My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me.
I have disabled the Flash plugin on Chrome, since all websites that I use support HTML5 video playback.
Every other website that requires Flash redirects me to the Flash download page. However, somehow, the HBO website actually redirected me to the chrome://plugins page, which meant that it could detect that I had manually disabled the Flash plugin. Unfortunately, I have no access to the credentials to dig into the JS now.
I found this post on SO. However none of the solutions there (including the accepted one) can distinguish between not installed and disabled.
Does anyone know how JS can detect whether a Chrome plugin is installed, disabled or active? Shouldn't this be completely sandboxed? HBO can already detect incognito browsing, I wonder what the cumulative security impact is of the browser leaking all this info.
After looking through the JS I cannot find any mention of this type of validation. Maybe it is something that Chrome does, and I'm needlessly worried?