News for hackers. Stuff that matters.
Re:TeamViewer installs suspicious font only useful for web f... by turtleman1338 on Wednesday July 20, 2022 @09:36AM (#32165596)
It would be totally sufficient to use the protocol handler. You also can not be sure teamviewer is not installed, just because the font is missing. The user could use an older version that does not include the font, or could have removed the font manually.
Re:TeamViewer installs suspicious font only useful for web f... by mwcampbell on Wednesday July 20, 2022 @09:40AM (#32165639)
But can JavaScript check whether the protocol handler is installed? Or can it only attempt to use the protocol handler, then give the user if-then-else instructions to manually handle the case where it's not installed? Remember, a remote support product has to assume that the user receiving support doesn't have the knowledge or energy to go through a complex setup process, which is presumably a digression from whatever problem they were having in the first place.
Re:TeamViewer installs suspicious font only useful for web f... by alex_suzuki on Wednesday July 20, 2022 @09:51AM (#32165785)
It cannot. Enumerating protocol handlers is actually an excellent fingerprinting technique. That’s why platforms like iOS for instance forbid it, or you have to explicitly specify which ones you’ll query (see: https://developer.apple.com/documentation/uikit/uiapplicatio...).
Re:TeamViewer installs suspicious font only useful for web f... by tiagod on Wednesday July 20, 2022 @11:28AM (#32167177)
> The user could use an older version that does not include the font

Teamviewer versions are not backwards-compatible

> It would be totally sufficient to use the protocol handler

The error when it's not installed could be confusing to the user. Remember this is a remote support product, you must the assume the user is not tech literate. You must also assume the user is on IE5 or something.