21–30 of 37 posts
Earlier quoted context omitted.
Chrome is just trying to start catching up to where Safari and Firefox are.
Chrome is restricting fingerprinting, but they still ship google analytics in the browser itself so it's harder to block. They'll only really block fingerprinting in their browser when they have no use for it.
Reposting from the other [1] thread: Basically Safari keeps track of which domains are being requested in a 3rd party context (i.e. I load example.com in my browser and the page loads the facebook sdk - Safari increments a counter for facebook by 1). Once a given domain reaches 3 hits, Safari will strip cookies and some other data in 3rd party requests to that domain. The problem is that advertisers can use this to f…
Wow. I understand ITP's high level design, but didn't know it's implementation is so naive. Maintaining global database with a few rules which can be easily reverse engineered and giving its access to any documents? How did it go through the internal review process? Does Apple have any privacy/security review process for its major products? I understand that privacy engineering is very hard and sometime can get not v…
There is a fundamental difficulty when trying to implement privacy: A limit on the disclosure of information is itself a disclosure of information. A good privacy design needs to confront this issue directly. Sometimes there's nothing to be done. I think in some cases it's mathematically unsolvable (cf. Cynthia Dwork's paper on Differential Privacy). But an explicit consideration can at least surface some trade-offs.…
It makes me think of password requirements. Isn't it bad to earmark a password as requiring certain things rather than to let the possibilities be completely open?
Earlier quoted context omitted.
Chrome is just trying to start catching up to where Safari and Firefox are.
Chrome is restricting fingerprinting, but they still ship google analytics in the browser itself so it's harder to block. They'll only really block fingerprinting in their browser when they have no use for it.
Can you show me that's true? If it is, that's fairly interesting.
There may be room for more improvement here but be aware what the POCs illustrate is not an active vulnerability any more.
In addition, we don't believe this channel was ever exploited in the wild.
(If anyone is aware of other issues in this area, I encourage you to practice responsible disclosure and report to Apple or to the WebKit project.)
We've addressed the issues disclosed to us, and if you try any of the 5 POCs in the paper you will find they no longer work in the latest Safari. Details of the fixes here: https://webkit.org/blog/9661/preventing-tracking-prevention-... There may be room for more improvement here but be aware what the POCs illustrate is not an active vulnerability any more. In addition, we don't believe this channel was ever exploite…
Reposting from the other [1] thread: Basically Safari keeps track of which domains are being requested in a 3rd party context (i.e. I load example.com in my browser and the page loads the facebook sdk - Safari increments a counter for facebook by 1). Once a given domain reaches 3 hits, Safari will strip cookies and some other data in 3rd party requests to that domain. The problem is that advertisers can use this to f…
We've addressed the issues disclosed to us, and if you try any of the 5 POCs in the paper you will find they no longer work in the latest Safari. Details of the fixes here: https://webkit.org/blog/9661/preventing-tracking-prevention-... There may be room for more improvement here but be aware what the POCs illustrate is not an active vulnerability any more. In addition, we don't believe this channel was ever exploite…
I’ve been following privacy issues and technology for a while, but haven’t come across a foundational discussion of (a) the merits of and (b) technical implementations of different approaches to avoid fingerprinting: “hiding” vs “blending in”(making me look identical to countless others - maybe even randomizing who I look like in a smart way). I wonder if any subject area experts reading this thread would be willing…
But then, here's the thing. My other personas are similarly focused, but on other stuff. And they don't use English.
A determined global adversary could link them through traffic analysis. But it's a big Internet, and I don't make it easy.