then I guess it’s time we go back to terminal browsing. text based sites here we come.
They really gave internet browsers too much access. Why the fuck does my browser need this level of clearance
Yeah - stuff like this really shows that computing went in the wrong direction. You shouldn’t install every crap software on your computer. You shouldn’t install every crappy app. Browsers have too much access and are therefore a security risk by themselves. So we are left without any sensible way to run small programs like the one you are using to flash some firmware or to configure your mouse or whatever. Install it on your computer and it will spy on you. Flash the firmware from your browser and you are totally fucked, because your internet-facing thingy can flash a firmware
They better hope there isn’t another pandemic. Cuz I am officially labeling that quantity of free time as “1 Degoogle”. and if I ever get my hands on another fuckin degoogle I am going to degoogle all over my fucking house
You can Degoogle one step at a time. Make it a weekly habit to spend 10 minutes Degoogling every week and you won’t need to wait for another worldwide shutdown
True. And I did hear if you degoogle at least 20 times a month it reduces your risk of prostate cancer.
Nocturnal google emissions
deleted by creator
Holy shit, what do you mean all over your house? How did you ever let it get that bad?
Becau of the push for web apps to get around platform (and platform store) limitations.
e.g. Apple banned apps for vapes (not just talking about nic vapes but e.g. there’s a number of cannabis flower vapourisers that use Bluetooth for fine tuned settings, those were forced to move over to web apps as the native apps simply got pulled), but also software like ESPHome is completely web based and needs access to raw USB devices to write the new firmware onto them, the list goes on.
Main issue seems to be that a lot of these APIs don’t require explicit user approval. USB, Bluetooth does, but apparently accessing detailed system statistics doesn’t? Make that make sense…
Well it’s all potential advertisement revenue
That’s not a legitimate reason. The correct response is to make a standalone application, not a web app, and distribute it elsewhere than the main store. It’s one more reason sideloading needs to be allowed. If it isn’t we end up with vulnerabilities because of workarounds.
Good luck distributing it “elsewhere” when it comes to iPhones.
Yes, even with the DMA forcing Apple to open up to alternative app stores in Europe, Apple still has a definitive say as to what apps can be published, and what those apps have access to.
Also, a lot of the time, a full blown app is unnecessary, or not practical.
The solution isn’t to prevent functionality from existing - this includes browsers and web apps having access to certain aspects to the hardware - but giving the user absolute control over what they allow an app to do.
Good luck distributing it “elsewhere” when it comes to iPhones.
Without creating the stupid browser based loopholes, it wouldn’t be a choice. Developers would be pushing Apple and Google to allow “sideloading” (as if alternative sources are any less legitimate than from their stores).
Also, a lot of the time, a full blown app is unnecessary, or not practical.
It’s just as practical. It’s unnecessary for a browser to be built to function as a replacement to an application for literally any purpose. If you’re making a website, then fine, you don’t need an app. If you’re making something that interfaces with the functionality of the device, that isn’t the job of a browser.
The solution isn’t to prevent functionality from existing - this includes browsers and web apps having access to certain aspects to the hardware - but giving the user absolute control over what they allow an app to do.
How do you do this? If the browser has permission it has permission. Each application should be separate so the permissions are separate.
Even without the “browser loophole”, developers are pushing Google and Apple about further permissions being granted and sideloading and whatnot. Apple and Google careth not… Your argument is pretty moot at this point.
And no, you can already do per website permissions. Or what the fuck do you think the notification settings are for, or the PER INSTANCE BASED REQUESTS for e.g. Bluetooth or USB device access? Or when a website asks you to access your camera or microphone? These are all instances of the browser having access and the website having to request permission separately from it…
Each application should be separate so permissions are separate
Ever heard of this nifty thing called “sandboxing” that browsers have been doing for, oh, about a decade now?
Even without the “browser loophole”, developers are pushing Google and Apple about further permissions being granted and sideloading and whatnot. Apple and Google careth not… Your argument is pretty moot at this point.
No, not even without it. Without it there would be a significantly larger push. It wouldn’t just be a small movement. It’d be necessary. It’s like being on a computer and getting everything from the Microsoft store (if you’re on Windows). Sometimes they don’t have what you need, so basically every moderate user has had to download something elsewhere. It’d be the same on phones. Apple and Google would not be able to get away with preventing sideloading because every user and developer would care, not just the few of us there are now.
And this is why you shouldn’t use any browser based on Chromium, because where Google goes (implementing ever more invasive APIs) they all follow.
Modern browsers are basically an OS of their own at this point. And, in fairness, for many users their actual OS is effectively just a means by which they access a browser. This is not even mentioning something like Chrome OS.
I’m not saying it’s a good idea or that it should be this way, but it is where we are.
I’m not even sure I’d allow them to know my resolution…
If you don’t allow ReCaptcha access to your address book, the website will fail to load.
Then that website can get fucked.
“Google says fingerprinting is not a security vulnerability”. That is a very google thing to say.
In this case, I agree that it’s a low priority patch. Here’s what you must do as an attacker. Decide for yourself whether it sounds practical for general deployment.
Requirements: Fill OPFS storage with an arbitrarily large amount of data which at least exceeds RAM, but may require up to 60% of SSD, then lock up a thread with random reads while a worker thread hosts a model that you feed any detected latency clusters.
Even if users don’t notice their fans maxing / battery burning / memory+storage disappearing and kill the tab themselves, this definitely will be the first tab offloaded by most browsers and OSes shortly after it is sent to the background.
That means you have a brief window where you might get the chance to guess which sites a user is visiting. Your guess is likely far less than 89% accurate (PoCs illustrate in optimal conditions where models are often deliberately overfit to specific machine(s) and locale) outside a hyper-targeted attack, you will be lucky for coin toss levels of certainty for any guess.
Is this an attractive attack vector?
You’re not wrong. But on the other hand, do we really need a browser API for measuring a user’s SSD usage?
While I am surprised by the lack of throttling or resource quotas permitting this (assuming they do) I must reiterate that repurposing OPFS this way is, to put it mildly, unrealistic even under optimal conditions. This “API for measuring SSD usage” is quite bad at it.
The meager data this exploit might return will, at best, require excessive cleanup to salvage any value at all. More likely, the data would still be considered worthless due to the expected margin of error and the likelihood that any targets successfully profiled are already well-known via existing datasets.
That said, typically niche-use-case and high-performance APIs that aren’t hidden behind experimental flags require user permission by default (a practice solidified by mitigations of other exploits like mining, fingerprinting, etc) so to find one open and apparently unregulated by default does seem unusual, if true.
Edit: Either way, I suspect any user vulnerable to this exploit is likely already exposed to much worse via similarly unsophisticated but more reliable attacks, and thus has already been heavily profiled.
I wonder if, at any point, anyone stopped to ask themselves, “did I really go to school just so I can ply my knowledge and expertise to find even more ways to fucking track people who expressly don’t want to be tracked so we can use the data for ad revenue (if not for other, even worse things)”?
software dev here.
I worked with a guy who was implementing application monitoring for clientside applications. think of it like google analytics for single page apps. he proposed we could require users install a browser plugin to make it easier to track and monitor the users on our app with the added benefit we could track them on other websites like our competition.
one person in a room of about 11 people spoke up about the implications of privacy and the backlash we might have from our user base when they find out that we basically just installed a keylogger in their browser.
the only thing that stopped this plan from going forward was the risk of losing users and potential revenue loss.
my point in all this is to answer your question. no, most people have stopped thinking about their actions and are just creating “solutions” to problems that don’t exist.
Hey I’ve been in that room! I don’t get it, I can’t live with that for of thing. And this is why I only have like 2 or 3 extensions (all ad blockers).
Execs love this shit. I only had one exec who pushed not to do that or open Pandora’s box.
He made a ton of cash, cashed out, and retired at 30 something. Awesome dude, I miss working under him.
Out of curiosity, why 2-3 different ad blockers?
I run multiple as well. It’s like double-bagging it, except actually effective.
I have similar.
- privacy badger
- ublock
- adblock plus
and have pihole on my network.
You probably would have meant ublock origin and must have shortened it to uBlock, but just a reminder for others who don’t know, Ublock and Ublock Origin are different things, with Ublock.org and others being a clone and unreliable/malware (I am not sure on the malware part but just something I have heard but not verified). Use Ublock Origin on Firefox, and if you are using chrome, switch to Firefox but if you can’t for some reason use Ublock lite (manifest V3 version).
They often do different things.
Privacy badger, ublock, https everywhere are just required tools.
Hasn’t HTTPS Everywhere been dead for years? Enabling forced HTTPS is a native feature in every browser now afaik.
It’s wild how quickly morality falls to the wayside (and is subsequently paved over). Especially crazy to abandon one’s moral standing early on the path of solving problems that don’t exist to appease people who don’t care for a chance at the advancement of a career that you can’t take with you in a field that could be wiped out by a solar flare, all to end up making the world a worse place for subsequent generations (I’m not a bleeding-heart idealist, lol).
I often think about a few people I know who have psych degrees. All were told, in different years, that if they wanted to make money as a psychologist, they needed to get in with tech companies. Some even got job offers.
I studied data mining (now machine learning) and statistics.
I’ve spent my career explicitly NOT plying my knowledge this way. I don’t know how people do it.
I’d say my deep knowledge on how to track people has made me pretty averse to a lot of online things.
You know you can build marketing attribution systems and advertising metrics without violating user privacy.
But advertisers really like the idea of invading privacy and they pay out the nose for it.
Good on you. Few are willing to take the overgrown path. And, funny how people who work with the subject matter often avoid it- the cybersecurity guy who doesn’t own a computer, the guy who services food processing equipment who refuses to buy premade food, the guy who works/ed for the DoD who doesn’t own a phone, etc.
Would you mind sharing some of the online things you’re averse to, besides all that is implied by being on the Fediverse? I’m still new to this stuff.
Just things that can be correlated. Time, device, network, accounts, and apps all correlate. Precise location, device sensors, etc also correlate.
You have to decide what you want security or privacy against, then you have to be mindful always.
Every internet connection is a fingerprint.
E.g. The second you use that device on an VPN all your apps phoning home, checking notifications, logging events, etc. collapse your profile and deanonymize your anonymous activity.
So I actually use a dedicated device for anything I want a VPN on.
Opsec almost requires that you need a public device for your regular use, and a secondary device with limited scope, third party OS for higher privacy for anything you actually don’t want to share.
It’s safer to tunnel specific whitelisted connections through a VPN than whole device VPN for that reason (the less traffic goes to VPN the better). iOS VPN doesn’t work for that reason.
If you want VPN security, the best way is to run a container with only VPN networking, then a second container with the service you want protected and route all networking through the VPN container.
Also, say no to Chrome based apps looking for devices on your network. That uniquely fingerprints you across tons of surfaces.
They say it’s for chrome cast or something but it’s too much info to share.
That’s really great, thank you. I’ve got a working knowledge of applying opsec and related principles, but my understanding quickly drops off when we get into the why. That’s super helpful.
I work IT adjacent in physical security systems (cameras, access control, intrusion systems etc.). Everyone looks confused when they ask what I have at home or what they should install and I tell them fuck all of this surveillance state/must know every time someone thinks about my house bullshit. I push back on a lot of corporate garbage as well and I’m lucky enough to work off a company that listens and balances security with privacy when I steer us that way.
I think this is pretty common in tech fields.
I’ve got the same thing. I had someone ask me what I do for backups and they thought I was joking when I told them I have a good printer. They couldn’t get their head around the idea that I don’t even have a home network to attach a NAS to, and thought I was just being condescending. I had a similar conversation when asked how to secure an Alexa.
It is really hard to sort through job listings using ethics as your criteria.
“It is difficult to get a man to understand something, when his salary depends on his not understanding it.”
-Upton Sinclair
Which aspect of the situation to you intend for that quote to apply to? The companies/recruiters writing the listings, or the job-seekers reading them?
Just for the record, the way I intended it was to say that I find it extremely difficult to find jobs because I have high ethical standards. Hell, I basically left my previous career as a traffic engineer in part because I didn’t want to design sprawl, and jobs doing bike infrastructure are relatively few and far in between!
Bet
I looked it up - Firefox does not allow OFPS storage in private mode since November 2022 , so that is an option at least.
But only in private mode?
I wonder if librewolf has this option on by default
I don’t think so - from how i understand it, everything where you upload a file to a server to edit it there wouldn’t work at all.
The flow looks like this:
You select a file for upload - the browser creates a file in OPFS storage representing the original file - any change you make serverside are replicated to the copy in OPFS storage - when you save the file, you don’t actually have to download it, but the file gets moved from OPFS to wherever you save the file. This prevents long downloads and a lot of warnings (if you would download the file in the classic way, the OS would flag it with the Mark of the Web even tho it is your own file, triggering smartscreen on Windows) and the file in OPFS storage is encrypted because of HTTPS.it’s explained in detail here: https://web.dev/articles/origin-private-file-system
The attack creates a large OPFS file on the victim’s SSD, with both Chrome and Safari allowing a website to claim up to 60% of total disk space through OPFS, which on a 256GB drive is over 150GB.
Am I reading this right? 60% of all your disk space can be confiscated by some random web site? I gotta figure out how to get my browser cache onto some tiny partition.
I’ve done it with some apps/games by placing the folder in question on a separate drive/partition and using junction points (I use Junction Link Magic, but you can do it manually from command prompt) to basically create a ghost of the folder in the original location that routes everything to the new location.
You could create a small hidden partition just for the browser cache folder to reside on using this method.
Replicating this on Linux would be as simple as ln -s to make a symbolic link
Symbolic links for the win!
The actual paper (PDF) this is based on gives much better information than the article. From that we get some really key information:
To allow FROST to measure SSD contention, the victim must perform activities that result in storage accesses to the same disk as the file used for contention measurement
This can’t ready your SSD. It can only listen in on the conversation between your CPU and SSD when something else reads it or writes to it. The whole FROST approach has a number of clever tricks to generate reads from open applications though. Further, it requires the attacker’s code to be running in an active browser session.
Also, If you have two SSDs, and your browser is on one, this FROST approach can’t see anything written to or read from on the other SSD.
Lastly, there’s a mention in the paper about hardware based SSD encryption being vulnerable, there’s no mention of Software Whole Disk Encryption. Given how the researchers are using the SSD timing exploit, I would guess that a software (not hardware) whole disk encryption might be immune to this attack because the patterns of timings would be different with encrypted data being written to the SSD (instead of the data being encrypted by the SSD when written.
The paper also mentions that it also takes downloading a 1GB OFPS file and JS in use.
This isn’t so much “researchers can track you” so much as “it’s theocratically possible with stock laptops and browsers, within limitations.”
And even in the ideal case, not very effective.
Interesting approach, but that’s about it.
Sounds like a bunch of timing attacks could be rendered useless if access to an accurate timer required special permission. And without the permission, it either limited the resolution or added random jitter to any timer APIs.
Yeah, honestly we should have a way to instrument JS without actually making the JS runtime able to read the measurement data
I remember when browsers just showed text.
We should just throw away the web and do something new. Maybe Fidonet over Reticulum so we can use radio.
Booting up Lynx as we speak.
Good i dont allow every Javascript on websites (usually)
So the file has to exceed available RAM to benchmark the SSD performance? How viable is that at all? You’d be downloading gigabytes.
You don’t download the file. The JavaScript generates the file right on disk.
Ah that makes more sense. Seems like something easy to detect at least.
It’s been a while but doesn’t Windows let you know when you exceed RAM usage and hit paging file?
You didn’t hit the page file. This is OPFS, an in-browser filesystem that is sandboxed to each origin (essentially to each website), not directly accessible by the user, and exempt from the security checks that would guard access to the regular filesystem.
Yeah, that sounds to me like it needs a major revision.
but in order for the file to use all available RAM, other processes that still need memory will eventually trigger the out of memory warning… no?
unless I’m completely misunderstanding and OPFS has a set limit of RAM usage before it automatically starts writing to drives.
You seem fixated on the idea that OPFS is some kind of ramdisk. It isn’t. When a website stores a file in OPFS, the browser writes some kind of opaque data structure describing all stored files to disk. That data structure can take whichever shape the browser desires excewpt for just dumping those files in a directory in order to isolate OPFS from the regular filesystem.
You can query the browser for the maximum quota available to you and then just tell it that you want a file that big. Boom, now you own that chunk of the user’s SSD.
As has been pointed out elsewhere, that’s still of dubious value for fingerprinting but I don’t particularly enjoy the thought that random websites can just occupy gigabytes of space on my computer without even asking.
Yeah, I guess I was fundamentally misunderstanding OPFS. I was thinking it was just resident in memory as a process of the browser. What exactly does this line mean, though?
The file must exceed the system’s available RAM so that every random 4 KB read hits the SSD rather than the OS’s page cache.
The OS can cache parts of files in RAM to speed up accesses. That cache is called the page cache. If your file is big enough you can fairly reliably access random parts of it and expect the OS to not have cached them no matter how big the page cache is. So each read hits the SSD, allowing you to observe its performance.
You also have to provide access to your computer so the attacker can produce labeled training data for the neural network that performs the pattern matching for the actual fingerprinting.
Because that’s what they did in the paper: they got the data and performed the attack on the same machine. There’s no evidence presented in the paper that this identification could be generalised to arbitrary machines and configurations without prior access.
So yes, this is a complete nothingburger.
So that’s not what the paper says
Fun fact: running inside a flatpak or snap in no way mitigates this 😪
deleted by creator
