<story><title>An iframe from googlesyndication.com tries to access the camera and microphone</title><url>https://techsparx.com/software-development/security/csp-camera-microphone.html</url></story><parent_chain><item><author>tomudding</author><text>I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed.&lt;p&gt;There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get &amp;quot;response&amp;quot;), which is definitely something which can be used for fingerprinting.&lt;p&gt;Which reminds me of fingerprinting by tiny differences in the audio API provided by browsers [0]. Super interesting, but also a bit depressing. Also works for things like canvases and WebGL.&lt;p&gt;EFF allows you to check how fingerprintable your browser is [1]. Do note that the results may not be very accurate.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;coveryourtracks.eff.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;coveryourtracks.eff.org&lt;/a&gt;</text></item></parent_chain><comment><author>adtehcmadness1</author><text>As someone working on exactly this type of stuff, your&amp;#x27;e absolutely right.
\*.safeframe.googlesyndication.com is Google&amp;#x27;s implementation of the IAB&amp;#x27;s safeframe standard[0], which is basically a cross origin iframe with an API that&amp;#x27;s exposed to the embedded 3rd party code (the ad).
This is how its HTML looks like (some attributes removed for readability):&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;lt;iframe src=&amp;quot;https:&amp;#x2F;&amp;#x2F;\*.safeframe.googlesyndication.com&amp;#x2F;safeframe&amp;#x2F;1-0-38&amp;#x2F;html&amp;#x2F;container.html&amp;quot; title=&amp;quot;3rd party ad content&amp;quot; sandbox=&amp;quot;allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-top-navigation-by-user-activation&amp;quot; allow=&amp;quot;attribution-reporting&amp;quot;&amp;gt;&amp;lt;&amp;#x2F;iframe&amp;gt;
&lt;/code&gt;&lt;/pre&gt;
As you can see, it has both sandbox[1] and allow[2] attributes.
The former restricts certain behaviors of the embedded code (most notably, navigating the top window without user activation), and the latter restricts it from accessing certain APIs - this why the author saw errors in the console.&lt;p&gt;The script at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cdn.js7k.com&amp;#x2F;ix&amp;#x2F;talon-1.0.37.js&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cdn.js7k.com&amp;#x2F;ix&amp;#x2F;talon-1.0.37.js&lt;/a&gt; is an ad verification library developed by Verizon Media (formerly Oath), and it does, among other things,, fingerprinting for bot detection purposes (because they want to prevent ad fraud). It was served together with the actual ad media (so called &amp;quot;creative&amp;quot;) into the safeframe.&lt;p&gt;This a relativity begin case. Iv&amp;#x27;e seen much more terrible stuff, from fingerprinting for user taking to straight out malware being served in ads. It&amp;#x27;s a wild west (or web).&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.iab.com&amp;#x2F;guidelines&amp;#x2F;safeframe&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.iab.com&amp;#x2F;guidelines&amp;#x2F;safeframe&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTML&amp;#x2F;Element&amp;#x2F;iframe#attr-sandbox&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTML&amp;#x2F;Element&amp;#x2F;if...&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTML&amp;#x2F;Element&amp;#x2F;iframe#attr-allow&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTML&amp;#x2F;Element&amp;#x2F;if...&lt;/a&gt;</text></comment>
<story><title>An iframe from googlesyndication.com tries to access the camera and microphone</title><url>https://techsparx.com/software-development/security/csp-camera-microphone.html</url></story><parent_chain><item><author>tomudding</author><text>I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed.&lt;p&gt;There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get &amp;quot;response&amp;quot;), which is definitely something which can be used for fingerprinting.&lt;p&gt;Which reminds me of fingerprinting by tiny differences in the audio API provided by browsers [0]. Super interesting, but also a bit depressing. Also works for things like canvases and WebGL.&lt;p&gt;EFF allows you to check how fingerprintable your browser is [1]. Do note that the results may not be very accurate.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;coveryourtracks.eff.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;coveryourtracks.eff.org&lt;/a&gt;</text></item></parent_chain><comment><author>ravenstine</author><text>In my experience, with tools like Cover Your Tracks (apparently this is the new name for Panopticlick), the more you try and thwart fingerprinting, the more unique you appear.  Although I still do everything I can to block and filter everything conceivable, I&amp;#x27;ve given up on trying to figure out how identifiable I am on the web because it seems useless.  If you don&amp;#x27;t try then you&amp;#x27;re identifiable, and if you do then you are probably more identifiable.  Whatever.</text></comment>