Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't know what it is called but if you try to open a window from a timeOut it wont work. The user has to click on something then the click even grants the permission.

You could make something similar where fingerprint worthy information cant be posted or used to build an url. For example, you read the screen size then add it to an array. The array is "poisoned" and cant be posted anymore. If you use the screen size for anything those things and everything affected may stay readable but are poisoned too. New fingerprinting methods can be added as they are found. Complex calculations and downloads might make time temporarily into a sensitive value too.



In the old days, something similar to what you're calling "poisoned" was called "tainted" [0].

In those scenarios, tainted variables were ones which were read from untrusted sources, so could cause unexpected behaviour if made part of SQL strings, shell commands, or used to assemble html pages for users. Taint checking was a way of preventing potentially dangerous variables being sent to vulnerable places.

In your scenario, poisoned variables function similarly, but with "untrusted" and "vulnerable" being replaced with "secret" and "public" respectively. Variables read from privacy-compromising sources (e.g. screen size) become poisoned, and poisoned values can't be written to public locations like urls.

There's still some potential to leak information without using the poisoned variables directly, based on conditional behaviour - some variation on

    if posioned_screenwidth < poisoned_screenheight then load(mobile_css) else load(desktop_css)
is sufficient to leak some info about poisoned variables, without specifically building URLs with the information included.

[0] https://en.wikipedia.org/wiki/Taint_checking


I mean everything inside the if statement becomes tainted.

Like opening a window requires a click (in the chain of events), load() wouldn't work in a tainted conditional.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: