All this fuss should have been about lazy loading of resources. The leak is there
Chrome deploys deep-linking in latest build despite privacy concerns
151–159 of 159 posts
Re: Chrome deploys deep-linking in latest build despite privacy concerns
#152Can somebody explain to me how is this more of a privacy concern than the rest of the url, often containing the title sluf, date, id, tags and/or filter parameter of the page ?
Re: Chrome deploys deep-linking in latest build despite privacy concerns
#153The example that the security researcher gave seems moot: the same thing would happen if the employee simply scrolled down on the page manually, no? And we already have the ability to link to anchors on a page, and that's not considered to be a privacy issue. Can someone explain how this is actually a meaningful privacy issue?
Example from above:
Twitter.com/#:~:@user
This would behave differently if the browser's user is following @user than otherwise.
This convinced me not to dismiss the issue. I'm not sure how that leaks over a side channel. But i am sure there are governments who take active measures to shape the Internet to their liking - and twitter has played a significant role in the past inside countries governed by them to oppose these governments.
Re: Chrome deploys deep-linking in latest build despite privacy concerns
#154The article says the folks at Google have this short docs to address the concerns: Scroll-to-text Fragment Navigation - Security Issues https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj...
The doc addresses some concerns, but leaves what I think is the biggest issue (disclosure of information on a page, e.g. "send user to URL that searches gmail for from:hiring@snap.com; look for 'No emails are found'") completely unaddressed.
Re: Chrome deploys deep-linking in latest build despite privacy concerns
#155Earlier quoted context omitted.
>I'd like to call myself a privacy advocate, but this is just absurd. Yeah, my read of this is that it has nothing to do with privacy, people who want to block change for some reason have just learned that "i have privacy concerns about google" is a catchword that will get you some press coverage, and are essentially hijacking the actually valid and important privacy concerns to push forward their unrelated opinions…
This is my take on this, too. As a FF user, I'd love to see FF implement this too!
FF is considering implementing something in this space, yes. Note that there are at least two proposals for how this could work: one that is already deployed via a polyfill on various sites and the Google one. They have various functionality tradeoffs, and unfortunately Google decided to make up a wholly new thing instead of improving the existing thing...
Re: Chrome deploys deep-linking in latest build despite privacy concerns
#156Last week I switched to Firefox nightly on desktop and Firefox preview on mobile.
It took some configuration, but I'm not regretting it at all.
Re: Chrome deploys deep-linking in latest build despite privacy concerns
#157They should have used XPointer instead of reinventing the wheel. It has a much more effective syntax.
Re: Chrome deploys deep-linking in latest build despite privacy concerns
#158Earlier quoted context omitted.
Yeah, looks like I read it too quickly. But wow, what an absurd amount of work to almost find something out when you already have access to the entire network, and apparently the WiFi is not secured at all or your targets are all plugged in and on your switch. This is like complaining about a weak combination on a padlock used to secure your screen door.
It sounds like the feature's enabled across all websites - so it could break security & privacy expectations a user has about existing web pages. It requires that the attacker has DNS request visibility and expects that a user will visit a vulnerable page - not necessarily huge barriers to entry. This could be exploited by targeting a user with an advert that appears in the footer of a webpage, for example, and then…
But couldn't you now just buy an ad, send them to ihavecancer.example.com and find that in the DNS logs later? You don't even have to own the domain. You could use that exact one and then just find the failed resolution in the logs.
Re: Chrome deploys deep-linking in latest build despite privacy concerns
#159Earlier quoted context omitted.
One difference is that today's page anchors are only put there by the page author, so, since all authors are cracker-jack security experts, they would not have made an anchor available in such a sensitive part of the document, since it opens their readers up to this risk. As you can tell, I think that the difference is a real, technically true difference, but the implication is a bit dumb, since authors do not have t…
> One difference is that today's page anchors are only put there by the page author, AFAIK we can link to any id in the page, not only to anchors. Strictly speaking you're still right because the author creates those ids but some of them are automatically created by frontend or backend frameworks.
That's true, though I often forget it. But surely those cracker-jack security expert HTML writers don't forget! Or use such privacy insensitive tools as the ones you've mentioned.