8 ms·

> Disable Scroll To Text Fragment Why would Brave disable this? In my opinion, this is one of the most useful additions to browsers in recent memory, and it's

> Disable Scroll To Text Fragment Why would Brave disable this? In my opinion, this is one of the most useful additions to browsers in recent memory, and it's quite annoying to click a link expecting to go a specific section and just be put at the top of the page. I noticed this was broken in Brave, but I never would have imagined they intentionally broke the feature.

Phelinofist 4y ago
Came to ask the same question
- FatalLogic 4y ago
  >Came to ask the same question It IS an interesting question. But you should simply upvote it, if you have nothing at all to add.
Waterluvian 4y ago
This is probably the #1 feature that gives me the most personal conflict. I remember seeing it for the first time and thinking, “oh here we go. Google needed browsers to have a feature to make its search engine UX better…” But I also cannot deny just how useful it is.
- maven29 4y ago
  Does the internet have any discovery mechanisms except social media curation and search engines? If videos can be timestamped for links, why not webpages? Linking to automatic content-indexed excerpts shows respect for the time spent by recipient and saves markup effort for the author.
  - Frost1x 4y ago
    I mean you can arbitrarily type domain names with common TLDs in and see what happens. I hear the white house may not be a good start to roll the dice on. Yahoo, Altavista, and others used to have a curated index of quality websites. Links are inherently a discovery feature. Services like StumbleUpon used to exist but could arguably be seen as "social." The problem with "social media curation" as a qualifier could be interpreted as "a human is involved." Pretty much all forms of discovery, internet or not, requires either search or a human involved. Some services of course have broadcast mechanisms for curating an index but that's about the only exception I can think of for discovery that breaks away from these two qualifiers. To some degree, DNS is a broadcast system for discovery.
    - derefr 4y ago
      > I mean you can arbitrarily type domain names with common TLDs in and see what happens. I've always been curious whether any search engine tries to index the "disconnected web" by just war-dialing domains/IPs like this. > To some degree, DNS is a broadcast system for discovery. Sadly, there's no real way to build a "DNS spider." You could if you could send DNS AXFR queries for arbitrary zones; but DNS servers mostly don't respond to these without authentication.
    - maven29 4y ago
      In the absence of a universal recommender system that acts on clustering effects, social networks and link aggregators like HN can really be the next best thing. It looks like at one point, mozilla attempted to solve this with their context graph project as well as their acquisition of pocket. However, it does look like it has all the hallmarks of a technological solution to a societal problem. Solving the adverserial aspects as well as ethical concerns would require nothing short of a rethinking of how we use the web. https://medium.com/firefox-context-graph/context-graph-its-time-to-bring-context-back-to-the-web-a7542fe45cf3 https://medium.com/firefox-context-graph/context-graph-its-t... https://wiki.mozilla.org/Context_Graph https://wiki.mozilla.org/Context_Graph
  - teej 4y ago
    Is it time to bring back web rings?
    - Waterluvian 4y ago
      God I wish. I’m not sure they’re actually a good idea or not but I miss classic web.
- darepublic 4y ago
  Scroll to text? How about in page anchors.
  - illiac786 4y ago
    Lots of effort. Less granular. And what about external resources?
dannyobrien 4y ago
There were some privacy concerns, regarding leaking of user information: https://github.com/WICG/scroll-to-text-fragment/issues/76 https://github.com/WICG/scroll-to-text-fragment/issues/76
- illiac786 4y ago
  I read this and I am surprised the link fragment is sent to the DNS server, that is not how I understood DNS worked. Why isn't only the FQDN sent?
  - password4321 4y ago
    It's not the link fragment portion of the URL in the address bar that is sent to DNS, it is DNS requests from additional lazily-loaded content that is pulled up when the browser jumps down to it. Someone else went into detail: https://news.ycombinator.com/item?id=32742504 https://news.ycombinator.com/item?id=32742504
    - illiac786 4y ago
      This requires the attacker to have third party content on the page you are trying to get the user to scroll through, that is a huge assumption no? The password web page example is here highly unlikely: if the attacker injected his external content on the password web page, he has already a very strong position - getting users to click on links is not a logical next step, the attacker has far better avenues I would assume. At least that's my understanding.
spicybright 4y ago
Maybe because you can put identifying data in the URL, I guess? Not that you can't do that with a anchor, param, or an endpoint that can take arbitrary numbers/strings. I'd love to know the explanation too.
- kevincox 4y ago
  IIUC the main risk is that they can check if text appears on a page based on it. In an extreme case imagine that someone sends you a password in a messaging app which is available via the web. If an attacker can trick you to open webpages (maybe they intercept a HTTP site and open a few tabs) they can detect if the page scrolled based on side channels (data transfer) or direct information (did you load a lazy-loaded image from their server?). You can use this to learn page content. This is vaguely similar to https://en.wikipedia.org/wiki/CRIME https://en.wikipedia.org/wiki/CRIME. As a concrete example imagine that a webpage has something like this past the first page. <p>Your password is 56acc1bc03298ec0</p> <img loading=lazy src=https://cdn.example/secure.png> If I can trick you to load #:~:text=Your password is 5 and observe that you looked up the DNS for cdn.example and loaded secure.png (especially if that resource isn't cachable) I have learned the first character of the password. If I do this 64 times (on average) I have learned the whole password. This is a little hard to do, especially with pop-up blockers being built into most browsers so it is hard for a site to open many top-level windows (origin isolation of modern browsers will likely block this in iframes) it is not too extreme of a case. Of course there are simpler attacks. Maybe someone can link to https://www.youtube.com/feed/history#:~:text=Voice+Feminization+for+ABSOLUTE+BEGINNERS https://www.youtube.com/feed/history#:~:text=Voice+Feminizat... and they can tell if you have watched this video based on how many thumbnails have loaded. You load too many thumbnails and you get thrown in jail for being trans.
- chrismarlow9 4y ago
  Fair warning that I have not actually attempted these things, but: 1. I think you could potentially embed an iframe on a page and use the scroll positions combined with this feature to read information on a page. Start with "a", check scroll position, then "ab", then "abc". Similar to a blind sql attack where you gather data/hashes by continuously adding to the SELECT query using a substring function and a sleep (to detect if the substring was found). You brute force character by character. I believe this is commonly called an "Oracle attack" 2. XSS/Phishing/Spam. You add a png with a "Your account has been compromised" or a "fake form" (think Google docs) or whatever your spam message is to a part of a page. You send an email with this special url that will cause it to jump directly to that location on load. Just some theories. I'm pretty sure the first one would qualify for some sort of bounty, but my experience is most bug bounty programs wouldn't count the second one as valid (requires user interaction).
googlryas 4y ago
I don't really get it. It seems like one of those theoretical potential privacy violations, but seems more like an academic exercise than anything exploitable. I guess the idea is, someone can derive data about what you clicked based on some side channel (DNS queries? wifi activity? power draw?).
- TechBro8615 4y ago
  It does seem mostly theoretical, but it also seems like a natural feature for a privacy-focused browser to exclude. Web browsers have a long history of “mostly theoretical” becoming “effectively practical,” like when some new unrelated change invalidates an assumption underpinning the privacy guarantees of the original feature. In terms of this vector, I could imagine it leading to history enumeration when combined with CSS, similar to the classic “check the color of the link.” Or maybe some fingerprinting scripts could send signals to server-side traffic analysis heuristics by preloading a specific script based on which region of the screen is visible within the first second of loading the page. That’s all speculation of course, but clearly the feature increases privacy attack surface, by giving an external observer more paths for potentially reducing your possible anonymity sets.
- darepublic 4y ago
  I am guessing a timing attack
psygn89 4y ago
They should just make it an option to opt into.
- madamelic 4y ago
