Hacker News Reader

Comment by kylegordon | Hacker News Reader

And this is why, even with the best intentions of site operators, my browser will continue to use the best ad-block tools I can get, and my networks will be protected by tools like PiHole.

View on HN

In the 2005 era when I was a young video gamer I used to play World of Warcraft. There was a site, Thottbot, that players would use to find out information about things in game. I picked up a keylogger malware from their adservers. One of the advertisers had been hacked and was serving Malware every few thousand ads. Since that day I've used an adblocker and I'll always continue to do so.

I wonder if that’s how I got hacked....

Exactly. Market solutions for market problems. I'd love to see the Raspberry PI foundation develop and sell a home router with PIHole for regular consumer use.

Considering the alternatives, that sounds really appealing for me. I'd also buy it for my less tech-literate parents.

You can't profit your way out of a problem you profited yourself into. There will never be enough people setting up PiHoles to offset the value of spying, and it's publishing platforms like StackOverflow that suffer.

Wouldn't it be cool if it was solved on the provider level? They already have to set up DNS servers, might as well make it a Pi-hole instance.

Many ISPs are part of conglomerates that also contain web content publishers, so they have a vested interest for ads to continue working.

Also, ISP-level adblock will lead to tons of support requests, esp. when news websites start blocking that ISP and tell customers to call the ISP's support to "fix" the internet.

That's not enough, sadly.

Besides disabling JavaScript you can put hosts file blocklists.

Simple corporation block list (e.g. Facebook, Google) https://github.com/jmdugan/blocklists/tree/master/corporatio...

"Someone Who Cares" list http://someonewhocares.org/hosts/

Ultimate Hosts Blacklist: 1 million blocked domains (once in a while you might need to unblock something) and also a bonus known hacking IP blocklist. https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist

This seems melodramatic for something as trivial as an audio request.

Arbitrary code execution isnt really that trivial.

Arbitrary javascript execution is generally meaningless. Very rarely you'll get a zero-day or something, or maybe a site will use too much battery when focused.

But if that page is Stack Overflow, with millions of views, you are collectively wasting tons of power. Granted, you don't pay those bills.

Really? Malicious JavaScript can steal anything you can see and do anything you do. It can steal your passwords, bank account information, or transfer money out of your bank account. It just depends on what kind of page is serving up the arbitrary JavaScript.

It’s incredibly disrespectful. Nobody wants some random ad listening to their microphone. That they’re trying it anyway indicates that they’re hoping to get some people with browsers that don’t block it, or trick some people into saying yes.

It’s not harmful, as long as you’re not one of the people who gets tricked. But it does indicate that they want to do you harm, and try to. That they failed doesn’t make it all better.

It's probably just a mistake and not actually trying to collect anything.

You think it’s hitting the JavaScript microphone API by mistake? How?

It's Google's fingerprinting for tracking you across the web. It won't actually listen to or play anything, it just opens it up to see if it's there.

We have no way of knowing that when a permission alert comes up. The only reason we’d ever allow it is if we were tricked or exploited.

Wait, it was listening in on the microphone too? Doesn’t that break wiretapping laws?

The parent is wrong. It's for fingerprinting your audio pipeline. Trying to record audio would result in a permissions prompt.

My bad! It didn’t even occur to me that this might just be audio output, not input.

Did you click the link..? It's fingerprinting, not just trying to legitimately play audio.

It's not just audio requests btw. Google regularly serves ads that automatically redirect users to scam sites. A client I work with gets hit with that about every six months. The ads are targeting only mobile users which makes it even harder to debug. There's nothing a publisher can do to prevent this but disabling Google Adsense completely. There is no support from Google. After a few days, a week maybe, Google disables the malicious ad (or they see that the credit card didn't work) and it stops.

Reply on news.ycombinator.com