15 ms·
A new attack can unmask anonymous users on any major browser (2022)
- saxonww 3y agoFirefox container mode stops this. I can imagine a product that makes every tab an ephemeral container by default, and you had to explicitly opt-in to a container profile to share cookies, etc. cross-tab.
- pwgentleman 3y agoYeah there’s an extension called Temporary containers that does exactly that (^:
- baliex 3y agoBeen using it for years and watching others’ machines for how tracked they are across the web is terrifying. Even things as basic as being on clothingshop.com and then seeing ads for said shop on someotherdomain.com, which I understand is totally normal, has become jarring for me. I recommend everyone installs it. Yes, you have to click more cookie banners, and I still say no, but mind less when I cave and say yes because what they’ll learn is so limited. My temporary containers have a persistent auto increment so after a few years it’s (semi-) interesting to see that I’m on my ~20,000th temporary container
- ropeladder 3y agoWith Temporary Tontainers you can just install one of the cookie-ignoring plugins, since cookies don't do much if your containers are ephemeral.
- probably_wrong 3y agoIt is my understanding that the name "cookie banner" is misleading, to the point of acting against your own interests. If you click Agree you agree to be tracked regardless of the method. So yes, cookies won't do much, but now you've agreed to any kind of tracking, even those that defeat private mode and/or script blockers (assuming there's one).
- baliex 3y agoI haven't really looked into the plugins but surely if they can find the "accept tracking" button, they could also find the "no thanks" button instead
- ropeladder 3y agoTemporary Containers is fantastic. Its functionality should really be a core feature of any browser that claims to be concerned with privacy.
- Aachen 3y agoIf you're linked to something on twitter or discord or so, odds are that you'll open it in that container because that's the default behavior. While you're right, and I use containers as well, I'm not sure that's a solid way to prevent this attack unless the person can be convinced to diligently right click anything they wish to open, copy the link, and manually paste it in a fresh new tab.
- fsflover 3y agoThis is solved in Qubes OS by using separate VMs for different security domains. For Discord, a single click can be configured to open a browser in a dedicated disposable VM.
- Aachen 3y agoMy work requires me to open links in different VMs. How exactly do I tell a browser to override link clicks to be handled by an external program? This would be very useful indeed
- fsflover 3y agoThis is how I do it on Debian. First, reate a custom "browser" like this: touch .local/share/applications/open-in-dispvm.desktop, and put inside a command like this: qvm-open-in-vm '@dispvm:fedora-37-dvm' %u in accordance with this guide: https://www.qubes-os.org/doc/how-to-use-disposables/#opening-a-link-in-a-disposable-based-on-a-non-default-disposable-template-from-a-qube https://www.qubes-os.org/doc/how-to-use-disposables/#opening... To make this browser default, you do this: xdg-settings set default-web-browser open-in-dispvm.desktop See also how to create .desktop files: https://askubuntu.com/questions/45885/how-do-i-set-a-custom-browser-as-default-in-preferred-applications https://askubuntu.com/questions/45885/how-do-i-set-a-custom-....
- Aachen 3y agoBrowsers don't call the OS to open a URL, it would have to be an add-on or something
- ravenstine 3y agoEven better, type "about:profiles" into your URL bar, create a new profile that runs in an entirely separate Firefox process, and live your second life there.
- xjay 3y agoDisable automatic updates in this case (Windows). When an update is applied between the first and second profile process, any new tab won't do anything in any of the instances. Firefox likely still doesn't detect this state. Edit: That is, if you use Firefox with two or more profiles, and may start one profile later (after a new update was published).
- magicalhippo 3y agoI run Firefox stable and Firefox beta on separate profiles (in addition to containers). The stuff I'm less worried about using beta.
- ravenstine 3y agoSame thing happens on macOS. And yeah, I turn off automatic updates and just update when it bugs me. It's an underrated feature, IMO. Profiles can be made very purpose-specific, and I like that there's not the possibility of leakage due to a site exploiting an add-on sharing data across containers, etc. I still like the mukti-containers feature, but I see it as less of an anonymity thing and more as a convenient way to be able to sign into multiple website accounts at once.
- Semaphor 3y agoSeems like anyone using a third party content blocker like uMatrix will be immune.
- myshpa 3y agouMatrix is a lifesaver ... I enable only css, images and media for 1st party sites, everything else is disabled by default. Have not seen an ad in years.
- account-5 3y agoIsn't uMatrix abandoned? No longer developed? I used to use it but now use uBlock Origin in advanced mode. I'd switch back immediately if it was actively developed again.
