4 ms·
That would be a super-cookie though.
by RL_Quine 6y ago
That would be a super-cookie though.
- lucb1e 6y agoHow would specifying what content the library should have (to preserve integrity) lead to tracking?
- im3w1l 6y agoCaching across sites at all means you can see if it loads quickly or slowly to make inferences. Non-obvious tradeoff imo.
- XCSme 6y agoIt's not about how fast it loads, it about whether it actually requests the file from the server or not. See my comment above, if you have "x.js" in your cache and it's your first time on this site, it means that you previously visited another site that contains "x.js".
- im3w1l 6y agoIn cache - high speed, fetch from server - low speed. Isn't that how you detect it?
- XCSme 6y agoThe problem is not that you can detect it on the client,but you can also see it on the server. On the server you see that user requested the HTML for the page and other resources, but never requested X.js. You could keep a count of requests, per user per file.
- shakna 6y agoA number of problems surface [0]. Starting with timing leaks. > The first difficulty of implementing cross-origin, content addressable caching on the Web platform is that it may leak information about the user’s past browsing. For example, site "A" could load a script with a given hash, then later when the user visits site "B", it could attempt to observe the time it takes to load that same resource and infer whether the user had previously been at "A". [0] https://hillbrad.github.io/sri-addressable-caching/sri-addressable-caching.html https://hillbrad.github.io/sri-addressable-caching/sri-addre...