<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>adtehcmadness1</author><text>As someone working on exactly this type of stuff, your&amp;#x27;e absolutely right.
\*.safeframe.googlesyndication.com is Google&amp;#x27;s implementation of the IAB&amp;#x27;s safeframe standard[0], which is basically a cross origin iframe with an API that&amp;#x27;s exposed to the embedded 3rd party code (the ad).
This is how its HTML looks like (some attributes removed for readability):&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;lt;iframe src=&amp;quot;https:&amp;#x2F;&amp;#x2F;\*.safeframe.googlesyndication.com&amp;#x2F;safeframe&amp;#x2F;1-0-38&amp;#x2F;html&amp;#x2F;container.html&amp;quot; title=&amp;quot;3rd party ad content&amp;quot; sandbox=&amp;quot;allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-top-navigation-by-user-activation&amp;quot; allow=&amp;quot;attribution-reporting&amp;quot;&amp;gt;&amp;lt;&amp;#x2F;iframe&amp;gt;
&lt;/code&gt;&lt;/pre&gt;
As you can see, it has both sandbox[1] and allow[2] attributes.
The former restricts certain behaviors of the embedded code (most notably, navigating the top window without user activation), and the latter restricts it from accessing certain APIs - this why the author saw errors in the console.&lt;p&gt;The script at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cdn.js7k.com&amp;#x2F;ix&amp;#x2F;talon-1.0.37.js&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cdn.js7k.com&amp;#x2F;ix&amp;#x2F;talon-1.0.37.js&lt;/a&gt; is an ad verification library developed by Verizon Media (formerly Oath), and it does, among other things,, fingerprinting for bot detection purposes (because they want to prevent ad fraud). It was served together with the actual ad media (so called &amp;quot;creative&amp;quot;) into the safeframe.&lt;p&gt;This a relativity begin case. Iv&amp;#x27;e seen much more terrible stuff, from fingerprinting for user taking to straight out malware being served in ads. It&amp;#x27;s a wild west (or web).&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.iab.com&amp;#x2F;guidelines&amp;#x2F;safeframe&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.iab.com&amp;#x2F;guidelines&amp;#x2F;safeframe&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTML&amp;#x2F;Element&amp;#x2F;iframe#attr-sandbox&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTML&amp;#x2F;Element&amp;#x2F;if...&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTML&amp;#x2F;Element&amp;#x2F;iframe#attr-allow&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTML&amp;#x2F;Element&amp;#x2F;if...&lt;/a&gt;</text><parent_chain><item><author>tomudding</author><text>I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed.&lt;p&gt;There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get &amp;quot;response&amp;quot;), which is definitely something which can be used for fingerprinting.&lt;p&gt;Which reminds me of fingerprinting by tiny differences in the audio API provided by browsers [0]. Super interesting, but also a bit depressing. Also works for things like canvases and WebGL.&lt;p&gt;EFF allows you to check how fingerprintable your browser is [1]. Do note that the results may not be very accurate.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;coveryourtracks.eff.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;coveryourtracks.eff.org&lt;/a&gt;</text></item></parent_chain></comment><story><title>An iframe from googlesyndication.com tries to access the camera and microphone</title><url>https://techsparx.com/software-development/security/csp-camera-microphone.html</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>dc3k</author><text>&amp;gt; &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&lt;/a&gt;&lt;p&gt;&amp;gt; It is particularly useful to identify malicious visitors attempting to circumvent tracking&lt;p&gt;Ah yes, the visitor trying to not be tracked is the malicious one. Barf.</text><parent_chain><item><author>tomudding</author><text>I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed.&lt;p&gt;There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get &amp;quot;response&amp;quot;), which is definitely something which can be used for fingerprinting.&lt;p&gt;Which reminds me of fingerprinting by tiny differences in the audio API provided by browsers [0]. Super interesting, but also a bit depressing. Also works for things like canvases and WebGL.&lt;p&gt;EFF allows you to check how fingerprintable your browser is [1]. Do note that the results may not be very accurate.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fingerprintjs.com&amp;#x2F;blog&amp;#x2F;audio-fingerprinting&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;coveryourtracks.eff.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;coveryourtracks.eff.org&lt;/a&gt;</text></item></parent_chain></comment><story><title>An iframe from googlesyndication.com tries to access the camera and microphone</title><url>https://techsparx.com/software-development/security/csp-camera-microphone.html</url></story>