- Semaphor 3y agoIt’s not, sadly. But it still works, and the interface is still far superior to uBlock on Desktop. So I, and many others, use it as is, together with uBlock. There was actually a short time it broke, which was when the repo was unarchived, fixed, and archived again, so while there’s no new development, there’s at least a chance it might not break.
- account-5 3y agoI'm definitely loath to use something that's not been updated in that long considering the speed of change in web development. How do you know it's not missing some stuff? I agree the interface is much superior to the advanced ublock interface. Much more granular control. I do wish it was getting developed still or unlocked interface updated to uMatrix style.
- Semaphor 3y ago> I'm definitely loath to use something that's not been updated in that long considering the speed of change in web development. I mean, all you are missing out on, is even finer granularity. Details don’t matter, you got the basic blocks: cookies, css, images, other media, script, XHR, frames, and "other" aka everything else. Those don’t change, the "other" category will simply very slowly grow over time.
- j-bos 3y agoIs this new? Seems like a long present low hanging fruit.
- omgmajk 3y agoArticle from 2022.
- Blahah 3y agohttps://archive.is/neUxt https://archive.is/neUxt
- throwawayadvsec 3y agowouldn't that be stopped by CORS blocking which is pretty much the norm for large websites?
- lincolnq 3y agoIframes bypass CORS, so the trick is to use an Iframe and figure out (using some side channel since you can’t peek into the frame) whether the iframe loaded the content successfully or whether it loaded an error page.
- throwawayadvsec 3y agoI mean websites that blocks cors usually blocks iframes too?
- veeberz 3y agoThere's a type of side-channel attack you can do to get around CORS but still leak limited information. Suppose you want to detect whether one of N pre-chosen users of FakeMail (a service I made up) have visited a malicious page you control. Let's also say that in FakeMail: 1. you can see a hi-res version of your profile pic only if you're authenticated 2. only you can see your own hi-res profile pic 3. the path to this private pic is unique to each user, e.g. `/users/{user_id}/private_pic` The trick then is to embed an `<img>` tag with a `src` to this private, hi-res profile pic for each of the N pre-chosen targets in your malicious page. Then, in `onerror` and `onload` event handlers of `img`, you can implement logic to handle "user X is not here" and "user X is here" respectively. Of course, this attack could be thwarted by SameSite cookies or browsers with protection against cross-site use of cookies. And it's rather hard to find FakeMail's exact three conditions needed to pull off such an attack. AND just add one more, your targets have to be authenticated to FakeMail. It might seem like an attack that's not viable, but this has happened before, and iirc it was called XS-Leaks for a while when I first heard of it.
- Izkata 3y agoRelevant paragraphs: > How this de-anonymization attack works is difficult to explain but relatively easy to grasp once you have the gist. Someone carrying out the attack needs a few things to get started: a website they control, a list of accounts tied to people they want to identify as having visited that site, and content posted to the platforms of the accounts on their target list that either allows the targeted accounts to view that content or blocks them from viewing it—the attack works both ways. > Next, the attacker embeds the aforementioned content on the malicious website. Then they wait to see who clicks. If anyone on the targeted list visits the site, the attackers will know who they are by analyzing which users can (or cannot) view the embedded content. > The attack takes advantage of a number of factors most people likely take for granted: Many major services—from YouTube to Dropbox—allow users to host media and embed it on a third-party website. Regular users typically have an account with these ubiquitous services and, crucially, they often stay logged into these platforms on their phones or computers. Isn't this one of the older forms of de-anonymization? And this is pretty visible to the user too, embeds hint to even non-technical people they can be tracked across websites.
- Aachen 3y ago> And this is pretty visible to the user too How would even a tech savvy person know of this going on in the background, without being suspicious a priori? Embedded frames can be made invisible, overlaid with something else, or put off-screen. You'd have to be very familiar with this attacker's site to know that it's unusually slow today and loading longer than usual, or showing it's loading while the page appears to be already fully loaded. With the gigabytes of javascript that are common nowadays, that's not unusual. The riskiest part is probably the sharing, as email notifications of such actions are commonly sent out.
- Izkata 3y agoEmbeds in general can lead to this suspicion, not the attack itself. I've seen people question "why am I logged in to these Facebook comments? Does Facebook know I visited this site?", which then leads to them discovering recommendations that others have commented on here. They don't even need to know anything technical beyond "install this addon to stop Facebook from spying on you" and poof, this attack doesn't work anymore.
