Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Edge sends full URLs of pages visited to Microsoft

twitter.com

Post reply on HN
Print view View original

51–60 of 161 posts

Re: Edge sends full URLs of pages visited to Microsoft

#51

Post by cyphar »

gruez wrote: post #43
est31 wrote: post #32

Earlier quoted context omitted.

There is a first step which uses bloom filters, and if the filter gives a result, it is hashed and the hash is sent to the google service to double-check. That being said, a four byte / 32 bit hash is enough to almost uniquely identify a website. There number of 32 bit numbers and websites is roughly the same order of magnitude. It's a problem without a good solution because if you create many collisions then you als…

>That being said, a four byte / 32 bit hash is enough to almost uniquely identify a website. There number of 32 bit numbers and websites is roughly the same order of magnitude. Why not send less bits (eg. 24 bit) of the hash?

The utility of the hash for a user and some potential attacker is the same. Yes, passing 8 fewer bits means that they have 256 times more possible sites you might have visited. But it also means that you get 256 times as many false positives of websites being labeled as phising. This is what GP meant by it being problem without a good solution.

One possible option is to do what haveibeenpwned does, where you give fewer bits and then locally check. That would be a good improvement to the system's privacy, but you probably want to avoid downloading the hashes of every malicious website that starts with the given 3 bytes (I'd assume the list is quite large) for every page load.

Re: Edge sends full URLs of pages visited to Microsoft

#52

Post by liability »

simias wrote: post #45
ChrisLomont wrote: post #37

Earlier quoted context omitted.

Those hashes have to be essentially unique to prevent blocking good sites erroneous;y, and as such are easily associated to actual sites when you’re the scale of MS or Google.

Not if there's an other layer of verification locally. Then you can allow a few false positives with the hash on the remote and they'll get discarded when the full hash is compared locally. That being said 32bits of information seems like quite a lot and can probably used to match the original URL fairly accurately.

You also need to consider the greater context. Suppose my history shows I sent a hash that could be one of 100 different known URLs. One of them is about model airplanes, but there is no way to know I picked that one. Chance I like model airplanes? All else being equal.. call it 1%

But what if over the next hour I continue to send hashes with random subject matter sets that include model airplanes each time. Suppose the intersection of the possible subject matters shrinks with each additional hash, quite possibly contains only model airplanes.

I visited 100 URLs in one hour. For each URL there are 100 others with the same hash but independent topics. Lets say there are 10,000 known topics, but every hash I sent has model airplanes associated with it. Now what are the chances I like model planes?

It seems clear to me that this scheme, with logging, reveals a lot in theory. But maybe solving this problem in practice would cost more that the data is worth. For now.

Re: Edge sends full URLs of pages visited to Microsoft

#53

Post by [deleted] »

gruez wrote: post #43
est31 wrote: post #32

Earlier quoted context omitted.

There is a first step which uses bloom filters, and if the filter gives a result, it is hashed and the hash is sent to the google service to double-check. That being said, a four byte / 32 bit hash is enough to almost uniquely identify a website. There number of 32 bit numbers and websites is roughly the same order of magnitude. It's a problem without a good solution because if you create many collisions then you als…

>That being said, a four byte / 32 bit hash is enough to almost uniquely identify a website. There number of 32 bit numbers and websites is roughly the same order of magnitude. Why not send less bits (eg. 24 bit) of the hash?

[deleted]

Re: Edge sends full URLs of pages visited to Microsoft

#54

Post by kps »

liability wrote: post #46
eitland wrote: post #40

Earlier quoted context omitted.

Doesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about Google and Chrome. Edit 2: Thinking about it and searching a bit I conclude that IIRC Google at least used to have access to your browsing history as part of syncing it unencrypted.

Everything you type into the address bar gets considered for possible completion, right? And part of that quite possibly entails sending it off to Google servers which take a stab at finding completions for it. Your claim seems plausible at least.

Yes, there are some options under chrome://privacy/settings that suggest they send full or partial URLs:

- Use a web service to help resolve navigation errors

- Use a prediction service to help complete searches and URLs typed in the address bar

and then there's

- Use a web service to help resolve spelling errors

whose description suggests it sends more than URLs.

Re: Edge sends full URLs of pages visited to Microsoft

#55

Post by mnutt »

jhanschoo wrote: post #47
eitland wrote: post #40

Earlier quoted context omitted.

Doesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about Google and Chrome. Edit 2: Thinking about it and searching a bit I conclude that IIRC Google at least used to have access to your browsing history as part of syncing it unencrypted.

If you are logged into Chrome your history is synchronized across platforms, tied to your Google account. Same as with Firefox Sync. Not sure about behavior when not logged in, or when incognito.

Firefox Sync is quite different than Chrome's version; with Firefox your data is encrypted locally on your machine before it is synced.

Re: Edge sends full URLs of pages visited to Microsoft

#56

Post by [deleted] »

asveikau wrote: post #48
eitland wrote: post #40

Earlier quoted context omitted.

Doesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about Google and Chrome. Edit 2: Thinking about it and searching a bit I conclude that IIRC Google at least used to have access to your browsing history as part of syncing it unencrypted.

If you sign in it syncs history across devices, so I assume it does. Although it would technically be possible that they encrypt it using a key Google doesn't have, I wouldn't assume they implemented that.

[deleted]

Re: Edge sends full URLs of pages visited to Microsoft

#57

Post by kps »

asveikau wrote: post #48
eitland wrote: post #40

Earlier quoted context omitted.

Doesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about Google and Chrome. Edit 2: Thinking about it and searching a bit I conclude that IIRC Google at least used to have access to your browsing history as part of syncing it unencrypted.

If you sign in it syncs history across devices, so I assume it does. Although it would technically be possible that they encrypt it using a key Google doesn't have, I wouldn't assume they implemented that.

It's an option under the sync settings:

○ Encrypt synced passwords with your Google username and password

◉ Encrypt synced data with your own sync passphrase

Re: Edge sends full URLs of pages visited to Microsoft

#58

Post by Karunamon »

kps wrote: post #54
liability wrote: post #46

Earlier quoted context omitted.

Everything you type into the address bar gets considered for possible completion, right? And part of that quite possibly entails sending it off to Google servers which take a stab at finding completions for it. Your claim seems plausible at least.

Yes, there are some options under chrome://privacy/settings that suggest they send full or partial URLs: - Use a web service to help resolve navigation errors - Use a prediction service to help complete searches and URLs typed in the address bar and then there's - Use a web service to help resolve spelling errors whose description suggests it sends more than URLs.

And, if I recall right, you're asked if you want search suggestions in the omnibar the first time you use it for that purpose.
Post reply on HN