News for hackers. Stuff that matters.

A comment on Why is Stack Overflow trying to start audio?. Parent comment

Re:Why is Stack Overflow trying to start audio? by dTal on Thursday June 27, 2019 @06:20AM (#20293130)
>It's amazing to me that an advert can run arbitrary javascript at all.

I'm not fully up to date with how these things are usually set up - is there anything in the web security model that prevents "ads" from exfiltrating arbitrary information from any page that they're on? Could an ad read my keystrokes, or scrape private messages?

[ Parent | on HN ]
Re:Why is Stack Overflow trying to start audio? by londons_explore on Thursday June 27, 2019 @08:23AM (#20293759)
Ads are iframed, and don't have permissions to do anything to the host page.

Doesn't stop them fingerprinting the browser though

[ Parent | on HN ]
Re:Why is Stack Overflow trying to start audio? by tinus_hn on Thursday June 27, 2019 @11:02AM (#20295020)
Typically ads are not in iframes, they are loaded by Javascript from the ad network and can do whatever they want.
[ Parent | on HN ]
Re:Why is Stack Overflow trying to start audio? by smilliken on Thursday June 27, 2019 @11:13AM (#20295123)
There's multiple nested iframes and scripts loaded at every level. All variations are possible.
[ Parent | on HN ]
Re:Why is Stack Overflow trying to start audio? by tinus_hn on Thursday June 27, 2019 @12:52PM (#20296196)
Sure, but obviously it’s more valuable if you give the ad access to your DOM so it can ‘optimize the ad placement’.
[ Parent | on HN ]
Re:Why is Stack Overflow trying to start audio? by ChrisSD on Thursday June 27, 2019 @07:51AM (#20293580)
It is possible to restrict ads using CORS headers, sandboxed iframes and cross origin restrictions. However this is rarely done effectively. Often the ads have a ridiculous level of access.
[ Parent | on HN ]
Re:Why is Stack Overflow trying to start audio? by Aeolun on Thursday June 27, 2019 @06:52AM (#20293287)
Short answer is yes.
[ Parent | on HN ]
Re:Why is Stack Overflow trying to start audio? by dTal on Thursday June 27, 2019 @07:27AM (#20293450)
Yes, the security model stops them, or yes, they can do those things?
[ Parent | on HN ]
Re:Why is Stack Overflow trying to start audio? by gbuk2013 on Thursday June 27, 2019 @07:52AM (#20293582)
Yes, they can do those things.
[ Parent | on HN ]