Hacker News Reader

Comment by Santosh83 | Hacker News Reader

Not sure exactly where the proof of concept is. Is it this page?

https://m417z.com/De-anonymization-via-Clickjacking-in-2019/...

I tried it in latest Firefox with uBlock & HTTPS Everywhere and it leads me to a 'captcha' page similar to Cloudflare's but there's no actual captcha box. Nothing seems to happen...

Is it uBlock protecting me or is it that I've completely disabled all third party cookies?

View on HN

The author briefly touches on preventing the technique by disabling third party cookies, so yes, it's probability that.

> Having tried several solutions, I came to the conclusion that blocking third party cookies is the best mitigation for clickjacking.

I use Firefox and the new Tracking Protection feature can sometimes prevent Captcha boxes from loading. Click the Shield icon by the URL, then toggle the Tracking Protection to off. The page should reload, does it display the captcha?

You're right, turning off Firefox's tracking protection reveals the 'captcha' box (disguised FB comment box)... but it still fails since I've FB's platform feature turned off. Another window pops up informing me that I need to turn it on to record my comment, which of course I declined...

I think the captcha box is the Facebook comments box restyled. I'm guessing uBlock or Firefox containers are protecting you.

It's most likely uBlock - [1]

[1] - https://i.imgur.com/wpLgp9R.jpg

In my case a comment box doesn't appear at all. I also don't have Firefox containers enabled. uBlock is blocking google-analytics.com and facebook.net domains only on that page, while Firefox's own tracker blocking is not accepting 3rd-party cookies from disqus, fb and google.

https://imgur.com/a/gehE6nF

Although these days I'm aware that most large tracking companies are probably going beyond just 3rd party cookies and building shadow profiles based on device fingerprinting which as it stands is effectively impossible to avoid without crippling modern browsers.

I have uBlock on chrome and it worked for me. Got me too, I thought it was a captcha.

Reply on news.ycombinator.com