371
Researchers say they can spy on your browsing by measuring SSD activity through a browser API (www.tomshardware.com)
submitted 5 months ago by to c/technology@lemmy.world
73 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 202 points 5 months ago* (18 children)

They really gave internet browsers too much access. Why the fuck does my browser need this level of clearance

  • permalink
  • fedilink
  • source
  • hideshow 18 child comments
    •
  • [–] 33 points 5 months ago (6 children)

    Becau of the push for web apps to get around platform (and platform store) limitations.

    e.g. Apple banned apps for vapes (not just talking about nic vapes but e.g. there's a number of cannabis flower vapourisers that use Bluetooth for fine tuned settings, those were forced to move over to web apps as the native apps simply got pulled), but also software like ESPHome is completely web based and needs access to raw USB devices to write the new firmware onto them, the list goes on.

    Main issue seems to be that a lot of these APIs don't require explicit user approval. USB, Bluetooth does, but apparently accessing detailed system statistics doesn't? Make that make sense...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 4 points 5 months ago (4 children)

    That's not a legitimate reason. The correct response is to make a standalone application, not a web app, and distribute it elsewhere than the main store. It's one more reason sideloading needs to be allowed. If it isn't we end up with vulnerabilities because of workarounds.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 7 points 5 months ago (3 children)

    Good luck distributing it "elsewhere" when it comes to iPhones.

    Yes, even with the DMA forcing Apple to open up to alternative app stores in Europe, Apple still has a definitive say as to what apps can be published, and what those apps have access to.

    Also, a lot of the time, a full blown app is unnecessary, or not practical.

    The solution isn't to prevent functionality from existing - this includes browsers and web apps having access to certain aspects to the hardware - but giving the user absolute control over what they allow an app to do.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 5 months ago (2 children)

    Good luck distributing it "elsewhere" when it comes to iPhones.

    Without creating the stupid browser based loopholes, it wouldn't be a choice. Developers would be pushing Apple and Google to allow "sideloading" (as if alternative sources are any less legitimate than from their stores).

    Also, a lot of the time, a full blown app is unnecessary, or not practical.

    It's just as practical. It's unnecessary for a browser to be built to function as a replacement to an application for literally any purpose. If you're making a website, then fine, you don't need an app. If you're making something that interfaces with the functionality of the device, that isn't the job of a browser.

    The solution isn't to prevent functionality from existing - this includes browsers and web apps having access to certain aspects to the hardware - but giving the user absolute control over what they allow an app to do.

    How do you do this? If the browser has permission it has permission. Each application should be separate so the permissions are separate.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 5 months ago* (last edited 5 months ago) (1 child)

    Even without the "browser loophole", developers are pushing Google and Apple about further permissions being granted and sideloading and whatnot. Apple and Google careth not... Your argument is pretty moot at this point.

    And no, you can already do per website permissions. Or what the fuck do you think the notification settings are for, or the PER INSTANCE BASED REQUESTS for e.g. Bluetooth or USB device access? Or when a website asks you to access your camera or microphone? These are all instances of the browser having access and the website having to request permission separately from it...

    Each application should be separate so permissions are separate

    Ever heard of this nifty thing called "sandboxing" that browsers have been doing for, oh, about a decade now?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    Even without the "browser loophole", developers are pushing Google and Apple about further permissions being granted and sideloading and whatnot. Apple and Google careth not... Your argument is pretty moot at this point.

    No, not even without it. Without it there would be a significantly larger push. It wouldn't just be a small movement. It'd be necessary. It's like being on a computer and getting everything from the Microsoft store (if you're on Windows). Sometimes they don't have what you need, so basically every moderate user has had to download something elsewhere. It'd be the same on phones. Apple and Google would not be able to get away with preventing sideloading because every user and developer would care, not just the few of us there are now.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 52 points 5 months ago* (5 children)

    They better hope there isn't another pandemic. Cuz I am officially labeling that quantity of free time as "1 Degoogle". and if I ever get my hands on another fuckin degoogle I am going to degoogle all over my fucking house

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 54 points 5 months ago (3 children)

    You can Degoogle one step at a time. Make it a weekly habit to spend 10 minutes Degoogling every week and you won’t need to wait for another worldwide shutdown

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 5 months ago*

    I wholeheartedly second this. I started by removing all the files off Google Drive, which was easy for me. To swap email, I took one week researching email replacements, another week signing up, and every week since then has been swapping over one or two websites to the new addresses. Still not there, but I'll have a lot less work to do if/when I have to de-Google quickly.

    Thinking of de-Googling as a single action that must be completed in totality is not a good way of getting anything done. There is huge value in reducing reliance.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 5 months ago*

    Modern browsers are basically an OS of their own at this point. And, in fairness, for many users their actual OS is effectively just a means by which they access a browser. This is not even mentioning something like Chrome OS.

    I’m not saying it’s a good idea or that it should be this way, but it is where we are.

  • permalink
  • fedilink
  • source
  • parent