4 ms·

The font is used by the teamviewer website. When inviting a partner to a teamviewer session, one can do so by sharing the invitation url. The invitation url lo

by 6f 4y ago

The font is used by the teamviewer website. When inviting a partner to a teamviewer session, one can do so by sharing the invitation url. The invitation url looks like this (where XXXXXXXX is the session code). https://get.teamviewer.com/v15/en/sXXXXXXXX The website will check if a teamviewer font is installed (using javascript). If the font is found, the web site assumes that teamviewer is installed. The teamviewer installer also registers a protocol handler in the operating system. The website (javascript code) will thus try to launch teamviewer directly using a url like the following: teamviewer8://instantsupport/?sid=XXXXXXXX Otherwise, if the font is not found, it will prompt the user to download and install the teamviewer application. Source: Font detection routine: https://get.teamviewer.com/get/res/scripts/fontdetect.js Connect routine: https://get.teamviewer.com/get/res/scripts/connect.js

bouncing 4y ago
Clever, but still not an acceptable use of a font. There are very valid security reasons why browsers don't advertise installed software. Using a font install for reasons unrelated to having a font is still not a valid use case, even if the goal is a smooth UX.
mwcampbell 4y ago
This is the benign explanation I was looking for. It's a clever hack for providing a good user experience for the person who's receiving remote support, who can't be assumed to be computer-savvy. Of course, it would be better still if there was a standard way of setting up specific URL patterns under specific domains to automatically launch an associated desktop app if that app is installed. iOS can already do this through the "/.well-known/apple-app-site-association" URL on the domain. It's why Zoom and Teams links, when opened on an iOS device, always go straight into the native app once that app is installed. Edit to add: BTW, the file at the well-known Apple path also gives me a way of detecting a Zoom invite URL in one of my own products, even though Zoom URLs can have custom domains.
- ayewo 4y ago
  Interesting. Based on your comment, I did a quick check and only Zoom gives a valid response. The parent domain for Microsoft Teams don't seem to respect the convention. https://zoom.us/.well-known/apple-app-site-association https://zoom.us/.well-known/apple-app-site-association - 200 OK https://www.microsoft.com/.well-known/apple-app-site-association https://www.microsoft.com/.well-known/apple-app-site-associa... - 404 Not Found
  - acous 4y ago
    https://teams.microsoft.com/.well-known/apple-app-site-association https://teams.microsoft.com/.well-known/apple-app-site-assoc...
  - vel0city 4y ago
    www.microsoft.com is a pretty generic page. Microsoft makes a lot of applications other than Teams. Should it open Onedrive? Excel? OneNote? Xbox? If you go to the actual Teams site, it does have the apple-app-site-association link. https://teams.microsoft.com/.well-known/apple-app-site-association https://teams.microsoft.com/.well-known/apple-app-site-assoc...
    - ayewo 4y ago
      Heh, I've never used teams before so when I did a few searches I got sent to www.microsoft.com and office.com. None of the links on page 1 and 2 of the SERP led to teams.microsoft.com.
      - mwcampbell 4y ago
        Not surprising; teams.microsoft.com goes straight to a login page, so you wouldn't know that's the domain unless you use the product.
- WorldMaker 4y ago
  > Of course, it would be better still if there was a standard way of setting up specific URL patterns under specific domains to automatically launch an associated desktop app if that app is installed. The "PWA" standard for "/.well-known/apple-app-site-association" is "related_applications" [0] in the Web App Manifest standard and specifically here where "prefer_related_applications" [1] is set to true. [0] https://developer.mozilla.org/en-US/docs/Web/Manifest/related_applications https://developer.mozilla.org/en-US/docs/Web/Manifest/relate... [1] https://developer.mozilla.org/en-US/docs/Web/Manifest/prefer_related_applications https://developer.mozilla.org/en-US/docs/Web/Manifest/prefer...
scosman 4y ago
Good find. Disproves the "only useful for web fingerprinting". It's also useful to their users for a fairly common flow. Don't assume malice, but do consider side effects of your decisions. This does add an extra bit to web-fingerprinting, it's only 1 bit. Someone intentionally trying to add fingerprinting could do much more malicious things. Unique font names or uniquely generated font w varying letter widths could completely de-anonymize a user. This seems scoped to identifying team-viewer users, not identifying/fingerprinting individuals.
- electroly 4y ago
  This is still web fingerprinting. They are using this, specifically, for fingerprinting. They don't care about the font; they care about being able to spot TeamViewer users in a crowd. The only difference here is it's being done for a beneficial purpose. "TeamViewer installs font only useful for web fingerprinting" is absolutely true; only the word "suspicious" is untrue because now we know what it's for.
  - throwaway290 4y ago
    Fingerprinting requires there to be a purpose of identifying an individual device, and is done by collecting multiple data points that in aggregate are a unique combination. Just knowing you have a font or TeamViewer, like just knowing your IP or viewport size, isn't fingerprinting your device.
    - dymk 4y ago
      They may not be baking a cake, but they have all the ingredients to bake a cake. They also give everybody else who is currently baking a cake an additional ingredient.
      - kaetemi 4y ago
        And according to the Internet, everything is cake.
userbinator 4y ago
It seems like giving only TeamViewer's site the ability to see this font would solve the fingerprinting problem and let it work as designed. Per-site font lists don't seem to be a common feature in browsers nor extensions, however.
turtleman1338 4y ago
It would be totally sufficient to use the protocol handler. You also can not be sure teamviewer is not installed, just because the font is missing. The user could use an older version that does not include the font, or could have removed the font manually.
- mwcampbell 4y ago
  But can JavaScript check whether the protocol handler is installed? Or can it only attempt to use the protocol handler, then give the user if-then-else instructions to manually handle the case where it's not installed? Remember, a remote support product has to assume that the user receiving support doesn't have the knowledge or energy to go through a complex setup process, which is presumably a digression from whatever problem they were having in the first place.
  - alex_suzuki 4y ago
    It cannot. Enumerating protocol handlers is actually an excellent fingerprinting technique. That’s why platforms like iOS for instance forbid it, or you have to explicitly specify which ones you’ll query (see: https://developer.apple.com/documentation/uikit/uiapplication/1622952-canopenurl https://developer.apple.com/documentation/uikit/uiapplicatio...).
- tiagod 4y ago
  > The user could use an older version that does not include the font Teamviewer versions are not backwards-compatible > It would be totally sufficient to use the protocol handler The error when it's not installed could be confusing to the user. Remember this is a remote support product, you must the assume the user is not tech literate. You must also assume the user is on IE5 or something.
throw03172019 4y ago
Great findings! Great little workaround they developed - super useful.
hedora 4y ago
So it’s a cookie. Do they ask for permission to set it in the EU?
- hatware 4y ago
  Are you being pedantic?
- kevincox 4y ago
  This could very easily be justified as a functional cookie. Honestly if this could only be detected from a TeamViewer-owned domains it would be basically a non-issue. The more concerning bit is that this can be used to build a cross-site fingerprint.
- GrumpyNl 4y ago
  That is a great idea, generate a font on the fly with the info you need and you have your alternative cookie. Question is, do you have to treat it as a cookie?
- Griffinsauce 4y ago
  Are EU laws specifically about cookies or do they have broader wording?
  - detaro 4y ago
    The 2009 ePrivacy directive, also known as "Cookie law", speaks of "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user". GDPR is concerned with all personal data processing, cookie or not is even more irrelevant to it applying.
EGreg 4y ago
That used to be cool but now browsers support this check for an app natively. Does TeamViewer do it to support much older browsers?
Illniyar 4y ago
Oh! That's clever.
system2 4y ago
btilly 4y ago
Why, then, do they only install the font on Windows? Why not do the same thing on OS X or Linux?
- cuteboy19 4y ago
  Not worth the effort presumably.

by 6f 4y ago

bouncing 4y ago

Clever, but still not an acceptable use of a font. There are very valid security reasons why browsers don't advertise installed software. Using a font install for reasons unrelated to having a font is still not a valid use case, even if the goal is a smooth UX.

mwcampbell 4y ago

This is the benign explanation I was looking for. It's a clever hack for providing a good user experience for the person who's receiving remote support, who can't be assumed to be computer-savvy. Of course, it would be better still if there was a standard way of setting up specific URL patterns under specific domains to automatically launch an associated desktop app if that app is installed. iOS can already do this through the "/.well-known/apple-app-site-association" URL on the domain. It's why Zoom and Teams links, when opened on an iOS device, always go straight into the native app once that app is installed. Edit to add: BTW, the file at the well-known Apple path also gives me a way of detecting a Zoom invite URL in one of my own products, even though Zoom URLs can have custom domains.

ayewo 4y ago
Interesting. Based on your comment, I did a quick check and only Zoom gives a valid response. The parent domain for Microsoft Teams don't seem to respect the convention. https://zoom.us/.well-known/apple-app-site-association https://zoom.us/.well-known/apple-app-site-association - 200 OK https://www.microsoft.com/.well-known/apple-app-site-association https://www.microsoft.com/.well-known/apple-app-site-associa... - 404 Not Found
- acous 4y ago
  https://teams.microsoft.com/.well-known/apple-app-site-association https://teams.microsoft.com/.well-known/apple-app-site-assoc...
- vel0city 4y ago
  www.microsoft.com is a pretty generic page. Microsoft makes a lot of applications other than Teams. Should it open Onedrive? Excel? OneNote? Xbox? If you go to the actual Teams site, it does have the apple-app-site-association link. https://teams.microsoft.com/.well-known/apple-app-site-association https://teams.microsoft.com/.well-known/apple-app-site-assoc...
  - ayewo 4y ago
    Heh, I've never used teams before so when I did a few searches I got sent to www.microsoft.com and office.com. None of the links on page 1 and 2 of the SERP led to teams.microsoft.com.
    - mwcampbell 4y ago
      Not surprising; teams.microsoft.com goes straight to a login page, so you wouldn't know that's the domain unless you use the product.
WorldMaker 4y ago
> Of course, it would be better still if there was a standard way of setting up specific URL patterns under specific domains to automatically launch an associated desktop app if that app is installed. The "PWA" standard for "/.well-known/apple-app-site-association" is "related_applications" [0] in the Web App Manifest standard and specifically here where "prefer_related_applications" [1] is set to true. [0] https://developer.mozilla.org/en-US/docs/Web/Manifest/related_applications https://developer.mozilla.org/en-US/docs/Web/Manifest/relate... [1] https://developer.mozilla.org/en-US/docs/Web/Manifest/prefer_related_applications https://developer.mozilla.org/en-US/docs/Web/Manifest/prefer...

