3 ms·
Isn't the real point that one should not be able to obtain that much information simply by knowing some user id or user name? I would guess plenty of services
by jo909 11y ago
Isn't the real point that one should not be able to obtain that much information simply by knowing some user id or user name?
I would guess plenty of services include the username in some URLs.
Edit: of course the autor also stated that, but more as a side note. Leaking the CID would not be a problem if there wasn't any futher information to be gained.
- pdkl95 11y agoIt is well known that unique identifiers are used to identify general internet traffic as the host moves to different IPs. This works even when the intended meaning of that identifier isn't known. https://www.eff.org/deeplinks/2013/12/nsa-turns-cookies-and-more-surveillance-beacons https://www.eff.org/deeplinks/2013/12/nsa-turns-cookies-and-...
- jo909 11y agoFair argument that every unique id or name makes you trackable, but that is a much bigger (and IMHO long lost) battle on so many fronts, and it does not seem very fair to single out Microsoft here. And I don't think that is the motivation of the author either.
- pdkl95 11y agoI'm absolutely not singling out Microsoft, and I'm not sure why you would think I was. Anybody that is regularly putting a unique identifier in plaintext network traffic is harming their users, and that goes for Microsoft embedding CIDs in dommain names, Verizon with their X-UIDH vandalism, Google's 3rd-party tracking cookies, and the like similar. Also, you will never win a war if you give up the fight. This battle is absolutely not "long lost". The only way that could be true is if you give up, thereby self-fulfilling the prediction.