- Aachen 3y agoTL;DR (the crucial info is, predictably, at the very end): share a picture with someone via dropbox or whatever and embed that dropbox page on a website you control, then "analyze accessible information about the target’s browser and the behavior of their processor as the request is happening to make an inference about whether the content request was allowed or denied." So you can confirm via unspecified vectors whether a visitor is among a specific set of persons if they are logged in with the right user account. (Not exactly a way to unmask any anonymous user on any major platform, the way the headline sounds.) Edit: oh, it's not at the very end. Beyond the horizontal line and newsletter begging there's a few more paragraphs I didn't see before. Credit where it's due, they didn't bury it at the end but, instead, only 988 words stand between you and the above information!
- Izkata 3y agoOh haha this might be an attack itself: > The researchers developed a browser extension that can thwart such attacks, and it is available for Chrome and Firefox. But they note that it may impact performance and isn’t available for all browsers. And if you click through to the Firefox one... > This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.
- JBiserkov 3y agoThe target demographic selects itself ;-)
- notjulianjaynes 3y agoI am pretty sure that how it works is almost every Firefox add on that isn't in their recommended add ons has this warning.
- Izkata 3y agoAs far as I know they can get it reviewed without reaching "recommended" status. My point is these are security researchers that didn't bother getting it reviewed. Surely they'd go through the effort to get it reviewed if they really wanted to convince people it was safe, right? Seems to imply to me there's something that would get it removed if Mozilla did review it. Edit: I guess maybe reviewed and recommended are the same (I swear they were different at one point), but there is an email you can send to suggest extensions to reach this status.
- msla 3y agoAnd given the track record of security researchers, we must conclude that the browser extension is suspicious: https://news.ycombinator.com/item?id=29599553 https://news.ycombinator.com/item?id=29599553 https://news.ycombinator.com/item?id=29611139 https://news.ycombinator.com/item?id=29611139
- green_boons 3y agoThere was a similar attack from a couple years ago that checked if favicons for sites were cached and then polled them
- lelandfe 3y agoIt’s a classic problem. It’s also why :visited was limited, why caches were partitioned, etc.
- kodah 3y ago> “If you’re an average internet user, you may not think too much about your privacy when you visit a random website,” says Reza Curtmola, one of the study authors and a computer science professor at NJIT. "But there are certain categories of internet users who may be more significantly impacted by this, like people who organize and participate in political protest, journalists, and people who network with fellow members of their minority group." I get so dizzied by statements like this. It's almost as if researchers want to undermine their own work. Privacy can be essential for certain groups, but it should be a priority for everyone. Frankly I'm not even sure the statement about minority groups is true anymore. We've seen unmasking used by corporations, interest groups, governments, etc against a wide variety of people with dangerous outcomes. I'd prefer we refactor messaging to make people realize that this is important to everyone and that we lay an impotus to do something about it, especially as governments all over the world are moving to eliminate personal and online privacy.
- deleted 3y ago[deleted]
- zztop44 3y agoI don’t understand. This seems pretty innocuous to me. >“If you’re an average internet user, you may not think too much about your privacy when you visit a random website” Surely you don’t dispute that? Like, maybe the average user should think about their privacy when they visit a random website, but it’s not dizzying to say that they probably don’t. And the rest of statement is just saying that some users are more at risk of what is a targeted exploit. Probably both in terms of the chance it is used against them, and the consequences of that use. Your point that unmasking gets used against a wide range of people is well taken, but it hardly invalidates the argument being made here, does it? You believe it’s more important to emphasize that everyone should care about privacy. The author seems to believe that it’s more important to emphasize the impact on populations more likely to be targeted. Both are fair perspectives.
- OJFord 3y agoIt's impossible to know the author's intent of course, but I think the problem/confusion is the choice of the word 'impacted' - GP is saying essentially 'everyone is impacted, even if only a few are aware/care'. Your reading I assume is impacted in the sense of thinking and worrying about it; affected (strictly speaking) by it.
- Sunspark 3y agoCombined with AI/ML this would be useful for PaaS to provide a curated offering of porn, except for those from Louisiana.
- kccqzy 3y agoWebKit has a feature where all script-accessible cookies are deleted after 7 days: https://webkit.org/tracking-prevention/ https://webkit.org/tracking-prevention/ While this feature is annoying in that I have to repeatedly log in to some websites that I visit less frequently, it could make this exact attack less effective.
- AHOHA 3y agoAm I the only one who use a separate profile in the browser and always open new links in private tabs?
