13 ms·
TeamViewer installs suspicious font only useful for web fingerprinting
- Kukumber 4y agoNice discovery, indeed that is very suspicious, i wish Microsoft would have sorted out permissions for Windows.. This would help notice things like that earlier I use this: https://processhacker.sourceforge.io/ https://processhacker.sourceforge.io/ gives me notifications whenever a process create/delete services, also has a nice CPU graph in the system tray, thanks to that i noticed Windows will eat your CPU/DISKs whenever you AFK, some telemetry/update thing running in the background.. even when you just idle watching a video.. inefficient telemetry software.. sweet.. what a time to be alive
- kaetemi 4y agoIs that the Microsoft Store related process (wsappx) that has a habit of spinning the CPU for hours?
- dingleberry420 4y agoAlso just disk indexing which exists to make your user experience better. Not everything is malicious.
- MaxikCZ 4y agoIndexing is running all the time yet when I search for something it takes ages to find anyways. Yet "Everything" indexes my disk in a minute and spits out results instantly. Even if windows indexing aint malicious, it certainly behaves as if it is.
- d2wa 4y ago> Even if windows indexing aint malicious, it certainly behaves as if it is. The problem is that closing files takes a lot of time on Windows. https://www.youtube.com/watch?v=qbKGw8MQ0i8 https://www.youtube.com/watch?v=qbKGw8MQ0i8
- Kaze404 4y agoIf they're indexing your disk 24/7 for a better user experience and searching for something still barely works half the time, I'd be less embarrassed if it was attributed to malice.
- rejectfinite 4y ago> some telemetry/update thing Could be automatic maintenence https://www.tenforums.com/tutorials/40119-enable-disable-automatic-maintenance-windows-10-a.html https://www.tenforums.com/tutorials/40119-enable-disable-aut... , updates to programs, the windows store updates or windows update service... What says it is Telemetry?
- Kukumber 4y agoI forgot the name, i'll try to note that down whenever i'm on my windows partition
- cabirum 4y agoI skimmed the article and looks like they didn't try to compare the font from two different PCs. I think it may be a uniquely generated/procedural font, identifying a specific installation.
- sschueller 4y agoIf they are so hell bent of forcing users to pay stop offering a free version.
- squarefoot 4y agoThat would equal to fishing without a bait on the hook:)
- monkeydust 4y agoFor what possible intention though?
- huhtenberg 4y agoHa, excellent point. You could potentially leak any small piece of information by encoding it in glyph shapes. Should be enough capacity for something like MachineGUID.
- alophawen 4y agoInstead of spreading ridiculous claims, why won't you just confirm your hypothesis? All it takes is 2 ip:s and two downloads of their installer and compare checksums. https://download.teamviewer.com/download/TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.ex... 4440facac7b7bf11478a0368ce448adc732d97ae TeamViewer_Setup.exe
- stevewatson301 4y agoThis is a very charitable interpretation of corporate behavior, but perhaps one reason this could have been implemented is to enable support teams to detect if it's installed on a system. As with anything though, it could be abused by tech support scammers. Overall, I wish such things weren't implemented.
- Flimm 4y agoMy proposal: 1. Browsers should ship with a set of fonts used just in the web browser that web designers can count on. Right now, there isn't a font I can count on finding in Chrome on all platforms. This especially matters for non-English languages, where a different system font can lead to a website that looks very different. 2. Browsers should not load fonts installed in the operating system. It's a fingerprinting vulnerability. And it also causes issues where the system-installed font is unexpectedly different from platform to platform. For example, Arial is different across platforms, especially once you consider non-English languages.
- lelandfe 4y ago> Browsers should not load fonts installed in the operating system Already in the works, and some browsers don’t today (eg Safari). They permit the default system fonts (eg Helvetica) but nothing more from user space. In the future it will be a permission you grant a site: https://wicg.github.io/local-font-access/ https://wicg.github.io/local-font-access/ It’s a great move. The benefits of local fonts are negligible and the downsides are clearly enormous
- jonnycomputer 4y agoCrazy, in a way, that it wasn't already this way from the beginning.