  Same with letting you disable their built-in extensions. Seems pretty wild to me that a privacy browser is alright with having their own extensions run in browser without any way to disable them or even know they exist. "But the extensions are open-source so that means you can audit them!" Uh yeah... but maybe I just don't want them to run and put "Tip" links on everything. It doesn't matter whether they are secure or not, the user should get to choose what they run in their browser. Brave is great (in my opinion), but the more you look the more you realize how strongly opinionated it is about how people should use the web which is pretty antithetical to what Brave says they are trying to do.
  - radicaldreamer 4y ago
    You can disable them, but the options are hidden all over the place in Settings, some seemingly buried intentionally to make them hard to find -- using UI dark patterns.
    - autoexec 4y ago
      Can you actually disable them, or just disable what they do by finding and toggling some obscure option in the settings? There's a difference between changing how an extension running in the browser works and removing it so that it isn't running at all.
      - radicaldreamer 4y ago
        Not clear whether it's disabled or the UI is simply hidden...
karaterobot 4y ago
They're kinda damned if they do, damned if they don't. If they left it in, (some) people would condemn them for not taking privacy seriously. Since they took it out, (some) people condemn them for taking this theoretical privacy risk too seriously.
Zamicol 4y ago
As it stands today, the spec has issues when considering other pre-existing options and future compatibility. For example, there is no way to get the URL if the protocol is `file://`. For a real world example: https://github.com/mozilla/standards-positions/issues/194#issuecomment-1220996568 https://github.com/mozilla/standards-positions/issues/194#is... See the stack overflow issue: https://stackoverflow.com/questions/67039633/get-the-text-fragment-part-of-current-url-from-window-location/73366996#73366996 https://stackoverflow.com/questions/67039633/get-the-text-fr... (See also the currently "conflicting" library for URL fragment queries: https://github.com/Cyphrme/URLFormJS https://github.com/Cyphrme/URLFormJS) I think it can be easily fixed, using solutions like a delimiter, but that discussion probably needs to be apart of a wider discussion concerning URL extensibility.
bburky 4y ago
https://xsleaks.dev/docs/attacks/experiments/scroll-to-text-fragment/ https://xsleaks.dev/docs/attacks/experiments/scroll-to-text-... may be a better description about the security impact, and has more context about this and similar cross site leaks possible with browsers.
- illiac786 4y ago
  It says "This scenario is mitigated in the Chrome implementation"
TheLoafOfBread 4y ago
That was reason why I switched to Brave. I hated that feature with passion on Chrome.
- Aachen 4y ago
  But why did you want it removed / dislike it
  - TheLoafOfBread 4y ago
    Because I don't want to suddenly move on some place on a page. I want to start on top of the page regardless what Google believes is best for me. And what pissed me off was that Google decided that this feature is mandatory and I can't disable it.
    - yunohn 4y ago
      You seem to have misunderstood the feature. Google doesn’t decide anything - the person sharing the text with you, or the search result referencing that text, is what uses the feature to guide you to the right location. Sometimes I wonder if people enjoy being blindly knee jerk reactionary.
      - TheLoafOfBread 4y ago
        No I did not misunderstand the feature, it was Google who pushed it on me. In Google, in its search engine. And I was not able to disable it. Sorry that I don't like to be told what I want to see.
        shepherdjerred 4y ago
        This is absurd. Do you also wish to disable anchor tag navigation?
        TheLoafOfBread 4y ago
NikolaNovak 4y ago
I'm extremely ignorant in ways of Web and HTML. But this sounds like the Anchor functionality of 25 years ago? Edit: this thing https://www.w3docs.com/snippets/html/how-to-create-an-anchor-link-to-jump-to-a-specific-part-of-a-page.html https://www.w3docs.com/snippets/html/how-to-create-an-anchor...
- code_duck 4y ago
  It is similar, except it doesn’t require anything special in the HTML. It scrolls to an occurrence of the specified sequence of text.
- autoexec 4y ago
  You're right, it does much the same thing, but this works on external sites so a webmaster doesn't need to create a bunch of anchors to specific information on a page. Instead you can link to any site and force the browser to highlight/jump to an arbitrary location on that external site. It's the kind of thing I'd disable because of the privacy leaks it makes possible (Ctrl-F on the new page works just as well and keeps the user in control), but I can see how some people might like the extra convenience (when it's not being used maliciously to collect sensitive information from otherwise secure websites).
deleted 4y ago
[deleted]

Phelinofist 4y ago

Came to ask the same question

FatalLogic 4y ago
>Came to ask the same question It IS an interesting question. But you should simply upvote it, if you have nothing at all to add.

Waterluvian 4y ago

This is probably the #1 feature that gives me the most personal conflict. I remember seeing it for the first time and thinking, “oh here we go. Google needed browsers to have a feature to make its search engine UX better…” But I also cannot deny just how useful it is.

maven29 4y ago
Does the internet have any discovery mechanisms except social media curation and search engines? If videos can be timestamped for links, why not webpages? Linking to automatic content-indexed excerpts shows respect for the time spent by recipient and saves markup effort for the author.
- Frost1x 4y ago
  I mean you can arbitrarily type domain names with common TLDs in and see what happens. I hear the white house may not be a good start to roll the dice on. Yahoo, Altavista, and others used to have a curated index of quality websites. Links are inherently a discovery feature. Services like StumbleUpon used to exist but could arguably be seen as "social." The problem with "social media curation" as a qualifier could be interpreted as "a human is involved." Pretty much all forms of discovery, internet or not, requires either search or a human involved. Some services of course have broadcast mechanisms for curating an index but that's about the only exception I can think of for discovery that breaks away from these two qualifiers. To some degree, DNS is a broadcast system for discovery.
  - derefr 4y ago
    > I mean you can arbitrarily type domain names with common TLDs in and see what happens. I've always been curious whether any search engine tries to index the "disconnected web" by just war-dialing domains/IPs like this. > To some degree, DNS is a broadcast system for discovery. Sadly, there's no real way to build a "DNS spider." You could if you could send DNS AXFR queries for arbitrary zones; but DNS servers mostly don't respond to these without authentication.
  - maven29 4y ago
    In the absence of a universal recommender system that acts on clustering effects, social networks and link aggregators like HN can really be the next best thing. It looks like at one point, mozilla attempted to solve this with their context graph project as well as their acquisition of pocket. However, it does look like it has all the hallmarks of a technological solution to a societal problem. Solving the adverserial aspects as well as ethical concerns would require nothing short of a rethinking of how we use the web. https://medium.com/firefox-context-graph/context-graph-its-time-to-bring-context-back-to-the-web-a7542fe45cf3 https://medium.com/firefox-context-graph/context-graph-its-t... https://wiki.mozilla.org/Context_Graph https://wiki.mozilla.org/Context_Graph
- teej 4y ago
  Is it time to bring back web rings?
  - Waterluvian 4y ago
    God I wish. I’m not sure they’re actually a good idea or not but I miss classic web.
darepublic 4y ago
Scroll to text? How about in page anchors.
- illiac786 4y ago
  Lots of effort. Less granular. And what about external resources?

dannyobrien 4y ago

There were some privacy concerns, regarding leaking of user information: https://github.com/WICG/scroll-to-text-fragment/issues/76 https://github.com/WICG/scroll-to-text-fragment/issues/76

illiac786 4y ago
I read this and I am surprised the link fragment is sent to the DNS server, that is not how I understood DNS worked. Why isn't only the FQDN sent?
- password4321 4y ago
  It's not the link fragment portion of the URL in the address bar that is sent to DNS, it is DNS requests from additional lazily-loaded content that is pulled up when the browser jumps down to it. Someone else went into detail: https://news.ycombinator.com/item?id=32742504 https://news.ycombinator.com/item?id=32742504
  - illiac786 4y ago
    This requires the attacker to have third party content on the page you are trying to get the user to scroll through, that is a huge assumption no? The password web page example is here highly unlikely: if the attacker injected his external content on the password web page, he has already a very strong position - getting users to click on links is not a logical next step, the attacker has far better avenues I would assume. At least that's my understanding.

