Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome deploys deep-linking in latest build despite privacy concerns

theregister.co.uk

Post reply on HN
Print view View original

31–40 of 159 posts

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#31

Post by cmg »

phillipseamore wrote: post #24

What? A DNS lookup doesn't include anything but the hostname and anything following a hash is never sent with a request from the browser.

I think the idea there is that there would be lazy-loaded content from another site that would only load when someone scrolled far enough to see the highlighted word, which will automatically happen with this feature.

The title of the Forbes article is too hyperbolic for my tastes and while this could be a security concern in very specific situations it's being overblown.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#32

Post by _verandaguy »

abbracadabbra wrote: post #20
DoctorOW wrote: post #18

Earlier quoted context omitted.

It'll be like the early 2000's if switching to another browser was most likely just IE6 reskinned.

Microsoft Edge, which is built on Chromium, would fit this parallel nicely.

And brave, and vivaldi

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#34

Post by tyingq »

Confused. As I understand it, anything after the # in a uri isn't sent over the wire.

So the only way someone could see that you're navigating to a specific fragment is some sort of deep chrome logging, or chrome plugin, etc. And if that's the case, cat's already out of the bag for everything you do already.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#35

Post by phillipseamore »

cmg wrote: post #31
phillipseamore wrote: post #24

What? A DNS lookup doesn't include anything but the hostname and anything following a hash is never sent with a request from the browser.

I think the idea there is that there would be lazy-loaded content from another site that would only load when someone scrolled far enough to see the highlighted word, which will automatically happen with this feature. The title of the Forbes article is too hyperbolic for my tastes and while this could be a security concern in very specific situations it's being overblown.

I think that would need to be a designed attack, not something that would apply to 99% of websites. The only legitimate resource (that could be used as a canary) being loaded far down a page would be an image (and that kind of requires it to be lazy loading as well).

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#36

Post by blakesterz »

EDITED and hour later: A couple of people have pointed out it's back, they've made some changes and marked it as public now.

There was another article on this same topic this morning with this:

"Google's engineers have not ignored worries about the security and privacy risks. To their credit, they've gathered them together into a single document and they've clearly been engaged in understanding what people are worried about. It's just that they've concluded the concerns aren't that big a deal or can be dealt with to their satisfaction."

That Single Document is here, and I went and had a read this morning, but now I get permission denied, I guess it was getting too much attention?

https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj...

I wish I would've save a copy now. It hand some decent details on the various vulnerabilities and how they are handling (or ignoring) them.

Re: Chrome deploys deep-linking in latest build despite privacy concerns

#38

Post by phillipseamore »

blakesterz wrote: post #36

EDITED and hour later: A couple of people have pointed out it's back, they've made some changes and marked it as public now. There was another article on this same topic this morning with this: "Google's engineers have not ignored worries about the security and privacy risks. To their credit, they've gathered them together into a single document and they've clearly been engaged in understanding what people are worrie…

It was actively being destroyed when I checked it.
Post reply on HN