- gfaster 4y agoimo it's more crazy that people thought of tracking users by using a font in the first place. The level of human ingenuity that has gone into spying on people is staggering.
- greyhair 4y agoFollow the money. It is always about the money. I was at a corporate security conference where one of the speakers stated that organized crime groups hire the top mathematicians and computer scientists from the top universities every year. They provide them with laboratories that you wish your company could afford.
- rawoke083600 4y agoLol that is horrible and kinda clever ! Still horrible - Lol Linus (Linus Tech Tips) are renowned for hating them and their sales tactics.
- jes 4y agoI had a TeamViewer subscription for a few years. Getting it cancelled when I elected not to renew it was tedious and difficult. I don’t recommend TeamViewer anymore. My opinion is that they are janky as hell.
- joenathanone 4y agoI paid for a lifetime license, who knew that a lifetime was less than 10 years? My lifetime license was revoked and I have to buy the latest version I want to continue using. No thank you.
- AndyJames 4y agoI think Linus from Linus Tech Tips had the same issue. It's worth watching this on YT
- HanClinto 4y agoThis was hilarious, thank you for the tip! Here's the ref in case anyone else wants to watch it also: https://www.youtube.com/watch?v=SCRzaGUKEFA https://www.youtube.com/watch?v=SCRzaGUKEFA https://www.youtube.com/watch?v=mBC5BqRNkas https://www.youtube.com/watch?v=mBC5BqRNkas
- m-p-3 4y agoOne thing I understood a while ago is that any service claiming a lifetime license is it's either the lifetime of the product or the company, not the customer. I tend to avoid it unless I'm fairly certain the product / company will last for longer than it would cost me per year of a subscription (to make sure my "investment" is worth it), and that I'll use it extensively. Nothing is truely forever, and moreso in the world of software.
- TheFreim 4y agoWhat's the best alternative you've found? I personally use anydesk from time to time when helping family with tech issues remotely, but I haven't looked too much at other software.
- shikoba 4y agoAd soon as you bow to proprietary softwares you implicitly accept those kind of behaviors.
- alophawen 4y agoThe file in question is TeamViewer15.odf As usual on HN, people is speculating and guessing rather than studying the subject. https://file.io/8EeNRguzVgpj https://file.io/8EeNRguzVgpj
- hereme888 4y agoBrave browser randomizes default installed language and fonts to resist that sort of fingerprinting. Just a shill for Brave. *Edit: well, I didn't know randomization or the plain use of Brave itself is a useful fingerprint point.
- hoistbypetard 4y agoUnfortunately, if a site can detect that a visitor is using Brave, that is a very useful datapoint for fingerprinting.
- d2wa 4y agonavigator.brave.isBrave()
- hoistbypetard 4y agoRight. I'm saying that, on the only site I run where I look at this kind of thing, when I review the stats, "uses Brave" puts a visitor into a pool of 2 people. Preventing me from enumerating their fonts is a valiant effort, though.
- paulryanrogers 4y agoWait doesn't randomizing make one more easily fingerprinted? Unless every check returns different results. And even that behavior could be a strong signal to distinguish Brave from other browsers.
- DonHopkins 4y agoI would love to have a nice scalable TrueType font of the fingerprints of famous serial killers and criminals and insurrectionists like Donald Trump. That would be so cool! You could scatter them all over your documents to make them look incriminating.
- mdp2021 4y agoThe configuration in Firefox privacy.resistFingerprinting should impede it («Not all fonts installed on your computer are available to webpages»), but I am not sure, as I do not know the exact "which fonts to expose" rule. Edit: in theory, it should allow only "«base»" fonts and not user installed. In practice, more details would be useful.
- Ansil849 4y ago> In practice, more details would be useful. More details (the lists of whitelisted fonts per OS) are here: https://bugzilla.mozilla.org/show_bug.cgi?id=1336208 https://bugzilla.mozilla.org/show_bug.cgi?id=1336208
- Ansil849 4y agoTo lessen font enumeration attacks in Firefox, you can go to about:config and make sure privacy.resistFingerprinting is set to True.
- d2wa 4y agoThat setting can cause weird rendering issues in PDFs.
- orbital-decay 4y agoRFP is great but it also heavily interferes with addons. It disables Ctrl and Alt key combinations for them, breaks scrolling and timer-based behavior, and generally renders many of the addons unusable in various ways.
- p4bl0 4y agoI cannot use this because it always resets the custom zoom level for web site. For example I cannot browse HN with the default font size, so I set Firefox to zoom 120% for news.ycombinator.com, and I don't want to have to do that each time I come back to the site.
- Ansil849 4y agoYes, this is by design: https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 Privacy is at odds with usability, sometimes.
- stormdennis 4y ago30 days before your subscription expires, teamviewer send you a friendly email to remind you to that your subscription expires in 30 days and to be sure to renew before then in order to not lose service. What that email does not tell you is that unless you cancel your subscription at least 30 days (ie on that very day) before your sub expires they will renew you automatically and demand a full year's subscription under threat of legal proceedings. Personally I believe that the purpose of this email is to lull you into a false sense of security that you can just let your subscription lapse instead of renewing when that is far from the case.
- markdown 4y agolol why do people put up with these scams? I want to sign up just so I can tell them to fuck off when they try that with me.
- tartoran 4y agoThat is a classical dark pattern already.
- user3939382 4y agoWhere is Congress, the FTC, state Attorney General, and DOJ on this kind of stuff? I bet you if one of these tricks was a problem for the donors that run our government it would be taken care of.
- hattar 4y agoIf our representatives weren’t all so old, they might have a concept of these types of issues. Unfortunately without age limits we’re stuck with candidates so old that most lack an awareness of the most common issues of living and working with the internet.
- brycewray 4y agoIt’s not about age (nearing 67 here, so I bristle at such mentions). Probably even the youngest members of Congress wouldn‘t have a clue about some of these items. It comes down to things like what their staff knows and what they’ve actually experienced themselves. One doesn’t generally reach public office and/or the staff of an office-holder through a path even remotely like what a typical HN commenter has followed.
- tyingq 4y ago>I haven’t examined archived versions of the TeamViewer website; it might have used the font in the past. That seems the most likely explanation. That it was once used somewhere in TeamViewer, no longer is, but is still packaged. I don't think there's a real conspiracy involved.
- 4ggr0 4y agoI'm currently using TeamViewer on a single PC, but I'm searching for an alternative. Big plus if the alternative is OSS + self-hosted, but I'm open to other solutions. My current workflow is -> Connect to HomeVPN -> Turn on Gaming PC with WakeOnLAN -> Connect with TeamViewer to start Steam -> Start gaming with Steam RemotePlay. I did not find a way for Steam to autostart without logging into Window, that's the only reason I currently use TeamViewer, essentially to login and start Steam.
- thegeomaster 4y agoHave you tried Parsec?
- maxloh 4y ago
- 4ggr0 4y agoNo, but it looks very interesting. So this would replace TeamViewer and Steam RemotePlay at the same time, not bad. Just not that big of a fan about the pricing. $100 per year just so that my SO can play on their PC at their home, while I'm not at my home, seems a bit steep. Yeah, my use-case is very specific, I know. I don't even game remote myself, but if I'm on holidays or at work and my partner wants to game from their home, I need a way to be able to power on my PC and everything necessary for it to work. A complete niche, first-world problem :)
- thegeomaster 4y agoI myself use the free tier, didn't miss any of the paid features. It's easily the best, lowest-latency, most no-hassle remote desktop tool I've ever used. Once they add Linux hosting I won't mind shelling out some cash either.
