Why isn't only the FQDN sent?
Someone else went into detail: https://news.ycombinator.com/item?id=32742504
The password web page example is here highly unlikely: if the attacker injected his external content on the password web page, he has already a very strong position - getting users to click on links is not a logical next step, the attacker has far better avenues I would assume.
At least that's my understanding.
I guess the idea is, someone can derive data about what you clicked based on some side channel (DNS queries? wifi activity? power draw?).
In terms of this vector, I could imagine it leading to history enumeration when combined with CSS, similar to the classic “check the color of the link.” Or maybe some fingerprinting scripts could send signals to server-side traffic analysis heuristics by preloading a specific script based on which region of the screen is visible within the first second of loading the page.
That’s all speculation of course, but clearly the feature increases privacy attack surface, by giving an external observer more paths for potentially reducing your possible anonymity sets.
Edit: this thing
https://www.w3docs.com/snippets/html/how-to-create-an-anchor...
It's the kind of thing I'd disable because of the privacy leaks it makes possible (Ctrl-F on the new page works just as well and keeps the user in control), but I can see how some people might like the extra convenience (when it's not being used maliciously to collect sensitive information from otherwise secure websites).
I remember seeing it for the first time and thinking, “oh here we go. Google needed browsers to have a feature to make its search engine UX better…” But I also cannot deny just how useful it is.
If videos can be timestamped for links, why not webpages? Linking to automatic content-indexed excerpts shows respect for the time spent by recipient and saves markup effort for the author.
The problem with "social media curation" as a qualifier could be interpreted as "a human is involved." Pretty much all forms of discovery, internet or not, requires either search or a human involved. Some services of course have broadcast mechanisms for curating an index but that's about the only exception I can think of for discovery that breaks away from these two qualifiers. To some degree, DNS is a broadcast system for discovery.
It looks like at one point, mozilla attempted to solve this with their context graph project as well as their acquisition of pocket. However, it does look like it has all the hallmarks of a technological solution to a societal problem. Solving the adverserial aspects as well as ethical concerns would require nothing short of a rethinking of how we use the web.
https://medium.com/firefox-context-graph/context-graph-its-t...
I've always been curious whether any search engine tries to index the "disconnected web" by just war-dialing domains/IPs like this.
> To some degree, DNS is a broadcast system for discovery.
Sadly, there's no real way to build a "DNS spider." You could if you could send DNS AXFR queries for arbitrary zones; but DNS servers mostly don't respond to these without authentication.
Not that you can't do that with a anchor, param, or an endpoint that can take arbitrary numbers/strings.
I'd love to know the explanation too.
In an extreme case imagine that someone sends you a password in a messaging app which is available via the web. If an attacker can trick you to open webpages (maybe they intercept a HTTP site and open a few tabs) they can detect if the page scrolled based on side channels (data transfer) or direct information (did you load a lazy-loaded image from their server?). You can use this to learn page content. This is vaguely similar to https://en.wikipedia.org/wiki/CRIME.
As a concrete example imagine that a webpage has something like this past the first page.
<p>Your password is 56acc1bc03298ec0</p>
<img loading=lazy src=https://cdn.example/secure.png>
If I do this 64 times (on average) I have learned the whole password.
This is a little hard to do, especially with pop-up blockers being built into most browsers so it is hard for a site to open many top-level windows (origin isolation of modern browsers will likely block this in iframes) it is not too extreme of a case.
Of course there are simpler attacks. Maybe someone can link to https://www.youtube.com/feed/history#:~:text=Voice+Feminizat... and they can tell if you have watched this video based on how many thumbnails have loaded. You load too many thumbnails and you get thrown in jail for being trans.
1. I think you could potentially embed an iframe on a page and use the scroll positions combined with this feature to read information on a page. Start with "a", check scroll position, then "ab", then "abc". Similar to a blind sql attack where you gather data/hashes by continuously adding to the SELECT query using a substring function and a sleep (to detect if the substring was found). You brute force character by character. I believe this is commonly called an "Oracle attack"
2. XSS/Phishing/Spam. You add a png with a "Your account has been compromised" or a "fake form" (think Google docs) or whatever your spam message is to a part of a page. You send an email with this special url that will cause it to jump directly to that location on load.
Just some theories. I'm pretty sure the first one would qualify for some sort of bounty, but my experience is most bug bounty programs wouldn't count the second one as valid (requires user interaction).
For a real world example: https://github.com/mozilla/standards-positions/issues/194#is...
See the stack overflow issue: https://stackoverflow.com/questions/67039633/get-the-text-fr...
(See also the currently "conflicting" library for URL fragment queries: https://github.com/Cyphrme/URLFormJS)
I think it can be easily fixed, using solutions like a delimiter, but that discussion probably needs to be apart of a wider discussion concerning URL extensibility.
Seems pretty wild to me that a privacy browser is alright with having their own extensions run in browser without any way to disable them or even know they exist.
"But the extensions are open-source so that means you can audit them!"
Uh yeah... but maybe I just don't want them to run and put "Tip" links on everything. It doesn't matter whether they are secure or not, the user should get to choose what they run in their browser.
Brave is great (in my opinion), but the more you look the more you realize how strongly opinionated it is about how people should use the web which is pretty antithetical to what Brave says they are trying to do.
Sometimes I wonder if people enjoy being blindly knee jerk reactionary.
Thankfully switching to Brave solved my issue and this stupid feature is disabled.
[0] https://perishablepress.com/disable-chrome-scrolltotextfragm...
I think most in the comment chain were thinking of the case of sending a link to a friend where you want them to be scrolled to some specific text. I often want to create these links for others when linking to long pages, or technical documentation.
I haven’t tried Brave (the crypto stuff puts me off), but if you’re interested in a good alternative to Google Search (that doesn’t link text fragments) you should check out Kagi. It’s paid, but it’s worth funding a Google competitor on principle IMO.
Only Google Search does that. What a knee jerk response...
It IS an interesting question. But you should simply upvote it, if you have nothing at all to add.
Why would Brave disable this? In my opinion, this is one of the most useful additions to browsers in recent memory, and it's quite annoying to click a link expecting to go a specific section and just be put at the top of the page. I noticed this was broken in Brave, but I never would have imagined they intentionally broke the feature.