1

Gmail cookies

If you view the linked image you will see that when I log into gmail google stores a cookie called SSID on my system. Is it possible that their javascript requests the SSID of my Wi-Fi network from the network? If I am logged into a hotspot with a distinctive name such as "L33T H4CK3R UNIVERSITY SECURE WI-FI" or "Manufacturer-DeFaUlt-HOmE-rOUtEr-nAmE1234x599" this could be a security issue that allows someone to deduce my true IP address even if I am using TOR or a VPN. For instance, google has a Wi-Fi hotspot map; they could use that map to figure out my true IP and true location from my Wi-Fi network name.

Could someone recommend libraries I could look at or an approach I could take to program a Firefox or Chrome plugin that would spoof the Wi-Fi network name and other information that is passed to Javascript?

Improve this question

1 Answer 1

Reset to default
1

SSID is not abbreviated only as Service Set IDentifier, it also referenced as Secure Session IDentifier, depending on context. Try to take a look at it's actual value to determine if there is a security issue. Just using a SSID as a cookie name is defenately not harming neither security, nor privacy

Improve this answer
14
  • Yes clearly SSID could stand for anything. Google could also use a cookie called ABCD to store my SSID name. What worries me is the possibility that google may be collecting system level information from javascript to compromise the anonymity provided by my VPN. I wonder if you could help me find a resource I could use to research how (if?) Javascript can make OS API calls to get information about my system such as what operating system I am using, the SSID, or even information about the file directory. If my home folder is Joe_Sixpack_Laptop can a javascript request that information?
    – John Miller
    Commented Jun 20, 2016 at 19:04
  • @JohnMiller the JS capabilities are highly-dependent on a browser you're using and it's version. If you're concerned about the data leaks you've mentioned upstrings - use a blank VM isolated from your host PC and launch browser inside it : it will see NOTHING except a gateway 192.168.0.1 and a blackhole-like network card that attaches your VM to Tor as a router. No proxies, no real DNS addresses, NOTHING
    – Alexey Vesnin ♦
    Commented Jun 20, 2016 at 19:07
  • Thanks so much! What is a blank VM? do you mean one that I only use for the purpose of surfing the web anonymously? How can I isolate it from my host pc? For example if I installed linux on VirtualBox then just opened that up would that be sufficient? Or are there other steps I should take?
    – John Miller
    Commented Jun 20, 2016 at 19:11
  • @JohnMiller Correct! And by it's "blankness" I presume that NOTHING except an OS and a Web browser is installed on it. To isolate a VM from a host is quite easy: use a VM that has only one network host-only interface, so no NAT or Bridge networking at all! And route it's traffic through Tor's TransPort+DNS. It's a piece of cake in firewall rules.
    – Alexey Vesnin ♦
    Commented Jun 20, 2016 at 19:31
  • I have been doing some research on my own, and most blogs I have read (for instance: christophermaier.name/blog/2010/09/01/…) seem to suggest that I have to set up one Network Adapter on VBox with NAT to access the internet at all. Then I can set up a second network adaptor with Host Only so that I can ssh into my virtual machine; I don't want to ssh into my virtual machine, though. Will I still have a "blank" machine with just an NAT adapter? it seems superfluous to run a host-only interface if this is mainly to access the vm from host
    – John Miller
    Commented Jun 20, 2016 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .