5 ms·

What? A DNS lookup doesn't include anything but the hostname and anything following a hash is never sent with a request from the browser.

Proven 7y ago
https://www.theregister.co.uk/2020/02/20/chrome_deploys_deeplinking/ https://www.theregister.co.uk/2020/02/20/chrome_deploys_deep...
thedance 7y ago
It seems that “privacy researcher at brave” is a job requiring no domain knowledge, only plentiful contact with credulous journalists.
- drusepth 7y ago
  I don't want to derail this thread, but that's kind of Brave's whole MO. They pretty much constantly put out or source anti-Google content; there's often a grain of truth somewhere in many of them, but not always and rarely reported honestly.
cmg 7y ago
I think the idea there is that there would be lazy-loaded content from another site that would only load when someone scrolled far enough to see the highlighted word, which will automatically happen with this feature. The title of the Forbes article is too hyperbolic for my tastes and while this could be a security concern in very specific situations it's being overblown.
- phillipseamore 7y ago
  I think that would need to be a designed attack, not something that would apply to 99% of websites. The only legitimate resource (that could be used as a canary) being loaded far down a page would be an image (and that kind of requires it to be lazy loading as well).
  - merrywhether 7y ago
    Latest Chrome defers out-of-viewport images on its own, or at least tries to.
jstewartmobile 7y ago
As you broaden your domains of expertise, it becomes increasingly clear that most news media is astroturf.
dredmorbius 7y ago
This Google Doc (posted earlier in this thread) seems to desribe possible attack vectors far more clearly than either the Forbes or Register articles (second being better than the first as well): https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj2gkwCq8_5xwIae7PVik/mobilebasic#heading=h.uoiwg23pt0tx https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj...
jiqiren 7y ago
I just give a unique key to each user. That user does a lookup of key-<scroll-position>.tracking.example.com when they get to that part of the page. As they scroll I gather data via dns. Source: was my job to track people and what they do.

Proven 7y ago

https://www.theregister.co.uk/2020/02/20/chrome_deploys_deeplinking/ https://www.theregister.co.uk/2020/02/20/chrome_deploys_deep...

thedance 7y ago

It seems that “privacy researcher at brave” is a job requiring no domain knowledge, only plentiful contact with credulous journalists.

drusepth 7y ago
I don't want to derail this thread, but that's kind of Brave's whole MO. They pretty much constantly put out or source anti-Google content; there's often a grain of truth somewhere in many of them, but not always and rarely reported honestly.

cmg 7y ago

I think the idea there is that there would be lazy-loaded content from another site that would only load when someone scrolled far enough to see the highlighted word, which will automatically happen with this feature. The title of the Forbes article is too hyperbolic for my tastes and while this could be a security concern in very specific situations it's being overblown.

phillipseamore 7y ago
I think that would need to be a designed attack, not something that would apply to 99% of websites. The only legitimate resource (that could be used as a canary) being loaded far down a page would be an image (and that kind of requires it to be lazy loading as well).
- merrywhether 7y ago
  Latest Chrome defers out-of-viewport images on its own, or at least tries to.

jstewartmobile 7y ago

As you broaden your domains of expertise, it becomes increasingly clear that most news media is astroturf.

dredmorbius 7y ago

This Google Doc (posted earlier in this thread) seems to desribe possible attack vectors far more clearly than either the Forbes or Register articles (second being better than the first as well): https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj2gkwCq8_5xwIae7PVik/mobilebasic#heading=h.uoiwg23pt0tx https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj...

jiqiren 7y ago

I just give a unique key to each user. That user does a lookup of key-<scroll-position>.tracking.example.com when they get to that part of the page. As they scroll I gather data via dns. Source: was my job to track people and what they do.