> Instead, the hack analyzes subtle features of a potential target’s browser activity to determine whether they are logged into an account for an array of services, from YouTube and Dropbox to Twitter, Facebook, TikTok, and more. Plus the attacks work against every major browser, including the anonymity-focused Tor Browser.
It's not a hack, it's called Single-Sign-On :)
And it's been known for years.
Interestingly, BadWolf is effectively immune, new tabs have a separated ephemeral session.
The advertised case is about 5 *permanent* containers, maybe few ephemeral ones, IIRC that's with an extension.
Meanwhile where, the number on the tab easily goes beyond 52 after few days, together with also often cleaning tabs as there is virtually no latency in doing so.
I don't think anyone could do this on firefox without redoing the interface or keybindings, which is probably a pain in the ass.
And if they're anything close to me, their memory usage would be going to the roof because I never clean tabs in firefox except via just creating a new window and closing the old one.
@lanodan @p No, of course they don't isolate each tab, that would be trouble. You can assign which container the tab uses manually. This way if you log in to Facebook in the Facebook container, cookies and persistent data can't get outside. It's like using a different profile, but all within one browser instance. That is why it should be immune only if used properly. If all your tabs use the default container — it's not.
@p @lanodan Of course! I have media larger than 8Kb, third party fonts and scripts blocked by default in UBO and only enable them when I absolutely must.
Ideally, you should have IP routes set only to the servers you want to connect to and not have the default route. But maybe that's a bit overkill 😅
I tried blocking cloudflare, it didn't last: https://hacktivis.me/articles/blocking%20cloudflare%20IP-range%20be%20like
🔜fosdem
@lanodan@queer.hacktivis.me
I could sue my ISP if it would do any shit and they also have to follow the local laws.
Suing a VPN provider? You might as well sue a dead person.
And a lot of them can follow *any* law they want, even worse than Facebook law HQ being Santa-Clara but taxes HQ being Ireland. (Forcing Facebook into EU would be funny given GDPR :D)
> VPN providers are probably even worse.
In the case of Epik's VPN, NordVPN, "probably" can be changed to "provably".
> Suing a VPN provider? You might as well sue a dead person.
Such a mess.
> Forcing Facebook into EU would be funny given GDPR
That's the great thing about GDPR: it's absurd enough be costly, but it's also easy enough to ignore if you are small. There was that one provision that allowed that guy to get Facebook to send him a 900-page printout of all the data they had on him, that was hilarious.
> There was that one provision that allowed that guy to get Facebook to send him a 900-page printout of all the data they had on him, that was hilarious.
Yeah, Max Schrems, which is founder or something of https://noyb.eu/en
He done it multiple times btw.
I heard of supermarkets tracking people with wifi.
But well, I don't have a smartphone and I don't go in supermarkets, they've always been mischievous assholes, last time I went there was returning a gas ~rubber pipe that was very nearly expired and I just bought.
Glad I checked the date before opening the package and that in EU there is mandatory free 15-days return.
> bluetooth shit?
Yeah, not just wifi but Bluetooth pings. Any radio. In the US, it's currently illegal to do this with cell network stuff, but there are a lot of antennas on a person nowadays.
Did I tell you when I worked across the street from the Beverly Wilshire? There's some paparazzi operation that runs out of there, they were, at the time, making Pringles yagis for their Bluetooth antennas and then using those to capture MAC addresses, which they could confirm at public events. So the politician or celebrity (or their friends, or anyone in their security detail), if they had a Bluetooth device, these guys could tell what room of the hotel they were in and who they were there with.
@p @lanodan @m0xee shit like this is why farraday bags have gone from ‘you’re a paranoid maniac’ fashion to ‘hm, seems reasonable’ accessory. It took 30 years from radio beacons landing aircraft in bad weather to measuring how long you linger around the cereal section before you bought those fruit loops, just to wring a few more cents out of you.
There will always be people that think it's a good idea to reroute all their communications to whatever fad of the day, and then not even learn when it turns out it was a false company done by a three-letter agency.
Or these days people who think it's great to have a microphone, door camera, … connected to a mothership.
What should be done instead is making sure people *ignore* them, as they have no idea what they're talking about.
And I totally would sue people in my town, specially neighbors if they would install an Amazon Ring.
@lanodan @ins0mniak @p No one's using VPN to avoid browser fingerprinting I think. It still prevents your ISP from spying on you, helps circumvent georestrictions, countrywide IP blocks, etc.
@ins0mniak @p @lanodan That is true. It is necessary, but not sufficient.
And I don't know for the freedomination land that is USA but in France and probably most of Europe, it is *illegal* for an ISP to spy on you.
So for an European perspective, a scam ISP like those VPN is effectively harmful.
@lanodan @ins0mniak @p Yeah, but don't forget about countries like China, Russia, etc.
You can't sue shit there and some guy in Zurich spying on you is still more trustworthy than ISP having direct connection to the KGB 😆
For places like China and Russia you're quite doomed.
Specially as they tend to make VPNs illegal or restricted to the kind where it's just to access a corporate subnet.
Can VPNs help in those countries?
Maybe, but at the same time, they entirely could sneak keyloggers into your devices.
@lanodan @ins0mniak @p They can if you use them in a barebones way e.g. openvpn configuration, not the "apps".
And of course you have to take ll the other measures.
OpenVPN on your own machine or not, it's horribly trivial to inspect traffic, they do run routers you know.
There is corporations selling those things, either for corporate networks or for entire countries.
Use something like Tor or setup your own VPN on a infra you can reasonably trust.
@lanodan @ins0mniak @p Well, of course! Like I said, it's to make inspection harder on the ISP side only. VPN provider CAN spy on you, but likely has less motivation to do so. And it's not like all traffic becomes unencrypted if you are using VPN, there is still HTTPS, DNS over HTTPS — which make traffic inspection even harder.
VPN on you own VPS is a good idea in general, but if you want to switch exit nodes you've got to have several VPSs which is costly.
Multiple exit-nodes are a thing required on tor so it's less worth it to use packet-inspection.
Also while cloud is expensive, if that's what you're using it doesn't costs more to move elsewhere or pick another IP.
@lanodan @ins0mniak @p Circumventing georestrictions is the most obvious use case. TOR is really inconsistent at this. There was a configuration file directive to control the country of the exit node, but I think it's no longer there.
There are other use cases, like your electric company could have blocked your address for some weird reason 😏 You are right though, you can easily just get new one for a small fee.
> Why would you switch exit nodes when it's your own VPS?
I imagine to convince Youtube or Netflix to show you haram in HD.
bigtv.jpe
p.jpe
> No one's using VPN to avoid browser fingerprinting I think.
Nobody can, but people selling a VPN can promise it.
Ring is the worst. Theres an app now for Ring called "neighbors" where people can post their footage and such and other people can comment on it. It's fucking creepy as hell.
I hear he didn't take it very well.
