Javascript was a mistake, #9001: https://www.wired.com/story/web-deanonymization-side-channel-attack-njit/
🔜fosdem
@p
> Instead, the hack analyzes subtle features of a potential target’s browser activity to determine whether they are logged into an account for an array of services, from YouTube and Dropbox to Twitter, Facebook, TikTok, and more. Plus the attacks work against every major browser, including the anonymity-focused Tor Browser.
It's not a hack, it's called Single-Sign-On :)
And it's been known for years.
Interestingly, BadWolf is effectively immune, new tabs have a separated ephemeral session.
> Instead, the hack analyzes subtle features of a potential target’s browser activity to determine whether they are logged into an account for an array of services, from YouTube and Dropbox to Twitter, Facebook, TikTok, and more. Plus the attacks work against every major browser, including the anonymity-focused Tor Browser.
It's not a hack, it's called Single-Sign-On :)
And it's been known for years.
Interestingly, BadWolf is effectively immune, new tabs have a separated ephemeral session.
@m0xee @p Except not really.
The advertised case is about 5 *permanent* containers, maybe few ephemeral ones, IIRC that's with an extension.
Meanwhile where, the number on the tab easily goes beyond 52 after few days, together with also often cleaning tabs as there is virtually no latency in doing so.
I don't think anyone could do this on firefox without redoing the interface or keybindings, which is probably a pain in the ass.
And if they're anything close to me, their memory usage would be going to the roof because I never clean tabs in firefox except via just creating a new window and closing the old one.
The advertised case is about 5 *permanent* containers, maybe few ephemeral ones, IIRC that's with an extension.
Meanwhile where, the number on the tab easily goes beyond 52 after few days, together with also often cleaning tabs as there is virtually no latency in doing so.
I don't think anyone could do this on firefox without redoing the interface or keybindings, which is probably a pain in the ass.
And if they're anything close to me, their memory usage would be going to the roof because I never clean tabs in firefox except via just creating a new window and closing the old one.
@lanodan @p No, of course they don't isolate each tab, that would be trouble. You can assign which container the tab uses manually. This way if you log in to Facebook in the Facebook container, cookies and persistent data can't get outside. It's like using a different profile, but all within one browser instance. That is why it should be immune only if used properly. If all your tabs use the default container — it's not.
@p @lanodan Of course! I have media larger than 8Kb, third party fonts and scripts blocked by default in UBO and only enable them when I absolutely must.
Ideally, you should have IP routes set only to the servers you want to connect to and not have the default route. But maybe that's a bit overkill 😅
@m0xee @lanodan
> Ideally, you should have IP routes set only to the servers you want to connect to and not have the default route. But maybe that's a bit overkill 😅
The trick is knowing in advance where anyone on your network might want to connect. It's much more effective to just kill malicious networks:
curl -k https://rdap.arin.net/registry/entity/ORACLE-4 |
jq -r '.networks |
map("prips -c " + .startAddress + " " + .endAddress) | join("\n")'
> Ideally, you should have IP routes set only to the servers you want to connect to and not have the default route. But maybe that's a bit overkill 😅
The trick is knowing in advance where anyone on your network might want to connect. It's much more effective to just kill malicious networks:
curl -k https://rdap.arin.net/registry/entity/ORACLE-4 |
jq -r '.networks |
map("prips -c " + .startAddress + " " + .endAddress) | join("\n")'
