31–40 of 87 posts
In this case, it may be able to figure out that favicons are disabled (if the implementation is written to support that), but not more than that.
This is a neat approach, but I'm not sure I'd expect it to be used in the wild. ~32 consecutive document redirects every time you want to fingerprint a browser would be slow: twelve (?) redirects on my (~fast) internet takes about ten seconds. On 3g, I could imagine this taking much longer. You'd also likely need to do this at the (root) page level (i.e., it wouldn't work inside an iframe, since iframes don't have fa…
> About me. I am a twenty year old student from 🇩🇪 Germany Impressive! Come work with me :) can’t wait to see what you do by the time you’re 30.
This is a neat approach, but I'm not sure I'd expect it to be used in the wild. ~32 consecutive document redirects every time you want to fingerprint a browser would be slow: twelve (?) redirects on my (~fast) internet takes about ten seconds. On 3g, I could imagine this taking much longer. You'd also likely need to do this at the (root) page level (i.e., it wouldn't work inside an iframe, since iframes don't have fa…
I think you could also run this on an iframe embedded in a page
Some users (including myself) disable favicons, since I don't use favicons. (I disabled it when I set up the computer, far before I heard anything about favicon supercookies.) In this case, it may be able to figure out that favicons are disabled (if the implementation is written to support that), but not more than that.
This is a neat approach, but I'm not sure I'd expect it to be used in the wild. ~32 consecutive document redirects every time you want to fingerprint a browser would be slow: twelve (?) redirects on my (~fast) internet takes about ten seconds. On 3g, I could imagine this taking much longer. You'd also likely need to do this at the (root) page level (i.e., it wouldn't work inside an iframe, since iframes don't have fa…
Earlier quoted context omitted.
I think you could also run this on an iframe embedded in a page
What is your response to parent's comment that "it wouldn't work inside an iframe, since iframes don't have favicons"?
Earlier quoted context omitted.
It may have been their intention, after reading the bugzilla report they made[1]. > I also think that it would have been appropriate to notify about the ulterior motive behind this defect report at the latest when the paper got published. This underhanded approach of reporting a defect just leaves a bad taste, really. The behavior may be an actual defect in the classical sense, but I'm just wondering what would have…
Honestly, this is a big deal here. A "security researcher" attempted to _introduce new vulnerabilities_ into a major open source project just so that they could report these vulnerabilities later. How scammy can research get?