Hacker News new | past | comments | ask | show | jobs | submit login

> What is stopping, legally, them from taking e.g. HTTP Headers from independent connections and linking them together through fingerprinting?

Setting aside legality, the attack you're describing will be thwarted by network state partitioning: https://www.chromestatus.com/feature/6713488334389248




Am I missing something, or does this not address the fact that https://whatsmybrowser.info/ will always yield the same thing whether a connection is made to GA, Firebase, YouTube or Blogger? That seems to have to do with connection timing and caching, not with what the connection itself leaks.


I thought the parent was talking about using information about the network connection to link users across sites hosted by the same entity?

If you're talking about fingerprinting in general, that is also something that all the browsers are working on. I'm most familiar with Chrome's strategy, which is to first switch APIs that provide a lot of entropy from something you get by default to something you have to actively request, figure out how to provide similar functionality more privately, and then enforce a privacy budget that does not allow collecting enough information to identify users: https://www.chromium.org/Home/chromium-privacy/privacy-sandb...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: