TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

A new attack can unmask anonymous users on any major browser (2022)

160 pointsby tysonealmost 2 years ago

20 comments

kodahalmost 2 years ago
&gt; “If you’re an average internet user, you may not think too much about your privacy when you visit a random website,” says Reza Curtmola, one of the study authors and a computer science professor at NJIT. &quot;But there are certain categories of internet users who may be more significantly impacted by this, like people who organize and participate in political protest, journalists, and people who network with fellow members of their minority group.&quot;<p>I get so dizzied by statements like this. It&#x27;s almost as if researchers want to undermine their own work. Privacy can be <i>essential</i> for certain groups, but it should be a priority for everyone. Frankly I&#x27;m not even sure the statement about minority groups is true anymore. We&#x27;ve seen unmasking used by corporations, interest groups, governments, etc against a wide variety of people with dangerous outcomes.<p>I&#x27;d prefer we refactor messaging to make people realize that this is important to everyone and that we lay an impotus to do something about it, especially as governments all over the world are moving to eliminate personal and online privacy.
评论 #36171966 未加载
评论 #36172848 未加载
评论 #36172035 未加载
评论 #36172969 未加载
评论 #36172479 未加载
评论 #36175078 未加载
评论 #36173110 未加载
评论 #36176133 未加载
评论 #36172271 未加载
评论 #36171834 未加载
Izkataalmost 2 years ago
Relevant paragraphs:<p>&gt; How this de-anonymization attack works is difficult to explain but relatively easy to grasp once you have the gist. Someone carrying out the attack needs a few things to get started: a website they control, a list of accounts tied to people they want to identify as having visited that site, and content posted to the platforms of the accounts on their target list that either allows the targeted accounts to view that content or blocks them from viewing it—the attack works both ways.<p>&gt; Next, the attacker embeds the aforementioned content on the malicious website. Then they wait to see who clicks. If anyone on the targeted list visits the site, the attackers will know who they are by analyzing which users can (or cannot) view the embedded content.<p>&gt; The attack takes advantage of a number of factors most people likely take for granted: Many major services—from YouTube to Dropbox—allow users to host media and embed it on a third-party website. Regular users typically have an account with these ubiquitous services and, crucially, they often stay logged into these platforms on their phones or computers.<p>Isn&#x27;t this one of the older forms of de-anonymization? And this is pretty visible to the user too, embeds hint to even non-technical people they can be tracked across websites.
评论 #36171221 未加载
评论 #36172420 未加载
评论 #36172255 未加载
saxonwwalmost 2 years ago
Firefox container mode stops this. I can imagine a product that makes every tab an ephemeral container by default, and you had to explicitly opt-in to a container profile to share cookies, etc. cross-tab.
评论 #36170865 未加载
评论 #36171190 未加载
评论 #36171656 未加载
andrewmcwattersalmost 2 years ago
At this point, I’m convinced that the web is now sophisticated enough that it’s inherently unsafe, and anyone who wants to track you has a myriad of nuanced ways to probe various technical indicators, timings, and form heuristics about who you might be at the very least.<p>Considering there are commercial solutions KNOWN to do this today, and do so with staggering accuracy even through VPNs and relays such as Apple’s, it seems like a game that can’t be cat-and-moused anymore.<p>It’s done, there’s too much exposed information when browsing the web.<p>Ironically, even Stallman’s technique of emailing webpages to himself to read is risky depending on how the page is sent to him and whether scripts are completely removed or disabled.<p>It just feels like playing with fire. You always have the chance of being burned. Or rather, the only winning move is to not play.
评论 #36175033 未加载
评论 #36175046 未加载
Aachenalmost 2 years ago
TL;DR (the crucial info is, predictably, at the very end): share a picture with someone via dropbox or whatever and embed that dropbox page on a website you control, then &quot;analyze accessible information about the target’s browser and the behavior of their processor as the request is happening to make an inference about whether the content request was allowed or denied.&quot;<p>So you can confirm via unspecified vectors whether a visitor is among a specific set of persons if they are logged in with the right user account. (Not exactly a way to unmask any anonymous user on any major platform, the way the headline sounds.)<p>Edit: oh, it&#x27;s not at the very end. Beyond the horizontal line and newsletter begging there&#x27;s a few more paragraphs I didn&#x27;t see before. Credit where it&#x27;s due, they didn&#x27;t bury it at the end but, instead, only 988 words stand between you and the above information!
Blahahalmost 2 years ago
<a href="https:&#x2F;&#x2F;archive.is&#x2F;neUxt" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;neUxt</a>
klabb3almost 2 years ago
Can someone explain why the cache timing pattern gets such a strong signal for something so seemingly distant? Is this about memory locality or just the effects of a different “CPU workload” in general?<p>Also, what JS APIs are used to carry out such high resolution time measurements?
green_boonsalmost 2 years ago
There was a similar attack from a couple years ago that checked if favicons for sites were cached and then polled them
评论 #36171537 未加载
account-5almost 2 years ago
I don&#x27;t know. Seems like this only affects people with no opsec. Surely if you&#x27;re doing stuff on the internet you think is likely to attract attention from law enforcement you&#x27;re at the least using a different browser profile than the one you use to post your cat memes and food pictures?? Surely you&#x27;d be using a different browser or even device.
评论 #36174817 未加载
kccqzyalmost 2 years ago
WebKit has a feature where all script-accessible cookies are deleted after 7 days: <a href="https:&#x2F;&#x2F;webkit.org&#x2F;tracking-prevention&#x2F;" rel="nofollow">https:&#x2F;&#x2F;webkit.org&#x2F;tracking-prevention&#x2F;</a><p>While this feature is annoying in that I have to repeatedly log in to some websites that I visit less frequently, it could make this exact attack less effective.
Semaphoralmost 2 years ago
Seems like anyone using a third party content blocker like uMatrix will be immune.
评论 #36170922 未加载
j-bosalmost 2 years ago
Is this new? Seems like a long present low hanging fruit.
评论 #36170959 未加载
izaalmost 2 years ago
Wouldn&#x27;t blocking third-party cookies prevent this? It should really be the default setting at this point.
评论 #36173621 未加载
AHOHAalmost 2 years ago
Am I the only one who use a separate profile in the browser and always open new links in private tabs?
1vuio0pswjnm7almost 2 years ago
&quot;A new attack can unmask anonymous users on any major browser&quot;<p>Yet another reason to prefer minor browsers for &quot;anonymous&quot; or recreational browsing<p>I&#x27;m using one to submit this comment
sylwarealmost 2 years ago
Expecting otherwise is not reasonable.<p>Digital privacy does not exist, even for tech savvy people. Anybody saying otherwise is trying to sell you something.
throwawayadvsecalmost 2 years ago
wouldn&#x27;t that be stopped by CORS blocking which is pretty much the norm for large websites?
评论 #36171365 未加载
评论 #36171265 未加载
Izkataalmost 2 years ago
Oh haha this might be an attack itself:<p>&gt; The researchers developed a browser extension that can thwart such attacks, and it is available for Chrome and Firefox. But they note that it may impact performance and isn’t available for all browsers.<p>And if you click through to the Firefox one...<p>&gt; This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.
评论 #36172569 未加载
评论 #36171332 未加载
评论 #36171278 未加载
sunjesteralmost 2 years ago
Isn&#x27;t this from 2019?
Sunsparkalmost 2 years ago
Combined with AI&#x2F;ML this would be useful for PaaS to provide a curated offering of porn, except for those from Louisiana.