4 ms·

Interesting that you mention the privacy risk of tracking, as this[0] just appeared in my Twitter feed at about the same time I was reading HN. "Tracking Users

Interesting that you mention the privacy risk of tracking, as this[0] just appeared in my Twitter feed at about the same time I was reading HN. "Tracking Users across the Web via TLS Session Resumption"[1]. A snippet from the abstract: "Our results indicate that with the standard setting of the session resumption lifetime in many current browsers, the average user can be tracked for up to eight days. With a session resumption lifetime of seven days, as recommended upper limit in the draft for TLS version 1.3, 65% of all users in our dataset can be tracked permanently." Not exactly looking forward to TLS1.3, it appears to be a move forward in security but with no (or worse) privacy benefits that I've seen so far. [0]https://twitter.com/durumcrustulum/status/1052936324024557570 https://twitter.com/durumcrustulum/status/105293632402455757... [1]http://front.math.ucdavis.edu/1810.07304 http://front.math.ucdavis.edu/1810.07304

kardos 8y ago
> with the standard setting of the session resumption lifetime in many current browsers > seven days, as recommended upper limit Do we fix this by changing that setting to a few hours? Edit: the report discusses this: "The recommended upper limit of the session resumption lifetime in TLS 1.3 [19] of seven days should be reduced to hinder tracking based on this mechanism. We propose an upper lifetime limit of ten minutes based on our empirical observations"
- yborg 8y ago
  Is this a configurable option in Firefox?
phaer 8y ago
The links to the full paper in your second link led me to a 404 page. Found it here: https://svs.informatik.uni-hamburg.de/publications/2018/2018-12-06-Sy-ACSAC-Tracking_Users_across_the_Web_via_TLS_Session_Resumption.pdf https://svs.informatik.uni-hamburg.de/publications/2018/2018... looks interesting, thanks!