- yamazakiwi 4y agoMy desktop machine is not in my living room but I like to watch shows on my large TV while gaming from the couch. I use Parsec and remote to my desktop from my shitty laptop and get much better performance than I would just gaming with an integrated chipset and it's portable. Also, plugging in a usb controller into my laptop automatically controls the desktop without any setup. Only bad thing I can say is that they got bought by Unity last year and Unity is now merging with IronSource :/
- mwcampbell 4y agoI choose to assume there's a benign explanation for this. Nobody's perfect; nobody can be expected to do everything in the optimal, least suspicious way; sometimes developers just have to come up with a good-enough solution for something and ship it. So let's look for the most charitable explanation of this. It's how we'd want online randos to approach our own work, right?
- squarefoot 4y agoI used TeamViewer less than twice a month for a few elderly relatives who needed help when I wasn't visiting. One of them sadly passed away recently, and another stopped using computers, so my usage went almost to zero. What angers me is that the fine folks/algorithm at TeamWiever kept killing my connections because they thought I was a professional abusing their free service. Screw them: Now I'll either find an alternative or nothing.
- 6f 4y agoThe font is used by the teamviewer website. When inviting a partner to a teamviewer session, one can do so by sharing the invitation url. The invitation url looks like this (where XXXXXXXX is the session code). https://get.teamviewer.com/v15/en/sXXXXXXXX The website will check if a teamviewer font is installed (using javascript). If the font is found, the web site assumes that teamviewer is installed. The teamviewer installer also registers a protocol handler in the operating system. The website (javascript code) will thus try to launch teamviewer directly using a url like the following: teamviewer8://instantsupport/?sid=XXXXXXXX Otherwise, if the font is not found, it will prompt the user to download and install the teamviewer application. Source: Font detection routine: https://get.teamviewer.com/get/res/scripts/fontdetect.js Connect routine: https://get.teamviewer.com/get/res/scripts/connect.js
- bouncing 4y agoClever, but still not an acceptable use of a font. There are very valid security reasons why browsers don't advertise installed software. Using a font install for reasons unrelated to having a font is still not a valid use case, even if the goal is a smooth UX.
- mwcampbell 4y agoThis is the benign explanation I was looking for. It's a clever hack for providing a good user experience for the person who's receiving remote support, who can't be assumed to be computer-savvy. Of course, it would be better still if there was a standard way of setting up specific URL patterns under specific domains to automatically launch an associated desktop app if that app is installed. iOS can already do this through the "/.well-known/apple-app-site-association" URL on the domain. It's why Zoom and Teams links, when opened on an iOS device, always go straight into the native app once that app is installed. Edit to add: BTW, the file at the well-known Apple path also gives me a way of detecting a Zoom invite URL in one of my own products, even though Zoom URLs can have custom domains.
- ayewo 4y agoInteresting. Based on your comment, I did a quick check and only Zoom gives a valid response. The parent domain for Microsoft Teams don't seem to respect the convention. https://zoom.us/.well-known/apple-app-site-association https://zoom.us/.well-known/apple-app-site-association - 200 OK https://www.microsoft.com/.well-known/apple-app-site-association https://www.microsoft.com/.well-known/apple-app-site-associa... - 404 Not Found
- password4321 4y agoDoes anyone know where to get Palida Narrow, the font installed by the Gauss malware? https://arstechnica.com/information-technology/2013/03/the-worlds-most-mysterious-potentially-destructive-malware-is-not-stuxnet https://arstechnica.com/information-technology/2013/03/the-w...
- midislack 4y agoWhy would you even use TeamViewer? It just seems shady.
- smeej 4y agoCompanies that routinely deal with remote access scams (I'm thinking especially of crypto exchanges) could check for this font and display specific warnings only to people who had TeamViewer installed on their Windows machine (probably disproportionately represented among scam victims). TeamViewer is a long way from the only software being used for this, but it's kind of a cool opportunity.
- pnw 4y agoThis is a pretty common hack for shortcut launching, something which browsers have restricted over the years.
- nullcontext 4y agoYeah but why haven't I been blocked yet for [b]commercial use suspected[/b]?