Hacker News Reader

Comment by rsj_hn | Hacker News Reader

Your options, as I see them.

1. Text based ads only (no third party js)

2. HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify)

3. Look for a js sandbox -- this _will_ break arbitrary js, will not be supported in all browsers, and will require dev work on your side:

  * Google Caja  https://github.com/google/caja

  * MentalJS  https://github.com/hackvertor/MentalJS

other options are available as well, in varying levels of maturity and support.

I think using a sandbox iframe is not going to be able to defeat browser fingerprinting, because the sandbox control options are not rich enough. You would need to block all JS.

View on HN

> HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify)

Or use iframe.sandbox, which was designed for it. https://www.w3schools.com/tags/att_iframe_sandbox.asp

Using an iframe sandbox has some issues:

1. scrollbars and positioning can cause problems with iframes that an inline div doesn't have, especially if there are multiple small iframes on the page.

2. As soon as you allow script in the sandbox iframe, then you are susceptible to these types of fingerprinting attacks. The fact that you have origin isolation doesn't really block what the ad was doing. This is because iframe sandbox was never designed to block fingerprinting attacks, it was design to create a separate origin that gave the dev broad control over features like 'allow js' 'allow access to origin', etc.

>1. scrollbars and positioning can cause problems with iframes that an inline div doesn't have, especially if there are multiple small iframes on the page.

I'm not quite sure what you mean here, but I'm curious. Have any examples?

Ideally you would like the iframe to not be visible -- you don't want it to show scrollbars if the content overflows.

But at the same time, you want to see all the content in the iframe. If you knew ahead of time exactly the layout of the text in the iframe you could do this, but it's harder when you have dynamically generated content inserted into the iframe, and now add to that wanting the page to be on different devices with different viewports, resolutions, users resizing the page, users increasing or decreasing text sizes for accessibility or changing default fonts.

And if you don't control the content, some of it may contain fixed size elements or absolute positioning inside the frame.

It's a really difficult problem that we were struggling with before ultimately giving up on trying to use iframes for this purpose. And when you make a mistake you either get ugly scrollbars in your iframe or part of your content is cut off when the user resizes the page.

Solving this problem requires the JS on the parent and child frames to cooperate and talk to each other about their sizes, so the parent can resize the iframe to match the size of its content. This is not something ad providers would bother to implement on their own, let alone in a consistent way.

Correct, there are solutions, but in our case none of them were feasible because we didn't control what was happening inside the iframe.

4. Images! Why would they need anything else? Why would they need JS?

Images are much heavier than text (and let's face it, most of advertisement is just words). But these days, JavaScript is heavier than millions of colour pixels, so maybe images are better :)

Is there any reason they couldn't be vector SVGs?

There are plenty of ad networks that do not allow advertisers to run JS. You have to run the ad networks script but that's the only one.

Reply on news.ycombinator.com