3 ms·
This sentence from the doc referenced sums it up well I think: > A naive implementation of this feature may allow an attacker to determine the existence of tex
by femto113 7y ago
This sentence from the doc referenced sums it up well I think:
> A naive implementation of this feature may allow an attacker to determine the existence of textual content across an origin boundary.
Security & privacy implications of that seem obvious, e.g. extracting an account number (or other sensitive information) from a page by searching for successive prefixes.
- maxrmk 7y agoJust to clarify, I do think there are real privacy concerns with a naive implement of this feature. Allowing sites to search across origin boundaries would be a huge issue! I just don't think that the DNS query issue mentioned in the article is the thing to be worried about. It's just so much less severe than the fact that DNS isn't encrypted, and requires essentially the same fix.