Hacker News Reader

Comment by meetuu | Hacker News Reader

javascript has a lot of power, and it acesses more than the browser, and none of this is remotely too complicated, it happens on a daily basis. your browser does a lot more than you think. FB most definately does not stay in your browser when it gets its hooks on you. BTW modal dialog buttons do more than the label says, the old meme "what button do i push to hack someone" can be written to "what button do i click to let facebook hack me"

It soon becomes apparent that not a lot of people know as much about thier hardware, and or software as they think they do. Dont forget zuckerburgs roots, hes a black hat 101%

FWIW all you dvoters need to bone up on your skills if you think this, and more is too complex.

View on HN

How would you access my CPU serial number or my router MAC address from JS? I would think you’d need a zero-day to accomplish this, and it seems dumb for Facebook to be burning browser exploits on fingerprinting when they could make much more money selling them.

> javascript has a lot of power, and it acesses more than the browser, and none of this is remotely too complicated

While you can finger print a browser relatively well with javascript, it does not have access to a number of the things you list, like MAC, router MAC, CPU serial number, etc.

when you click a modal button are you sure it does what is assumed? recall win10 upgrade scandal? (the X)

>when you click a modal button are you sure it does what is assumed? recall win10 upgrade scandal? (the X)

Hijacking a button to do something different is a matter of attaching a different event to it - which is exactly what you can do with windows forms for things like "do you want to save?" To access information that's not actually available is a whole other level. Why would you consider those two are equivalent?

edit: To include parent's question and clarify why it's trivial.

Too much "1337 h4x0r" stuff.

It's public knowledge (or even open source code) what browsers expose, and system logs or CPU serial numbers are certainly not part of that.

if you give permission from an admin login, it is trivial to take carte blanche of a machine, its trivial to convince someone to give you full access

You're implying that Facebook is - widely - using unknown privilege escalation exploits in browsers for tracking purposes? That's absurd.

of course the practice is absurd, but that doesnt make it non existent. a non trivial number of average users run around the web in an administrative account, there is no escalation required when a script is already executed with admin, or even root permissions. The rest is academic.

Could you provide the JavaScript code that would allow a modal button to access these items?

You should look at what microsoft did to sneak its way into a win10 install, you should also look at what google does to snarf permissions with a button by another name.

the breadcrumbs can start here.

https://apenwarr.ca/log/20190201

your smart kid figure it out youll learn more that way versus being spoon fed.

BTW im sure that posting such code here would be a criminal activity that dang and others would frown upon profusely.

Original:

Link?

Edit: >You should look at what microsoft did to sneak its way into a win10 install, you should also look at what google does to snarf permissions with a button by another name. the breadcrumbs can start here.

>https://apenwarr.ca/log/20190201

> your smart kid figure it out youll learn more that way versus being spoon fed.

That has zero technical information, just a lot of vague hand-waving. Give me something technical here.

New Edit:

> BTW im sure that posting such code here would be a criminal activity that dang and others would frown upon profusely.

You're claiming this can be done in JavaScript. If it can be done in JavaScript, it's not going to be illegal.

Reply on news.ycombinator.com