{"id":100172,"date":"2021-05-15T22:22:39","date_gmt":"2021-05-15T20:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/identifikacziya-cherez-analiz-vneshnih-obrabotchikov-protokolov-v-brauzere"},"modified":"2021-05-15T22:22:39","modified_gmt":"2021-05-15T20:22:39","slug":"identifikacziya-cherez-analiz-vneshnih-obrabotchikov-protokolov-v-brauzere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/identifikacziya-cherez-analiz-vneshnih-obrabotchikov-protokolov-v-brauzere","title":{"rendered":"Identification through the analysis of external protocol handlers in the browser","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The developers of the fingerprintjs library, which allows for passive browser identification based on indirect signs such as screen resolution, WebGL features, and lists of installed plugins and fonts, have introduced a new identification method. This method evaluates the types of applications installed by the user and works by verifying the browser\u2019s support for additional protocol handlers. The script code implementing this method has been published under the MIT license. <\/p>\n
The verification process is based on analyzing the bindings of handlers to 32 popular applications. For example, by identifying the presence of URL handlers like telegram:\/\/, slack:\/\/, and skype:\/\/ in the browser, one can infer the existence of telegram, slack, and skype applications on the system, using this information as a characteristic for generating the system identifier. Since the list of handlers is the same across all browsers in the system, the identifier remains unchanged when switching browsers and can be applied in Chrome, Firefox, Safari, Brave, Yandex Browser, Edge, and even Tor Browser. <\/p>\n
The method allows for the generation of 32-bit identifiers, which means it doesn't individually achieve high accuracy, but it makes sense as an additional attribute when combined with other parameters. A significant downside of the method is that the attempt at identification is noticeable to the user \u2014 when generating an identifier on the provided demonstration page, a small but clearly visible window opens in the bottom right corner where handlers are processed for quite a while. This downside does not appear in the Tor Browser, where the identifier can be computed discreetly. <\/p>\n
To determine the presence of an application, the script attempts to open a link related to an external handler in a popup window. The browser then displays a dialog suggesting opening the content in the associated application if the application is present, or shows an error page if the application is not installed on the system. By sequentially checking typical external handlers and analyzing the returned errors, one can infer the presence of the checked programs in the system. <\/p>\n
In Chrome 90 for Linux, the method did not work, and the browser displayed a standard confirmation dialog for all attempts to check the handler (the method works in Chrome for Windows and macOS). In Firefox 88 for Linux, both in normal and incognito mode, the script identified the presence of installed extensions from the list, with an identification accuracy rated at 99.87% (35 similar matches out of 26,000 tests conducted). In the Tor Browser running on the same system, an identifier was generated that matched the test in Firefox. <\/p>\n
Interestingly, the additional protection in the Tor Browser backfired, allowing for identification to be conducted without user awareness. Due to the disabling of confirmation dialogs for using external handlers in Tor Browser, verification requests could be opened in an iframe instead of a popup window (to differentiate between the presence and absence of handlers, the same-origin policy blocks access to error pages and allows access to about:blank pages). Due to flood protection, verification in Tor Browser takes significantly longer (10 seconds per application). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"