Re:Telemetry in Front-End Tools
by nyarlathotep_ on Wednesday April 05, 2023 @08:43PM
(#35462591)
What are you using to accomplish this? iptables?
Yes, iptables.
How do you know the app is not using a side channel to exfiltrate data through the normal mechanism of operation? Zoom - I expect it to require significant amount of bandwidth to operate. How am I to know that if remote call X fails it will not just route data through the video path?
> Because fingerprinting. I can't think of any way to stop fingerprinting. The best I can do (and I do) is to disallow JS from running, but that still leaves many possible signals.
This is even worse for native apps. webapps do fingerprinting because they don't have access to lowlevel native information. Any native App does not need to do Fingerprinting, they can just read device IDs directly, much more reliable that any method of fingerprinting.
> This is even worse for native apps
Not if those apps can't phone home.
> how can you be so confident that your firewalling method is less leaky than the battle-tested sandboxing of Chromium or WebKit?
I can't be 100% certain, of course -- although that's equally true of Chromium and webkit. But I have a monitoring system that checks my firewall logs to catch anything suspicious.
> The most secure option might be running a web app in an isolated Chromium process
Because fingerprinting. I can't think of any way to stop fingerprinting. The best I can do (and I do) is to disallow JS from running, but that still leaves many possible signals.