- klabb3 3y agoCan someone explain why the cache timing pattern gets such a strong signal for something so seemingly distant? Is this about memory locality or just the effects of a different “CPU workload” in general? Also, what JS APIs are used to carry out such high resolution time measurements?
- iza 3y agoWouldn't blocking third-party cookies prevent this? It should really be the default setting at this point.
- flangola7 3y agoCookies don't save you from having your CPU memory speed profiled
- doctor_radium 3y agoIndeed. Although I'm a little surprised that CPU access isn't one of the features denied through simple anti-fingerprinting measures. Edit: After a brief search there (thankfully) doesn't appear to be such a straightforward way to measure CPU load. Which of course makes it that much harder to block.
- sunjester 3y agoIsn't this from 2019?
- account-5 3y agoI don't know. Seems like this only affects people with no opsec. Surely if you're doing stuff on the internet you think is likely to attract attention from law enforcement you're at the least using a different browser profile than the one you use to post your cat memes and food pictures?? Surely you'd be using a different browser or even device.
- dredmorbius 3y agoI've become all but convinced over the past decade or so (largely though not entirely post-Snowden) that opsec matters far less than immunity and/or impunity. The difference between those last two is that immunity is actual freedom from consequence, whilst impunity may be the impression of invulnerability (leaning heavily on the sense of the word as "rashness or inconsideration" ... I'm aware that this may not be entirely standard or customary usage). The upshot is that the immune know that they cannot be touched, the impudent believe that they cannot be touched. The former is a more robust protection, the latter may prove highly brittle. (Activities of participants in the events of 6 Jan 2021 come to mind.) The distinction between either of these and opsec is that opsec must be good most or all of the time. Immmunity/impunity buy you a lot of sloppiness. A related concept is that of intelligence agencies doing far less of observing information and far more of planting it. This was common practice amongst both the USA and USSR during the Cold War, as has been detailed in numerous accounts. John Crewsden and Carl Bernstein both (separately) wrote of the CIA's activities in this regard, quite often working directly with news organisations (or personnel associated with same), during the 1970s: Crewsden: "The CIA’s 3-Decade Effort to Mold the World’s Views" (1977) <https://www.nytimes.com/1977/12/25/archives/the-cias-3decade-effort-to-mold-the-worlds-views-agency-network.html https://www.nytimes.com/1977/12/25/archives/the-cias-3decade...> (In six parts, listed and linked here: (<https://diaspora.glasswings.com/posts/cdec9a80ce3b0139a0df002590d8e506 https://diaspora.glasswings.com/posts/cdec9a80ce3b0139a0df00...>)). The story became the subject of a US Congressional investigation, documented here: <https://archive.org/details/CIAMedia1978Hearings/page/n3/mode/2up https://archive.org/details/CIAMedia1978Hearings/page/n3/mod...> Bernstein's account, "The CIA and the Media" (1977), <https://web.archive.org/web/20071026060752/http://www.carlbernstein.com/magazine_cia_and_media.php https://web.archive.org/web/20071026060752/http://www.carlbe...> Or that the NSA's capabilities in decoding ecrypted communications had much less to do with superhuman cryptographic hax0ring skillz, and more with flooding the market with affordable, back-doored encryption tools, via Crypto AG, a Swiss front company: <https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-cia-bnd-germany-intelligence-report https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-ci...>
- andrewmcwatters 3y agoAt this point, I’m convinced that the web is now sophisticated enough that it’s inherently unsafe, and anyone who wants to track you has a myriad of nuanced ways to probe various technical indicators, timings, and form heuristics about who you might be at the very least. Considering there are commercial solutions KNOWN to do this today, and do so with staggering accuracy even through VPNs and relays such as Apple’s, it seems like a game that can’t be cat-and-moused anymore. It’s done, there’s too much exposed information when browsing the web. Ironically, even Stallman’s technique of emailing webpages to himself to read is risky depending on how the page is sent to him and whether scripts are completely removed or disabled. It just feels like playing with fire. You always have the chance of being burned. Or rather, the only winning move is to not play.
- SapporoChris 3y agoThe last line of your comment appears hypocritical.
- waihtis 3y agoTails OS is still a thing
- sylware 3y agoExpecting otherwise is not reasonable. Digital privacy does not exist, even for tech savvy people. Anybody saying otherwise is trying to sell you something.
- Etrnl_President 3y ago[dead]
- 1vuio0pswjnm7 3y ago"A new attack can unmask anonymous users on any major browser" Yet another reason to prefer minor browsers for "anonymous" or recreational browsing I'm using one to submit this comment
- lenauvokane 3y ago[flagged]