scosman 4y ago

Good find. Disproves the "only useful for web fingerprinting". It's also useful to their users for a fairly common flow. Don't assume malice, but do consider side effects of your decisions. This does add an extra bit to web-fingerprinting, it's only 1 bit. Someone intentionally trying to add fingerprinting could do much more malicious things. Unique font names or uniquely generated font w varying letter widths could completely de-anonymize a user. This seems scoped to identifying team-viewer users, not identifying/fingerprinting individuals.

electroly 4y ago
This is still web fingerprinting. They are using this, specifically, for fingerprinting. They don't care about the font; they care about being able to spot TeamViewer users in a crowd. The only difference here is it's being done for a beneficial purpose. "TeamViewer installs font only useful for web fingerprinting" is absolutely true; only the word "suspicious" is untrue because now we know what it's for.
- throwaway290 4y ago
  Fingerprinting requires there to be a purpose of identifying an individual device, and is done by collecting multiple data points that in aggregate are a unique combination. Just knowing you have a font or TeamViewer, like just knowing your IP or viewport size, isn't fingerprinting your device.
  - dymk 4y ago
    They may not be baking a cake, but they have all the ingredients to bake a cake. They also give everybody else who is currently baking a cake an additional ingredient.
    - kaetemi 4y ago
      And according to the Internet, everything is cake.

userbinator 4y ago

It seems like giving only TeamViewer's site the ability to see this font would solve the fingerprinting problem and let it work as designed. Per-site font lists don't seem to be a common feature in browsers nor extensions, however.

turtleman1338 4y ago

It would be totally sufficient to use the protocol handler. You also can not be sure teamviewer is not installed, just because the font is missing. The user could use an older version that does not include the font, or could have removed the font manually.

mwcampbell 4y ago
But can JavaScript check whether the protocol handler is installed? Or can it only attempt to use the protocol handler, then give the user if-then-else instructions to manually handle the case where it's not installed? Remember, a remote support product has to assume that the user receiving support doesn't have the knowledge or energy to go through a complex setup process, which is presumably a digression from whatever problem they were having in the first place.
- alex_suzuki 4y ago
  It cannot. Enumerating protocol handlers is actually an excellent fingerprinting technique. That’s why platforms like iOS for instance forbid it, or you have to explicitly specify which ones you’ll query (see: https://developer.apple.com/documentation/uikit/uiapplication/1622952-canopenurl https://developer.apple.com/documentation/uikit/uiapplicatio...).
tiagod 4y ago
> The user could use an older version that does not include the font Teamviewer versions are not backwards-compatible > It would be totally sufficient to use the protocol handler The error when it's not installed could be confusing to the user. Remember this is a remote support product, you must the assume the user is not tech literate. You must also assume the user is on IE5 or something.

throw03172019 4y ago

Great findings! Great little workaround they developed - super useful.

hedora 4y ago

So it’s a cookie. Do they ask for permission to set it in the EU?

hatware 4y ago
Are you being pedantic?
kevincox 4y ago
This could very easily be justified as a functional cookie. Honestly if this could only be detected from a TeamViewer-owned domains it would be basically a non-issue. The more concerning bit is that this can be used to build a cross-site fingerprint.
GrumpyNl 4y ago
That is a great idea, generate a font on the fly with the info you need and you have your alternative cookie. Question is, do you have to treat it as a cookie?
Griffinsauce 4y ago
Are EU laws specifically about cookies or do they have broader wording?
- detaro 4y ago
  The 2009 ePrivacy directive, also known as "Cookie law", speaks of "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user". GDPR is concerned with all personal data processing, cookie or not is even more irrelevant to it applying.

EGreg 4y ago

That used to be cool but now browsers support this check for an app natively. Does TeamViewer do it to support much older browsers?

Illniyar 4y ago

Oh! That's clever.

system2 4y ago

btilly 4y ago

Why, then, do they only install the font on Windows? Why not do the same thing on OS X or Linux?

cuteboy19 4y ago
Not worth the effort presumably.