2 ms·
> And this is pretty visible to the user too How would even a tech savvy person know of this going on in the background, without being suspicious a priori? Emb
by Aachen 3y ago
> And this is pretty visible to the user too
How would even a tech savvy person know of this going on in the background, without being suspicious a priori? Embedded frames can be made invisible, overlaid with something else, or put off-screen. You'd have to be very familiar with this attacker's site to know that it's unusually slow today and loading longer than usual, or showing it's loading while the page appears to be already fully loaded. With the gigabytes of javascript that are common nowadays, that's not unusual.
The riskiest part is probably the sharing, as email notifications of such actions are commonly sent out.
- Izkata 3y agoEmbeds in general can lead to this suspicion, not the attack itself. I've seen people question "why am I logged in to these Facebook comments? Does Facebook know I visited this site?", which then leads to them discovering recommendations that others have commented on here. They don't even need to know anything technical beyond "install this addon to stop Facebook from spying on you" and poof, this attack doesn't work anymore.
- ls612 3y agoI’d also assume that ublockorigin will stop most of this in its tracks.
- cookieperson 3y agoI'd love a reference on that. I didn't think it did anything like that. Firefox containers and good browser hygiene can, but if you slip up...
- SoftTalker 3y agoThis is why I clear cookies and history when the browser closes, disable saved passwords/logins, and I close my browser frequently, generally between sites or at least sessions of use.
- doodlesdev 3y agoIf you block third-party frames and third-party scripts then indeed it should. See uBlock Origin medium and hard blocking modes [0][1]. Bonus points if you adopt cookie higiene and clean cookies, form data, etc. on browser exit (maybe save for some exceptions) [1]. Even better if you also use firefox containers, browser profiles, or maybe even different browsers for different browsing needs and online profiles. [0]: https://github.com/gorhill/uBlock/wiki/Blocking-mode#medium-mode-details- https://github.com/gorhill/uBlock/wiki/Blocking-mode#medium-... [1]: https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Benefits-of-blocking-3rd-party-iframe-tags https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Be... [2]: https://support.mozilla.org/en-US/questions/1308719#answer-1358510 https://support.mozilla.org/en-US/questions/1308719#answer-1...
- Aachen 3y agoHow do they even see there's facebook comments being loaded? You'd have to have the dev tools open or be looking at an add-on like privacy badger
- Izkata 3y agoThey'd see them because they're there on the page, below the article. Let me repeat: > Embeds in general can lead to this suspicion, not the attack itself.
- geysersam 3y agoCan the attacker still get any information about the user if the embedded frame is hidden? From the description above quoted by GP, it sounds like the user has to "interact" with the content in the embedded page for the attacker to be able to conclude they have access to the content.
- Aachen 3y agoOh, to me it sounded like the loading of a large image or so would give it away. If it's transparent to the user that something was shared with them, I'm not sure it can still be called a deanonymisation attack but basically straight up says to the user "I think you're Joe"