Show HN: I saw this mind-blowing experiment, so I made a simple version of it

Am I the only one that's horrified that window.screenX and window.screenY exist? This is not information that I want to provide.

Sorry, i'm a little lost. I tried thinking about it, but I can't think of any nefarious attacks someone could do with screenX/Y. Why is that such a risk? What could they possibly learn from that other than screen size?

Because fingerprinting. Shit like this is the reason you are supposed to use the Tor browser only with a tiny window.

you are supposed to use the Tor browser only with a tiny window

I hadn't ever heard of this. Here is a statement from the Tor project for anyone else wondering what this is about:

We automatically resize new browser windows to a 200x100 pixel multiple based on desktop resolution which is provided by a Firefox patch. To minimize the effect of the long tail of large monitor sizes, we also cap the window size at 1000 pixels in each direction. In addition to that we set privacy.resistFingerprinting to true to use the client content window size for window.screen, and to report a window.devicePixelRatio of 1.0. Similarly, we use that preference to return content window relative points for DOM events. We also force popups to open in new tabs to avoid full-screen popups inferring information about the browser resolution. In addition, we prevent auto-maximizing on browser start, and inform users that maximized windows are detrimental to privacy in this mode

Fingerprinting by screen size is real. I've checked one day, and it turned out my browser viewport size when maximized is super unique (like <0.1% users unique). That's mostly because I use sidebery (tabs on the left instead of the top) and don't have a (visible by default) bookmarks tab, but wow I didn't expect to be so obvious for advertisers by just reading my page-usable screen size.

The fingerprinting potential may well be limited, but it's the principle of the thing: The browser should not provide unnecessary information about its surroundings.

It would be another matter if this was a very useful feature, but I don't think that it is.

Here's one use for it: Ads could sense that they are off-screen and withhold content until the ad is moved back in view. I could easily see screenX/Y being used for that. I mean, I hope not, but how am I going to stop it?

knowing where the window is, you can generate something the user will click on a known position and then at the right time you trigger something like an administrator escalation privilege confirmation dialog and the user clicks that instead.

click jacking is always fun.

Using the demo in https://developer.mozilla.org/en-US/docs/Web/API/MouseEvent/... it seems Firefox pretends the window is always at (0,0). So that's nice.

You likely have `privacy.resistFingerprinting` set to true.

as everyone should!

people forget lesson from recent past. i don't know when google strong armed w3c to include this back... but we had this since ie4 days and then disabled everywhere since it was abused left and right for click jacking attacks.

Yep. There are some ridiculous web APIs out there that expose all sorts of things you'd think should remain private. Take the Battery Status API for example [1].

[1] https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta...

IIRC, that one and a number of other lower-level “WTF” APIs were introduced for Firefox OS. They made a little more sense in the context of providing an interface for mobile phones using the browser stack.

This would be useful in WebXR (given opt-in)

I just checked, it is possible to override them, which causes them to stop updating when you change the your window's location on the screen.

But… why does it lag? Shouldn’t this be trivial enough to be instant?

Probably because of websocket network lag and also, in my anecdotal experience, window position updates are sometimes strangely jittery

Why is it over a websocket? Can't it just share local data?

those were my thoughts too

You can use Broadcast Channels as well as Service Workers, even WebRTC would use a loopback interface!

This ought to work across different browsers though, for what it's worth. But ultimately it's just a fun experiment.

It says so right in the OP

The original work by Bjorn Staal used localStorage, but I found sockets more fun, because if tweaked a bit, this can be shared with friends.

I might be wrong, but I think the point is to simulate a server-client architecture (to show that it works even for an actual web app).

I wonder if it would be more instant if they used postMessage api instead of going over network.

Any local network usage should be nearly instantaneous.

My personal theory about the lag is that positioning the window is not synchronized to the JS thread, so the window moves before the JS thread is aware, which means you see the square move after the window has already moved.

Ah, my bad. I didn't read the code and just assumed there was a far away server.

Going over local network is more or less instant

I assume you mean BroadcastChannel?

https://developer.mozilla.org/en-US/docs/Web/API/BroadcastCh...

Background windows/tabs getting a lower priority maybe a factor.

Querying window position is laggy unfortunately. It's a browser feature.

The available API's on the web are very questionable. Feross has a web security lecture series on youtube where he showed off the following abomination. Enter at own risk.

https://theannoyingsite.com/

warning, this is really annoying. imagine you're infected with a ton of adware in the early 2000s you will be logged out of many accounts

here's someone testing it out on Windows a few years ago, but I assure you even in the latest chrome on mac, it's at least as bad https://youtu.be/estvbRSj4LU?si=gq6-l4pWLC9yXqap&t=109

Why would you keep minimizing things instead of closing them? The video just looks like one of those meant to frustrate the viewer into wanting to do it themselves. I blame the creator of that video as much as the site itself. The site itself served a purpose. The person running that video has a much less clear motive

I think if you close a window, another pops up. Or two.

You should go to this site and test this.

It spawned an app outside of the browser. That's the window being minimized that I meant. I'm not an unawares person to the site's purpose. You're being a bit disingenuous with your reading of my comment

I tried it on Safari private window. It was absolutely horrible. I hesitate to guess what would have happened if I didn't keep clicking cancel whenever it asked if I wanted to allow downloads, etc.

holy shit, I was not expecting that LOL

It lived up to its name for sure!!

uBlock Origin has prevented the following page from loading:

    https://theannoyingsite.com/

Because of the following filter:

    ||theannoyingsite.com^$document

Found in:

    uBlock filters – Badware risks

That's a great demo! I'd be curious to see how this would work with multiple monitors.

Also, thank you for voluntarily acknowledging that you were directly inspired by somebody else and giving them credit - the software industry could use more people like you.

What, thieves?

Make your stuff from zero, like the rest of us!

Pretty sure this is tongue-in-cheek, given the commenter (pretty high profile dev who creates a lot of cool stuff and does not shy away from using other open source code!) :)

Aw I thought it would be obvious :( Thanks for clarifying, of course nobody makes anything without being inspired from something that already existed, at least to a degree.

I guess it's hard to accurately convey sarcasm online, thanks again!

Standing on the shoulders of giants

No worries, it was pretty obvious to me

that was super cool of you. Before letting people make the incorrect assumption, you hit em off at the pass. good people right there

Wow this seems profound, I didn’t even know you could do that, that could be the future of augmented reality if you think about it, layers! Great job!

Could you please expand on your "if you think about it"?

sure, if you think about the long term usage of augmented reality then we will need to have multiple layers of content {rationale=because we need to focus on one thing in the context of multitasking, because we want to reskin the environment while still maintaining the content, and to avoid unsafely obscuring the field of view during ambulation and manipulation tasks}

Spoiler: he didn't.

Is it really different from any multiplayer game? Two view ports, shared coordinates, independent renderers. The “trick” is that the view ports are overlapping, but I would imagine sendMessage might be faster and not require any server round trip.

I was just trying to be nice, sheesh. happy holidays

made something similar 14 years ago...

https://youtu.be/bEwsuWNxdno

domain isn't mine anymore...

What API allowed that back then?

I don't see what is technically new about this? What API has been missing to do this?

Tcp and window.screenTop and screenLeft should get you there right? Hmm, yeah, 2008 is a long time ago though..

It was an API I developed using ActiveX on Microsoft's Internet explorer and NPAPI on other browsers

Oh wow, from December 2008.

Here's to no one trying to patent it now!

The original seems to be on LinkedIn. Does anyone else find it weird when geek content is posted to LinkedIn? It's the last place I'd think to look. Am I missing out or is this an outlier?

I work in computer vision and like hearing about the latest thing. I have been finding LinkedIn increasingly useful as a way to learn about machine learning.

There are _a lot_ of posts that I have to scroll through of little to no value, but every so often I see a post by Yann LeCun or the lead developer advocate at TensorFlow or a paper someone has liked that catches my eye or a new model release.

"Machine learning LinkedIn", as it were, is a real thing; not sure whether this applies to other disciplines.

Yann posts mostly on X.

I've recently started posting my content on LinkedIn (usually just linking to my blog or publication with a short explanation). Main reason is that I'm a bit unhappy with the new Twitter (a place where I used to share the most), approximately nobody reads Mastodon so I can't stop there, and all least I already have LinkedIn so it's low cost to share there.

For sure. It’s approximately the first time I’ve seen something like that on LinkedIn.

W-why is window LOCATION exposed to websites? Apparently even in FF private browsing...

At first I thought this is an electron only thing. I get it that we gave up on fingerprinting resistance but this is like pissing on it's grave.

EDIT: privacy.resistFingerprinting set to true fixes the coords to 0

On Wayland, a native window can't even get that information. At least not in a way that works across composiotors.

I'm as surprised as well.

I'm trying to guess why, and can only imagine that at some point the idea was to support multi-window webapps, like maybe you'd have separate windows for documents and different tool palettes, and they'd want to know each other's locations to try to prevent overlaps? I mean, back in the day, framesets were another idea that experienced some popularity before being totally eclipsed by <iframes> -- all of this back in the era when everything was based on the multiple-windows paradigm rather than the multiple-tabs paradigm. Window.screenLeft apparently originated in IE [1].

Just a guess though. Very curious if there's any legitimate reason for it to continue to exist, or whether W3 ought to deprecate it.

[1] https://developer.mozilla.org/en-US/docs/Web/API/Window/scre...

I thought you meant literal `window.location` and was confused, but yeah `window.screenX/Y` is a pretty suspect feature, now that you mention it.