“You opened this page.

[migueldeicaza@mastodon.social]

“You opened this page. It already knows the following.”

taken.

What the page already knows about you, revealed as you read it. No input. No permission. No exception.

Since You Arrived (sinceyouarrived.world)

[sempf@infosec.exchange]

@Migueldeicaza I know you knew the browser provided all of that before you opened the link. I did too.

Were you still as freaked out as me, even though you knew it was gonna happen?

[offbeatmammal@mastodon.social]

@Sempf @Migueldeicaza it's one thing knowing it, but quite another seeing it unfold in front of you. Experiencing it makes it more visceral

[layan2002@mastodon.social]

@Migueldeicaza Hello friend, I know this might be appropriate, but could you support my post? I would be very grateful🤍️

[isilzha314@infosec.exchange]

@Sempf

@Migueldeicaza the gyroscope data through the browser is the one that freaks me out every time.

you'd think over a decade of Niantic shenanigans would be the salient reminder

[rustynail@floss.social]

@Migueldeicaza funny thing, if I use an anti-fingerprinting browser and a vpn and stuff like that, most things this page tells me are fake, but there is another website called something like amiunique.org, which tells me that the combination of all the fake things about me can still uniquely identify me on the internet... at least among its other visitors I guess

[liquidparasyte@app.wafrn.net]

@Migueldeicaza@mastodon.social

Vivaldi was found wanting.
Firefox was quite a bit better.
Firefox Focus was basically the same.
Surprisingly Cromite was the best overall.

All, for whatever reason, reported the exact gyroscope position.

My question is why the fuck do browsers even report this data

[sempf@infosec.exchange]

@Offbeatmammal @Migueldeicaza This reminds me of showing developers how ineffective browser security controls are against an attacker. The developer knows that the browser is just talking to a backend server and that you can insert yourself between that space but it's very different seeing it.

[officeplant@mastodon.social]

@liquidparasyte @Migueldeicaza weird but nice to know that iOS and Safari are at least smart enough to block gyroscope and battery by default

[migueldeicaza@mastodon.social]

@Sempf I really loved the tone, typography and disclosure- such a. Rautiful way of presenting it

[migueldeicaza@mastodon.social]

@liquidparasyte not Safari

[endlessmason@hachyderm.io]

@Migueldeicaza
> You have not enabled Do Not Track. This is the default. It means either that you chose not to, that you did not know it existed, or that you know it makes no difference. All three possibilities are informative.

Statements dreamed up by the utterly deranged

[aburka@hachyderm.io]

@EndlessMason @Migueldeicaza I'm pretty sure all of these statements were dreamed up by an llm

[endlessmason@hachyderm.io]

@Migueldeicaza
This actually reminds me of support scam and ads for virus checkers from the 90s web.

A big fat popup that says "we have copied all the files from your computer
<iframe src="file://C:\">" and like... lamo, i guess.

[tbgp@mastodon.social]

@Migueldeicaza AI slop site just learned what basic fingerprinting is

[irelephant@app.wafrn.net]

@Migueldeicaza@mastodon.social

It thinks I'm in london.

[2ruth@mastodon.social]

@liquidparasyte @Migueldeicaza I'm on Firefox, and it got the gyroscope reading completely wrong. It also reported that I was in a town about 150 miles from here, and reckoned I'd touched the screen 612 times whilst scrolling through. Nonetheless, it's an eye opener in many ways

[wilmboerhout@mathstodon.xyz]

@Migueldeicaza it did not identify my browser correctly

[clonedhuman@mastodon.social]

@Migueldeicaza Is there a way to prevent this?

[chrisod@social.lol]

@Migueldeicaza it was off on my location by 600 miles