3 ms·
Relevant paragraphs: > How this de-anonymization attack works is difficult to explain but relatively easy to grasp once you have the gist. Someone carrying out
by Izkata 3y ago
Relevant paragraphs:
> How this de-anonymization attack works is difficult to explain but relatively easy to grasp once you have the gist. Someone carrying out the attack needs a few things to get started: a website they control, a list of accounts tied to people they want to identify as having visited that site, and content posted to the platforms of the accounts on their target list that either allows the targeted accounts to view that content or blocks them from viewing it—the attack works both ways.
> Next, the attacker embeds the aforementioned content on the malicious website. Then they wait to see who clicks. If anyone on the targeted list visits the site, the attackers will know who they are by analyzing which users can (or cannot) view the embedded content.
> The attack takes advantage of a number of factors most people likely take for granted: Many major services—from YouTube to Dropbox—allow users to host media and embed it on a third-party website. Regular users typically have an account with these ubiquitous services and, crucially, they often stay logged into these platforms on their phones or computers.
Isn't this one of the older forms of de-anonymization? And this is pretty visible to the user too, embeds hint to even non-technical people they can be tracked across websites.
- Aachen 3y ago> And this is pretty visible to the user too How would even a tech savvy person know of this going on in the background, without being suspicious a priori? Embedded frames can be made invisible, overlaid with something else, or put off-screen. You'd have to be very familiar with this attacker's site to know that it's unusually slow today and loading longer than usual, or showing it's loading while the page appears to be already fully loaded. With the gigabytes of javascript that are common nowadays, that's not unusual. The riskiest part is probably the sharing, as email notifications of such actions are commonly sent out.
- Izkata 3y agoEmbeds in general can lead to this suspicion, not the attack itself. I've seen people question "why am I logged in to these Facebook comments? Does Facebook know I visited this site?", which then leads to them discovering recommendations that others have commented on here. They don't even need to know anything technical beyond "install this addon to stop Facebook from spying on you" and poof, this attack doesn't work anymore.
- ls612 3y agoI’d also assume that ublockorigin will stop most of this in its tracks.
- cookieperson 3y agoI'd love a reference on that. I didn't think it did anything like that. Firefox containers and good browser hygiene can, but if you slip up...
- SoftTalker 3y agoThis is why I clear cookies and history when the browser closes, disable saved passwords/logins, and I close my browser frequently, generally between sites or at least sessions of use.
- doodlesdev 3y agoIf you block third-party frames and third-party scripts then indeed it should. See uBlock Origin medium and hard blocking modes [0][1]. Bonus points if you adopt cookie higiene and clean cookies, form data, etc. on browser exit (maybe save for some exceptions) [1]. Even better if you also use firefox containers, browser profiles, or maybe even different browsers for different browsing needs and online profiles. [0]: https://github.com/gorhill/uBlock/wiki/Blocking-mode#medium-mode-details- https://github.com/gorhill/uBlock/wiki/Blocking-mode#medium-... [1]: https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Benefits-of-blocking-3rd-party-iframe-tags https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Be... [2]: https://support.mozilla.org/en-US/questions/1308719#answer-1358510 https://support.mozilla.org/en-US/questions/1308719#answer-1...
- Aachen 3y agoHow do they even see there's facebook comments being loaded? You'd have to have the dev tools open or be looking at an add-on like privacy badger
- Izkata 3y ago
- geysersam 3y agoCan the attacker still get any information about the user if the embedded frame is hidden? From the description above quoted by GP, it sounds like the user has to "interact" with the content in the embedded page for the attacker to be able to conclude they have access to the content.
- Aachen 3y agoOh, to me it sounded like the loading of a large image or so would give it away. If it's transparent to the user that something was shared with them, I'm not sure it can still be called a deanonymisation attack but basically straight up says to the user "I think you're Joe"
- cookieperson 3y agoLots of companies do this. I've seen it on HN even. We probably should consider it an attack, but there's no way regulators will go for it. There are counter measures against it though, but I doubt anything is foolproof
- SV_BubbleTime 3y agoWouldn’t multi-account containers, or using private windows segmented to only one website solve it? Don’t open a private window and log in to multiple things… problem solved?
- jamiek88 3y agoDon’t ever make a mistake is what you are saying there. That’s borderline impossible for humans.
- hedora 3y agoOr, use a web browser that doesn’t support any cross site state, at all. I’d love to have such a browser, and to disable the browser that came with my phone, but does not have this property. (Things like firefox focus or the duck duck go browser for iOS try to do this; I’m not sure if they succeed, but they should protect against the attack described in the article, at least.)
- ad404b8a372f2b9 3y agoIt reminds me of the gmail timing attack. I can't find the link anymore and I don't remember it precisely but it was something like loading the auth page for a specific address in the background and depending on the load time you'd know if the person was already logged in with that address. It assumed there was a specific list of people you were targeting whose address you already knew and you could show different content to a specific target.