New Google Chrome feature blocks attacks against home networks | Hacker News Reader

New Google Chrome feature blocks attacks against home networks

bleepingcomputer.com

59 pointsWasserpuncher36 comments

Open articleView on HN

1. Force uBlock Origin out.

2. Reimplement its features selectively.

uBlock Origin comes with a filter called 'Block Outsider Intrusion into LAN'[0].

[0] https://github.com/uBlockOrigin/uAssets/blob/master/filters/...

Migrate to Firefox and install uBlock Origin, you will have this feature and more.

Chrome has had a builtin ad blocker for years.

I know nothing of this Chrome ad blocker, but you have to ask yourself, is it really an ad blocker if it’s owned and maintained by the largest adtech company on earth hellbent on maximising profits from ads?

Yes, it's in Google's best interest to maximize the amount of time people spend on the web, doing searches, to go to different websites. Websites with spammy ads can cause people to use the web less, causing them to search less, causing Google to be able to show less advertisements.

It’s in googles best interest to maximise the amount of time people spend on the web not viewing their adverts?

What on earth?

It's correlated. When people spend more time on the web, they do more Google searches, which will show more ads. So both the time spent not viewing their ads AND the time spent viewing their ads both increase.

Except if they're blocking ads and the ad blocker actually works (as e.g. uBlock Origin does), they're spending zero time viewing ads.

I never see any Google ads ever. Does the built in adblocker in chrome do that? Or does it... not block ads?

Chrome only blocks ads that violate the Better Ads Standards https://www.betterads.org/standards/

The ads that are shown on Google searches follow this so they are not blocked by Chrome.

Right so it doesn't do what an adblocker is supposed to do, which is block ads. It doesn't do that because it's not in Google's interest for it to do that.

It does block ads. It blocks ads that are harmful to the web ecosystem. Chrome blocking all ads would hurt the web ecosystem tremendously as it interferes with how many sites are monetized. It is not in Google's interest to kill the web. They want to ensure that it keeps growing.

Looking at the site you linked, it's clear that the objective of the standard is to show you ads without annoying the users enough to force them to install ad blockers. So the standard isn't about preventing targeted ads at all. And the ads don't have to cross the 'annoyance threshold' to be harmful to its audience. For example, cross-site tracking used by ad tech is a privacy nightmare in itself. There are good reasons to block all targeted ads altogether.

So… it’s not really an ad blocker then. Because it’s developed by the world’s largest advertising company.

It blocks ads so buy definition it is an adblocker.

Putting a sheet of paper over my computer screen is by definition an adblocker as well?

Except it’s definitely not, because that’s not its intended purpose.

>Except it’s definitely not, because that’s not its intended purpose.

Chrome's adblocker's purpose is to remove ads though so your example isn't the same.

So it’s a selective ad-remover, not an ad-blocker then.

Those are the same things. What do you think filter lists are which is how pretty much every ad blocker works? They literally are a list of a selectors for ads that should be removed.

Sure, and while you may pedantically argue that an antivirus software that selectively allows specific viruses on your computer depending on the author is still a antivirus software, most people wouldn’t.

I’d probably base my determination more on its actual functionality in practice, rather than soapboxing by a drive-by commenter that themselves admits that they haven’t used it.

I’m not even a Chrome user, but come on…

No, you come on. Chrome's "ad blocker" is objectively laughable, and the person you are responding to is pointing out that additionally there is a conflict of interest. Wouldn't matter even if the functionality was at parity with Ublock.

60% of Google's revenue, $175 Billion came from advertising. Google Chrome will never implement a feature that threatens the company's primary source of revenue.

And to the surprise of nobody, they do the opposite. Google Chrome selectively sends more data when vising Google domains compared to regular domains.

Does it block youtube ads?

The ads on YouTube do not violate the Better Ads Standards so they are not blocked.

What part of ALL as in "blocking all ads" does Google not understand?

We do not care about allowing "better ads", just the allowing "NO ads".

New Google Chrome feature blocks attacks from something websites shouldn't be able to access in the first place.

Well have you looked at the example? Browsers should be able to a access anY IP on the LAN. If that url is not password protected and let you just change settings via URL its really not the browsers fault for supposedly "giving access". Well thinking about it, it should probably not be possible in an iframe but they would just trick you clicking a link instead. People to not secure their routers and have default passes that is the big issue here. So of course them mitigating that makes sense.

Simple never giving access would mean people can not open their router interfaces, self hosted stuff on SBCs ... so you make no sense.

> People to not secure their routers and have default passes that is the big issue here.

Is it really? ISPs in USA/Canada/France/etc give customers WiFi routers with random passwords for many years.

It's not random, it's the devices Mac address and some isp-specific value hashed together and truncated.

Don't tell anyone though since that's a pretty big security risk.

Do you have a link for the algorithm? Really interesting.

https://arstechnica.com/information-technology/2024/02/doj-t...

> That malware, which worked as a botnet for the Russian hacking group Fancy Bear, was removed in January 2024 under a secret court order as part of "Operation Dying Ember," according to the FBI's director. It affected routers running Ubiquiti's EdgeOS, but only those that had not changed their default administrative password

Those are not ISP given devices. While it's bad-bad, Ubiquiti is a SOHO vendor and post-purchase configuration is expected.

It's easy to be smart about it after the fact. Back then it was hard to tell WWW is gonna be the the standard protocol for most people to interact with the internet.

And it doesn't even block, it preflights the requests, and if the device exists and responds, it will only block if the device sets a special header? Which of course no existing devices will, so it's going to do very little good - nothing for existing IoT gear, and likely not much more for new devices, unless all those manufacturers rapidly embrace setting the new header. To me it seems like it'd be a far more obvious approach to just throw up a dialog that says "the current page wants to connect to things on your home network, does that seem reasonable to you, or should I continue to block that?"

> it will only block if the device sets a special header?

No. It will block by default. If the header is present, it will allow the request.

> just throw up a dialog that says "the current page wants to connect to things on your home network

In many (probably most) cases it is just a work site trying to connect to an internal service on your work VPN, and the warnings would get annoying very quickly.

Ah, that makes a little more sense, though it will break any legitimate uses we might have now - not sure if the Home Assistant web UI talks to local devices by IP (or maybe only via their .local?) That's probably still a good tradeoff, and I am sure if they left it all up to the user plenty of people would click 'ok' without understanding, but it'd be nice to have that as an option.

Reply on news.ycombinator.com