Hacker News Reader

Comment by munch117 | Hacker News Reader

Am I the only one that's horrified that window.screenX and window.screenY exist? This is not information that I want to provide.

View on HN

Yep. There are some ridiculous web APIs out there that expose all sorts of things you'd think should remain private. Take the Battery Status API for example [1].

[1] https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta...

IIRC, that one and a number of other lower-level “WTF” APIs were introduced for Firefox OS. They made a little more sense in the context of providing an interface for mobile phones using the browser stack.

This would be useful in WebXR (given opt-in)

Using the demo in https://developer.mozilla.org/en-US/docs/Web/API/MouseEvent/... it seems Firefox pretends the window is always at (0,0). So that's nice.

You likely have `privacy.resistFingerprinting` set to true.

as everyone should!

people forget lesson from recent past. i don't know when google strong armed w3c to include this back... but we had this since ie4 days and then disabled everywhere since it was abused left and right for click jacking attacks.

> as everyone should!

Not until Mozilla stops telling websites that I want a light color scheme if I turn it on. privacy.resistFingerprinting does too many things and you shouldn't need to use that sledgehammer to prevent the browser from leaking information that no website should know.

Sorry, i'm a little lost. I tried thinking about it, but I can't think of any nefarious attacks someone could do with screenX/Y. Why is that such a risk? What could they possibly learn from that other than screen size?

The fingerprinting potential may well be limited, but it's the principle of the thing: The browser should not provide unnecessary information about its surroundings.

It would be another matter if this was a very useful feature, but I don't think that it is.

Here's one use for it: Ads could sense that they are off-screen and withhold content until the ad is moved back in view. I could easily see screenX/Y being used for that. I mean, I hope not, but how am I going to stop it?

knowing where the window is, you can generate something the user will click on a known position and then at the right time you trigger something like an administrator escalation privilege confirmation dialog and the user clicks that instead.

click jacking is always fun.

Because fingerprinting. Shit like this is the reason you are supposed to use the Tor browser only with a tiny window.

> you are supposed to use the Tor browser only with a tiny window

I hadn't ever heard of this. Here is a statement from the Tor project for anyone else wondering what this is about:

> We automatically resize new browser windows to a 200x100 pixel multiple based on desktop resolution which is provided by a Firefox patch. To minimize the effect of the long tail of large monitor sizes, we also cap the window size at 1000 pixels in each direction. In addition to that we set privacy.resistFingerprinting to true to use the client content window size for window.screen, and to report a window.devicePixelRatio of 1.0. Similarly, we use that preference to return content window relative points for DOM events. We also force popups to open in new tabs to avoid full-screen popups inferring information about the browser resolution. In addition, we prevent auto-maximizing on browser start, and inform users that maximized windows are detrimental to privacy in this mode

Fingerprinting by screen size is real. I've checked one day, and it turned out my browser viewport size when maximized is super unique (like <0.1% users unique). That's mostly because I use sidebery (tabs on the left instead of the top) and don't have a (visible by default) bookmarks tab, but wow I didn't expect to be so obvious for advertisers by just reading my page-usable screen size.

I just checked, it is possible to override them, which causes them to stop updating when you change the your window's location on the screen.

Reply on news.ycombinator.com