SoylentNews is people
SoylentNews
Ultrasounds emitted by ads or JavaScript code hidden on a page accessed through the Tor Browser can deanonymize Tor users by making nearby phones or computers send identity beacons back to advertisers, data which contains sensitive information that state-sponsored actors can easily obtain via a subpoena.
This attack model was brought to light towards the end of 2016 by a team of six researchers, who presented their findings at the Black Hat Europe 2016 security conference in November and the 33rd Chaos Communication Congress held last week.
Their research focuses on the science of ultrasound cross-device tracking (uXDT), a new technology that started being deployed in modern-day advertising platforms around 2014.
uXDT relies on advertisers hiding ultrasounds in their ads. When the ad plays on a TV or radio, or some ad code runs on a mobile or computer, it emits ultrasounds that get picked up by the microphone of nearby laptops, desktops, tablets or smartphones.
These second-stage devices, who silently listen in the background, will interpret these ultrasounds, which contain hidden instructions, telling them to ping back to the advertiser's server with details about that device.
-- submitted from IRC
(Score: 3, Interesting) by LoRdTAW on Monday January 09 2017, @03:30PM
This was my argument the other day. Java script isn't evil by default. The problem is web standards which force browser designs to be insecure by default. We need a browser that respects privacy and security by removing the ability to access files, devices, cookies outside of its domain, and disable auto playing of audio and video. Another thing to nuke is the lock-the-browser dialogue box (are you sure you want to leave this site?) If a page wants to use javascript for the basics like DOM manipulation, fine. Just disable all of the bullshit like camera access, file system access, and audio/video playing.
Though a better fix would be to use minimalist browsers like Dillo and NetSurf which do not support most of the problematic stuff like javascript and HTML 5 extensions.