Hacker News Reader

Comment by _gyhb | Hacker News Reader

Recently made this extension and interested in getting some feedback on it.

Vytal can Spoof your timezone, locale, geolocation and user agent. This data can be used to track you or reveal your location.

Most extensions that provide anti-fingerprinting features rely on content scripts to inject script tags into webpages. There are many limitations to script tag injections which you can read about here: https://palant.info/2020/12/10/how-anti-fingerprinting-exten...

Vytal utilizes the chrome.debugger API to spoof this data. This allows the data to be spoofed in frames, web workers and during the initial loading of a website. It also makes the spoofing completely undetectable.

You can test and compare Vytal and other extensions on https://vytal.io

Unfortunately it doesn't work on Firefox since Firefox doesn't support the debugger API. Works on Brave tho.

View on HN

> It also makes the spoofing completely undetectable.

It's my understanding that the usage of the debugger is detectable by scripts running on the page. I've actually come across content websites that will refuse to activate their features (play video) if the debugger is active.

Similarly on Android some video streaming apps will refuse to load and play their content catalog if USB debugging is enabled.

How can you detect it? Which websites refuse to activate their features if the debugger is active?

I've had the opposite experience: parts of websites broken by tracking blocker started working after popping debugger up.

The one I've seen before does the following:

A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open.

Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.

I'm unsure if that would work for this extension. Do you have a link to an implementation?

I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API. If it ignores it, you're fine.

This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf

The debugger timing method is described on page 10.

I don't think that method would work for detecting extension debugging.

There are a bunch of sophisticated ways to obfuscate it, but it basically boils down to:

    <script>
        setInterval(function() {
            try {
                let before = new Date().getTime();

                // This will pause the program execution if debugging is enabled.
                // If debugging isn't enabled this statement is a no-op.
                debugger;

                let after = new Date().getTime();

                // Detect if the program was paused or not.
                if (after - before > 0.01) {
                    // > 10ms difference?  The program was (most likely) paused by the debugger.
                    document.body.innerHTML = "<h1>Debugging started</h1>";
                }
            } catch(e) {}
        }, 1000);
    </script>

There are some other ways to detect it by implementing various prototype methods and continually logging the object to the console. The methods are only invoked if the dev console is opened.

Doesn't seem like this work for detecting the extension.

I'm able to get it to trigger on about ~10-20% of page reloads with your extension activated. Never when it isn't. Maybe it's just a matter of tuning the interval and detection threshold?

I don’t have a link offhand but I’ve seen this code while debugging some pirate sports streams. The next upcoming one to check would be an NBA game from “nba bite” (Google it, it’s the offshoot of the banned sports streaming subreddits.)

I think you’re probably right that it wouldn’t detect presence of your extension, since that code runs in its own context and I assume doesn’t actually call the debugger. If your extension injects a script into the page, then that could be detected with this technique or similar.

I'm commenting here both to remind myself to check back and try this out when I'm not on mobile, and to thank you for building this- at first glance it looks good.

You can save a comment. Just click the timestamp (x hours ago), then click favorite.

Just installed it, it's showing a message on top of each tab in Chrome

"Vytal" started debugging this browser

Is there a way to get rid of it?

There is a note at the link that explains the command line flag you need to pass in

Thanks, I will have to create a shortcut for it.

This should work

chrome.exe --silent-debugger-extension-api

Is it safe to do? I mean I want to stop this message for Vytal only, because I know that it uses debugger API. But I would want to know if tomorrow my adblocker starts to use debugger API.

Any existing extension would have to explicitly declare the appropriate permission for using the debugger API. Chrome automatically disables extensions that add new permissions until you review them.

Using Brave browser. Every page, and every reload brings up a "'Vytal' started debugging this browser" message.

Can you explain how Firefox (or Chrome) knows my location within 20m even if I use a VPN? Brave puts me where I think the VPN exit point is.

For example:

https://wikishootme.toolforge.org/

Many (most?) VPN mechanisms don't entirely remove access to the other routes from apps that manually request them, so even if an app isn't able to use something akin to "location services" on your device it might still easily be able to get access to your other IP addresses by sending requests with sockets manually bound to specific interfaces, and even might choose to lower the priority of information learned using interfaces that are clearly tunnel devices instead of network cards.

Also known as split tunnel, this can be used by corporate VPN solutions to lower the amount of network traffic entering a data center (so you don’t overload your undersized pipes)

No, I don't mean that. That's when you purposefully set your routing table to split some traffic to different paths. The premise here is that even if all of your traffic is supposedly going over a VPN, an app can often opt out of that and do whatever it wants.

> by sending requests with sockets manually bound to specific interfaces

I don’t believe this is possible in client JavaScript within a web browser. Very open to be proved wrong.

I thought the complaint was that the browser was figuring it out directly and then exposing it, such as via the browser's location API, not that the website was figuring it out using non-location network mechanisms provided by the browser.

(FWIW, a website that is given media recording privileges can definitely do that, though, using WebRTC. If you don't have that privilege then you can still use the WebRTC API but it doesn't return alternative candidates. But I also don't think that is what they meant.)

This could also happen if you have a misconfigured VPN with a DNS leak. Check out this website for clues: https://ipleak.net/

I checked and my DNS is not leaked through the VPN. Even if it was, how could that result in such an accurate localisation?

firefox has something called the mozilla location provider, which maps wifi access points to locations, which is similar to what google maps uses when you have gps disabled on mobile

This would make sense, thank you. Apparently Chrome has something similar?

Is there a way to turn that off? I never want my browser location services to work.

Go to about:config () and set geo.enabled to false.

: if you're on Android, you'll need either an unstable version (Beta, Nightly) or a fork (Fennec from F-Droid) of Firefox to get access to that page because Mozilla decided users of the standard distribution can't be trusted with these settings.

You clicked "Allow" on the location request dialog, click deny and it won't do that.

Of course, but how does it know? Where is the information from?

I'm assuming you mean on devices without a GPS.

There are services that wardrive around mapping locations of WiFi access points. Your laptop periodically will phone home with your nearby Wi-Fi MAC addresses (BSSIDs) to ask where they were detected.

Here's one such service: https://www.skyhook.com/wifi-location-solutions

By the way, if you've ever noticed a brief packet drop or latency spike (usually a few 100s of ms) while pinging a server from your Mac, it might be because your device is doing this.

When Location Services is on (which it is by default), macOS will periodically switch your wireless card to monitor mode to find those nearby SSIDs. That briefly interrupts normal network traffic.

IIRC, it does this more often when Find My.app is turned on.

You can disable Location Services in: System Preferences > Security & Privacy > Location Services

When you are on the VPN test for these:

https://www.expressvpn.com/webrtc-leak-test

https://www.dnsleaktest.com/

http://ipv6leak.com/

if this were true then BBC would know I'm not watching from UK.

I dont want to dislike firefox, but I am starting to find new reasons to resent it. It seems like every other week there is something new I'm finding out about that gives me pause before running updates. Every new 'feature' brings me further and further away from feeling like it's a browser I can trust to be just a browser. Something has to change. Pocket, Allo, still taking the google allowance, absolutely squandering their endowments on salary, too much focus on social signaling and politics. Just be a browser, please.

I won't be going to anything chrome-like, but I do see myself spending a lot more time using and sponsoring qutebrowser, or simply passively consuming offline.

> still taking the google allowance,

Doesn't Mozilla's revenue breakdown still show Google as the majority of their revenue, and pocket et al are efforts to diversify?

I wonder how that compares with Google Chrome relationship with Google...

Not having some proprietary debugger thing for this to work with when you can just set location in about:config seems like the pettiest nitpick

If wanting a browser to be just a browser is petty, then I am the pettiest. If you havent tried qutebrowser yet, give it a shot. When I say just a browser, this hits it pretty close, if you ask me.

Vim mode is pretty neat. It seems like the whole app is kind of just like a python gui app wrapper around webkit? Looks like it would be pretty good if I was using linux and a tiling wm as my main thing but these days I'm pretty bound to Windows for the type of development I'm working on.

Most of my linux desktop usage these days is stuff like writing scrapers in cloud containers that need a real browser that I can control using selenium or puppeteer or whatever though, is it supporting anything like that? If this works on Windows too that would be a bonus.

I don't know if it supports that type of workflow yet, but I hope something fills that void soon. It's a very real need with a clearly defined utility.

But, what will you go to? Chrome is worse by any metric.

Epiphany (aka Gnome Web) works pretty well on 99% of websites for me

There’s always Edge if you want Chrome without the Google and want some closed source bits (for streaming or whatever).

qutebrowser, like i said in the comment.

Allo? I think you confused this with something else if you're referring to Google Allo chat app.

https://www.pcworld.com/article/435884/firefox-hello-is-mozi...

Chrome is about to kill add blockers and you're complaining that Firefox doesn't have a super niche feature?!

You can literally accomplish this in firefox by other means.

Reply on news.ycombinator.com