69

I visited a Stack Overflow page from Google, and this message popped up:

Enter image description here

Why does Stack Overflow need to know my location? Note that I'm using a userscript that only hides the ads, so Stack Overflow doesn't get penalized, but if it was an advertisement requesting this, I would have expected the domain of an advertisement in the message, and not Stack Overflow itself.

28
  • 4
    Can you check which ads were served on that page? I do think the ads are added to the DOM, so they are not in an IFRAME so that technically make them come from Stack Overflow if the ad goes rogue.
    – rene
    Commented Jan 6, 2019 at 13:24
  • 13
    That makes the suspicion for an sneaky ad even higher.
    – rene
    Commented Jan 6, 2019 at 13:29
  • 2
    @rene actually, there is an iframe. I don't think it's external ads, more likely something they put in SO For Teams code, maybe by mistake. (Hence not many can reproduce) Commented Jan 6, 2019 at 13:38
  • 2
    @ShadowWizard I've got Teams and can't reproduce.
    – wizzwizz4
    Commented Jan 6, 2019 at 14:20
  • 6
    @ShadowWizard while ads are indeed loaded inside an <iframe> element, this iframe's document get populated by script and still has its origin set to stackoverflow.com. You can try from your dev-tools to switch the js console's context to the one of such iframe (google_ads_iframe_...) and then run navigator.geolocation.getCurrentPosition(()=>{});. You'll see that the request is made on behalf of stackoverflow.com, just like in the screenshot. It can still very well be a sneaky ad.
    – Kaiido
    Commented Jan 6, 2019 at 14:23
  • 3
    @Kaiido well, in such case SE should block ads from using JS. Not that it will happen, but they should. :) Commented Jan 6, 2019 at 14:38
  • 1
    @wizzwizz4 assuming it's a single ad, it takes about 200 reloads to get to it. Commented Jan 6, 2019 at 14:39
  • 3
    @Ferrybig I think you should add bug to the tags, and privacy, and maybe security.
    – wizzwizz4
    Commented Jan 6, 2019 at 14:43
  • 1
    @Kaiido IP address for sure (well, anyone can get it by posting image pointing to their server, but still..) Commented Jan 6, 2019 at 14:56
  • 1
    I've never seen this request. Has anyone else seen it apart from FerryBig? Commented Jan 6, 2019 at 17:07
  • 4
    @MartinSmith I've seen it on mobile web page today.
    – user2285236
    Commented Jan 6, 2019 at 17:48
  • 1
    @MartinSmith No. And the mobile page doesn't show ads as far as I know.
    – user2285236
    Commented Jan 6, 2019 at 17:58
  • 6
    This happened to me using Meta on Dec 24 using my Pixel in Chrome. Took a screenshot but I never got around to posting because it was the holidays. I haven't been able to reproduce since then. i.sstatic.net/kSDVr.png
    – Steven V
    Commented Jan 6, 2019 at 22:46
  • 1
    You should have screenshotted the whole page not just the angle showing the popup... Commented Jan 7, 2019 at 9:16
  • 3
    We don't ask. I'm trying to determine why you're seeing this. Does it repro with extensions disabled?
    – Nick Craver Mod
    Commented Jan 7, 2019 at 12:20

1 Answer 1

23

I'm trying to help debug in comments, but for all:

Why does Stack Overflow want to know my location?

We don't. This is a rogue extension or ad most likely and we'll get to the bottom of it.

5
  • 1
    I don't think it was a rouge extension. I had this happen using the mobile version of Meta on Chrome for Android which doesn't allow extensions. And the TLS certificate was valid over my home network via Verizon FiOS. MITM is highly unlikely as well. (I have faith SO is not asking for this data directly. Just adding more information to help.)
    – Steven V
    Commented Jan 7, 2019 at 13:03
  • 1
    @StevenV Thanks, that definitely helps. We're look at our options to both track this down and kill it now.
    – Nick Craver Mod
    Commented Jan 7, 2019 at 13:30
  • I also have the suspicion it is an advertisement, I purposely didn't pick an option when it asked for the location, and then I refreshed, it should have asked again in the case of an compromised extension, as those people usually target the sheep, and don't need complicated code
    – Ferrybig
    Commented Jan 7, 2019 at 14:49
  • Can this be a Chrome anomaly? I've seen this the day after SO asked me to use my phone's location: imgur.com/a/B1GnHBk
    – user2285236
    Commented Jan 8, 2019 at 20:26
  • @NickCraver I got another repro on gaming.stackexchange.com/questions/265083/… but this time I had my adblock (ublock on, since I require it for the distracting animated header on that site) i.imgur.com/BBFq8KB.png Again after following a link from Google
    – Ferrybig
    Commented Jan 13, 2019 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .