Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google can track surfing habits without need for HTTP cookies

youbroketheinternet.org

Post reply on HN
Print view View original

11–20 of 65 posts

Re: Google can track surfing habits without need for HTTP cookies

#11

Post by aawc »

Did you turn on that 'Block dangerous and deceptive content' feature in Firefox' security tab? It works by consulting Google each time you visit a new website. You can imagine the rest.

Patently wrong. Here's how the API works:

The Update API lets your client applications download hashed versions of the Safe Browsing lists for storage in a local database. URLs can then be checked locally. Only if a match is found in the local database does the client need to send a request to the Safe Browsing servers to verify whether the URL is included on the Safe Browsing lists.

From: https://developers.google.com/safe-browsing/v4/update-api

Source: Safe Browsing engineer on Chrome.

Re: Google can track surfing habits without need for HTTP cookies

#12

Post by phillipseamore »

phillipseamore wrote: post #8

So theoretically possible != proof. A high TLS resumption lifetime is used to decrease latency and it can have a huge impact. The RFC itself recommends a TTL of 24 hours (RFC4346).

And this is strange "They found that 80% of websites make a correct use, unsuitable for tracking repeat visitors — just resuming an existing session within the last ten minutes." Just Cloudflare has a 48 hour TTL. (Previously I stated 2 hours)

Re: Google can track surfing habits without need for HTTP cookies

#15

Post by phillipseamore »

phillipseamore wrote: post #12
phillipseamore wrote: post #8

So theoretically possible != proof. A high TLS resumption lifetime is used to decrease latency and it can have a huge impact. The RFC itself recommends a TTL of 24 hours (RFC4346).

And this is strange "They found that 80% of websites make a correct use, unsuitable for tracking repeat visitors — just resuming an existing session within the last ten minutes." Just Cloudflare has a 48 hour TTL. (Previously I stated 2 hours)

Sorry. Looked at the wrong column. Cloudflare actually has a 48 hour TTL.

Re: Google can track surfing habits without need for HTTP cookies

#18

Post by mook »

kawsper wrote: post #10
Nerada wrote: post #5

Mitigated by uMatrix and other Firewall tools, no? I don't find myself ever needing to allow Google Fonts/Analytics to view a page.

https://www.easyjet.com had a hilarious bug where their menu bar wouldn't work if you were blocking Analytics. But yes, it is often not a problem at all to block Google Fonts/Analytics - almost everything works as expected.

There's actually a bunch of sites that are similarly broken; if any script fails to load (including, yes, analytics) nothing works.

That was why I originally started using uBlock origin… it had a thing to shim in that, as opposed to uMatrix which didn't.

Post reply on HN