1887877 - 103 Early Hints can be used to break adblocking

Status: NEW

(Core :: Networking, defect, P3)

Description

[Kershaw Chang [:kershaw]]

See the PoC here.
I copied some text from it below:

The core idea behind this proof of concept is the use of 103 Early Hints response. By sending early hints prior to the actual response, the server 
can determine whether an adblocker is present based on the client's handling of these hints. If adblock is detected, the server can then serve an 
alternative page. This method is particularly effective because it doesn't depend on JavaScript, which can be disabled or manipulated by users.

Comment 1

[Valentin Gosu [:valentin]]

Hi Manuel,

We though this could use the opinion of someone on the privacy team 🙂
This only affects a small subset of users who disable javascript. Even then I expect there are ways of detecting an adblocker with iframes and meta refresh.
Let me know if anyone has any concerns about it - otherwise we can put it in the backlog.

Comment 2

[Manuel Bucher [:manuel]]

Chrome does not allow adblockers to interact with resources loaded using early hints

Adblockers not being able to interact with resources loaded using Early Hints is a shortcoming of Chrome. The same attack can be archived with HTTP-Link headers:

HTTP 200\n\r
Link: <...>\n\r
\n\r # Now wait and do the same stuff the PoC does

Early Hints makes it easier, because you can send Link headers isolated from all the other headers.
One way to aid adblockers is to provide the possibility to block requests to the DOM, but still make the network requests. I think it is likely that we already have such an API (by allowing adblockers to modify data provided in OnDataAvailable).

But this ends up being an arms race between adblock writers and anti-adblock detection script writers.

If this provides a too big attack surface and/or Early Hints remain largly unused, we could consider disabling Early Hints Preload again. But I don't think we are at a point yet. If anyone finds a website abusing this, that would be interesting to see as a comment here.

Lets put it into Necko backlog for now.