spicybright 4y ago

Maybe because you can put identifying data in the URL, I guess? Not that you can't do that with a anchor, param, or an endpoint that can take arbitrary numbers/strings. I'd love to know the explanation too.

kevincox 4y ago
IIUC the main risk is that they can check if text appears on a page based on it. In an extreme case imagine that someone sends you a password in a messaging app which is available via the web. If an attacker can trick you to open webpages (maybe they intercept a HTTP site and open a few tabs) they can detect if the page scrolled based on side channels (data transfer) or direct information (did you load a lazy-loaded image from their server?). You can use this to learn page content. This is vaguely similar to https://en.wikipedia.org/wiki/CRIME https://en.wikipedia.org/wiki/CRIME. As a concrete example imagine that a webpage has something like this past the first page. <p>Your password is 56acc1bc03298ec0</p> <img loading=lazy src=https://cdn.example/secure.png> If I can trick you to load #:~:text=Your password is 5 and observe that you looked up the DNS for cdn.example and loaded secure.png (especially if that resource isn't cachable) I have learned the first character of the password. If I do this 64 times (on average) I have learned the whole password. This is a little hard to do, especially with pop-up blockers being built into most browsers so it is hard for a site to open many top-level windows (origin isolation of modern browsers will likely block this in iframes) it is not too extreme of a case. Of course there are simpler attacks. Maybe someone can link to https://www.youtube.com/feed/history#:~:text=Voice+Feminization+for+ABSOLUTE+BEGINNERS https://www.youtube.com/feed/history#:~:text=Voice+Feminizat... and they can tell if you have watched this video based on how many thumbnails have loaded. You load too many thumbnails and you get thrown in jail for being trans.
chrismarlow9 4y ago
Fair warning that I have not actually attempted these things, but: 1. I think you could potentially embed an iframe on a page and use the scroll positions combined with this feature to read information on a page. Start with "a", check scroll position, then "ab", then "abc". Similar to a blind sql attack where you gather data/hashes by continuously adding to the SELECT query using a substring function and a sleep (to detect if the substring was found). You brute force character by character. I believe this is commonly called an "Oracle attack" 2. XSS/Phishing/Spam. You add a png with a "Your account has been compromised" or a "fake form" (think Google docs) or whatever your spam message is to a part of a page. You send an email with this special url that will cause it to jump directly to that location on load. Just some theories. I'm pretty sure the first one would qualify for some sort of bounty, but my experience is most bug bounty programs wouldn't count the second one as valid (requires user interaction).

googlryas 4y ago

I don't really get it. It seems like one of those theoretical potential privacy violations, but seems more like an academic exercise than anything exploitable. I guess the idea is, someone can derive data about what you clicked based on some side channel (DNS queries? wifi activity? power draw?).

TechBro8615 4y ago
It does seem mostly theoretical, but it also seems like a natural feature for a privacy-focused browser to exclude. Web browsers have a long history of “mostly theoretical” becoming “effectively practical,” like when some new unrelated change invalidates an assumption underpinning the privacy guarantees of the original feature. In terms of this vector, I could imagine it leading to history enumeration when combined with CSS, similar to the classic “check the color of the link.” Or maybe some fingerprinting scripts could send signals to server-side traffic analysis heuristics by preloading a specific script based on which region of the screen is visible within the first second of loading the page. That’s all speculation of course, but clearly the feature increases privacy attack surface, by giving an external observer more paths for potentially reducing your possible anonymity sets.
darepublic 4y ago
I am guessing a timing attack

psygn89 4y ago

They should just make it an option to opt into.

