Hacker News new | ask | show | jobs
by solardev 1009 days ago
Cool add on! Thanks for this. It's a use case I've often thought about, for the purposes you mention. I wish there was a built in permission to disable AJAX after page load. Bad for ads, I guess.

2. Exploit idea (not trying for the bounty, just thinking aloud). I wonder if a website could play background music (or a video) with stenographically encoded data, then another tab could listen to it with microphone permissions on and decode it that way. I'm thinking like a fake video conferencing site, or malicious telephony how-to doc that deals with API calls and such and links to a fake password hasher that then plays the audio for the first tab to hear. Convoluted, I know, just an idea.
1 comments
matusfaro 1009 days ago
> built in permission to disable AJAX after page load

Interesting, but consider this is a cat-and-mouse game. If you are the only one using this trick it may work for you, but I assume would be easy to overcome. (e.g. keep the page loading forever or until ads are loaded. Have the ads be J-free after page load, ...)

> website could play background music ... another tab could listen

You would need mic access from the other tab, but yes. If you send it over high enough frequency you wouldn't even hear it. You would just have a visual feedback that the tab is playing music.

On a side-note, I recall there was some kind of hardware device pairing (maybe Chromecast?) that used data over voice to establish that you are physically near the other device.

link
solardev 1009 days ago
> On a side-note, I recall there was some kind of hardware device pairing (maybe Chromecast?) that used data over voice to establish that you are physically near the other device.

Yeah, that's pretty common in home smart devices. Looks like Google patented one version and Sonos has their implementation too. In my experience it works better than Bluetooth, especially in (2.4 GHz) noisy environments

link
matusfaro 1009 days ago
Funny that you say Sonos.

I also remember there was a data-over-voice library called "chirp.io" which now redirects to Sonos homepage. Now I know why they acquired them :)

link
solardev 1009 days ago
I wonder if it's also part of the patent battle they got in with Google over smart speaker stuff.

Side rant: It's so sad, to this day Google Assistant works terribly on my Sonos system, and it's a major reason I'm reluctant to further buy into their ecosystem. And Sonos's own assistant doesn't even support Spotify, last I checked. Their whole UX is... not great. I really wanted to work there and maybe try to fix some of the issues I experience as a user, but they rejected me. Alas.

link