3 ms·

> I'm sure there are some security/privacy implications that would need to be worked through, but they don't seem insurmountable? It can't be worse than letting

> I'm sure there are some security/privacy implications that would need to be worked through, but they don't seem insurmountable? It can't be worse than letting websites show fake URLs... Prefetching cross-domain means that now anyone who loads google.com has the potential to also ping mywebsite.com/trackingendpoint, which is a resource that you have to cache. So I get some information, likely less than if you actually execute the page, but still enough to be worrisome. > It can't be worse than letting websites show fake URLs... I really don't get this complaint. I can absolutely understand the unease people have about "fake urls" but a lot of urls already lie. How many are really cloudflare or aws? It's completely possible I'm missing something, but as far as I can tell, signed http exchanges are more secure than a CDN, since they're signed. I guess that potentially since I, a nefarious person, can re-host your signed content, there might be data leakage possible there, but given that AMP is mostly static, I think that's mostly mitigated. Could be wrong here, I'm not a security (or AMP) expert, but I don't get the fear.

Wowfunhappy 8y ago
> Prefetching cross-domain means that now anyone who loads google.com has the potential to also ping mywebsite.com/trackingendpoint. Sorry, I'm not suggesting prefetching cross-domain. I know for a fact this works already, as I've done it. I'm suggesting that one domain should be able to load assets cached by another domain. They can check the hash to ensure it's the correct, unmodified asset.
- joshuamorton 8y ago
  I had a longer reply to this but lost it. There's some significant security concerns with this (I start claiming to cache the pornhub css file), it's not at all clear how it works when you have other caches (if Bing refers me, how do I decide to use bings cached version of my asset vs Google's). I guess you might mean that google can cache something as my site, but I'm pretty sure that would also allow me to maliciously overwrite Google's js in your cache. And it still has the latency issues: to connect to your site I now have to establish an initial https connection and load the main html page. That's significantly more than 0 latency.
  - Wowfunhappy 8y ago
    Shouldn't storing and checking a hash solve most of the security problems? That way, you know the asset hasn't changed at all. It doesn't matter if there's multiple caches because unless you've managed to break sha256, they should all be the same file. The actual html can also be cached, which should make it zero latency. However, I am realizing now that I'm not sure where the checksum gets stored... (I'll readily admit this was a spur-of-the-moment idea that I haven't actually thought through intensively.)

Wowfunhappy 8y ago

> Prefetching cross-domain means that now anyone who loads google.com has the potential to also ping mywebsite.com/trackingendpoint. Sorry, I'm not suggesting prefetching cross-domain. I know for a fact this works already, as I've done it. I'm suggesting that one domain should be able to load assets cached by another domain. They can check the hash to ensure it's the correct, unmodified asset.

joshuamorton 8y ago
I had a longer reply to this but lost it. There's some significant security concerns with this (I start claiming to cache the pornhub css file), it's not at all clear how it works when you have other caches (if Bing refers me, how do I decide to use bings cached version of my asset vs Google's). I guess you might mean that google can cache something as my site, but I'm pretty sure that would also allow me to maliciously overwrite Google's js in your cache. And it still has the latency issues: to connect to your site I now have to establish an initial https connection and load the main html page. That's significantly more than 0 latency.
- Wowfunhappy 8y ago
  Shouldn't storing and checking a hash solve most of the security problems? That way, you know the asset hasn't changed at all. It doesn't matter if there's multiple caches because unless you've managed to break sha256, they should all be the same file. The actual html can also be cached, which should make it zero latency. However, I am realizing now that I'm not sure where the checksum gets stored... (I'll readily admit this was a spur-of-the-moment idea that I haven't actually thought through intensively.)