugger is active. Similarly on Android some video streaming apps will refuse to load and play their content catalog if USB debugging is enabled.

_gyhb 4y ago
How can you detect it? Which websites refuse to activate their features if the debugger is active?
- hericium 4y ago
  I've had the opposite experience: parts of websites broken by tracking blocker started working after popping debugger up.
- runlevel1 4y ago
  The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
  - _gyhb 4y ago
    I'm unsure if that would work for this extension. Do you have a link to an implementation?
    - runlevel1 4y ago
      I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API. If it ignores it, you're fine. This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf https://www.usenix.org/system/files/sec21-musch.pdf The debugger timing method is described on page 10.