Here's the arxiv paper this article is reporting on, it's a short 6 page read: https://arxiv.org/pdf/2001.07421.pdf https://arxiv.org/pdf/2001.07421.pdf Basic

Here's the arxiv paper this article is reporting on, it's a short 6 page read: https://arxiv.org/pdf/2001.07421.pdf https://arxiv.org/pdf/2001.07421.pdf Basically Safari keeps track of which domains are being requested in a 3rd party context (i.e. I load example.com in my browser and the page loads the facebook sdk - Safari increments a counter for facebook by 1). Once a given domain reaches 3 hits, Safari will strip cookies and some other data in 3rd party requests to that domain. The problem is that advertisers can use this to fingerprint users: register arbitrary domains, make 3rd party requests to them, and detect whether or not that request is having data stripped. Each domain is an additional "bit" of data. This is similar to "HSTS Cookies" [1] and also to issues with Chrome's XSS auditor, which is why it was removed [2]. [1]: https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-browser-dilemma-how-hsts-supercookies-make-you-choose-between-privacy-or-security/ https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro... [2]: https://twitter.com/justinschuh/status/1220021377064849410 https://twitter.com/justinschuh/status/1220021377064849410