madamelic 4y ago
Same with letting you disable their built-in extensions. Seems pretty wild to me that a privacy browser is alright with having their own extensions run in browser without any way to disable them or even know they exist. "But the extensions are open-source so that means you can audit them!" Uh yeah... but maybe I just don't want them to run and put "Tip" links on everything. It doesn't matter whether they are secure or not, the user should get to choose what they run in their browser. Brave is great (in my opinion), but the more you look the more you realize how strongly opinionated it is about how people should use the web which is pretty antithetical to what Brave says they are trying to do.
- radicaldreamer 4y ago
  You can disable them, but the options are hidden all over the place in Settings, some seemingly buried intentionally to make them hard to find -- using UI dark patterns.
  - autoexec 4y ago
    Can you actually disable them, or just disable what they do by finding and toggling some obscure option in the settings? There's a difference between changing how an extension running in the browser works and removing it so that it isn't running at all.
    - radicaldreamer 4y ago
      Not clear whether it's disabled or the UI is simply hidden...

karaterobot 4y ago

They're kinda damned if they do, damned if they don't. If they left it in, (some) people would condemn them for not taking privacy seriously. Since they took it out, (some) people condemn them for taking this theoretical privacy risk too seriously.

Zamicol 4y ago

As it stands today, the spec has issues when considering other pre-existing options and future compatibility. For example, there is no way to get the URL if the protocol is `file://`. For a real world example: https://github.com/mozilla/standards-positions/issues/194#issuecomment-1220996568 https://github.com/mozilla/standards-positions/issues/194#is... See the stack overflow issue: https://stackoverflow.com/questions/67039633/get-the-text-fragment-part-of-current-url-from-window-location/73366996#73366996 https://stackoverflow.com/questions/67039633/get-the-text-fr... (See also the currently "conflicting" library for URL fragment queries: https://github.com/Cyphrme/URLFormJS https://github.com/Cyphrme/URLFormJS) I think it can be easily fixed, using solutions like a delimiter, but that discussion probably needs to be apart of a wider discussion concerning URL extensibility.

bburky 4y ago

https://xsleaks.dev/docs/attacks/experiments/scroll-to-text-fragment/ https://xsleaks.dev/docs/attacks/experiments/scroll-to-text-... may be a better description about the security impact, and has more context about this and similar cross site leaks possible with browsers.

illiac786 4y ago
It says "This scenario is mitigated in the Chrome implementation"

TheLoafOfBread 4y ago

That was reason why I switched to Brave. I hated that feature with passion on Chrome.

Aachen 4y ago
But why did you want it removed / dislike it
- TheLoafOfBread 4y ago
  Because I don't want to suddenly move on some place on a page. I want to start on top of the page regardless what Google believes is best for me. And what pissed me off was that Google decided that this feature is mandatory and I can't disable it.
  - yunohn 4y ago
    You seem to have misunderstood the feature. Google doesn’t decide anything - the person sharing the text with you, or the search result referencing that text, is what uses the feature to guide you to the right location. Sometimes I wonder if people enjoy being blindly knee jerk reactionary.
    - TheLoafOfBread 4y ago
      No I did not misunderstand the feature, it was Google who pushed it on me. In Google, in its search engine. And I was not able to disable it. Sorry that I don't like to be told what I want to see.
      - shepherdjerred 4y ago
        This is absurd. Do you also wish to disable anchor tag navigation?
        TheLoafOfBread 4y ago

NikolaNovak 4y ago

I'm extremely ignorant in ways of Web and HTML. But this sounds like the Anchor functionality of 25 years ago? Edit: this thing https://www.w3docs.com/snippets/html/how-to-create-an-anchor-link-to-jump-to-a-specific-part-of-a-page.html https://www.w3docs.com/snippets/html/how-to-create-an-anchor...

code_duck 4y ago
It is similar, except it doesn’t require anything special in the HTML. It scrolls to an occurrence of the specified sequence of text.
autoexec 4y ago
You're right, it does much the same thing, but this works on external sites so a webmaster doesn't need to create a bunch of anchors to specific information on a page. Instead you can link to any site and force the browser to highlight/jump to an arbitrary location on that external site. It's the kind of thing I'd disable because of the privacy leaks it makes possible (Ctrl-F on the new page works just as well and keeps the user in control), but I can see how some people might like the extra convenience (when it's not being used maliciously to collect sensitive information from otherwise secure websites).

deleted 4y ago

[deleted]