4 ms·

It can be used to track users across domains to some degree.

by dathinab 6y ago

mmcwilliams 6y ago
Not to be dense but wasn't that always the purpose of running a CDN service for common scripts and libraries?
- daveFNbuck 6y ago
  The script wouldn't have to be from a CDN to track people using the browser cache. I could infer whether you've visited a site that doesn't use CDNs or trackers by asking you to load something from that site and inferring whether you have that resource cached by the time it took you to load it.
  - mmcwilliams 6y ago
    This is true, but if you're running a CDN you have access to cross-domain user information just based on the headers, no?
    - daveoc64 6y ago
      The CDN is not the place you have to worried about. If Site A loads a specific JavaScript file for users with an administrator account, Site B can check to see if the JavaScript file is in your cache, and infer that you must have an administrator account if the file is there. The attack can happen with different types of resources (such as images).
      - mmcwilliams 6y ago
        This I understand, the risk of third-parties monitoring. The attacks are pretty obvious. My confusion is over what the business model of a commercial CDN is if not to track users across multiple sites? How do they pay for bandwidth?
- dathinab 6y ago
  The problem is not the CDN (or arbitrary shared source domain) being able to track you but the sites which use the CDN. Furthermore a CDN can't track you as simple as you might think, it often would require thinks which need explicitly opt-in agreements on a per website basis to be legal. Furthermore due to technical limitations you can only get that permission from the user after the CDN was already used. CDNs can still track aggregated information to some degree but they can't legally act like a tracker cookie.
GordonS 6y ago
Thanks, I understand the issue now - I haven't thought about CDNs from a privacy perspective before. I suppose with HTTP2 some of the benefits of serving JS through CDNs are gone anyway, so I guess it's time to stop using them.
amelius 6y ago
How serious is this type of threat? Compared to all the info about us that is already shared by data brokers?
- ev1 6y ago
  There are several data-broker-esque "services" that actually do this already with FB, Google, etc assets (favicon.ico and similar, loggedIn urls, ...) to check whether you have visited those pages, or whether you are logged in to those services by trying to request a URL that might return a large image if logged in, or fail rapidly if logged out. -- This has been a thing for a long time: https://news.ycombinator.com/item?id=15499917 https://news.ycombinator.com/item?id=15499917 If you don't use any of those sites, you're considered higher risk/fraudulent user/bot. Here's an example of a very short and easy way to see if someone is probably gay: https://pastebin.com/raw/CFaTet0K https://pastebin.com/raw/CFaTet0K On chrome, I consistently get 1-5 back after it's been cached, and 100+ on a clean visit. On Firefox with resistFingerprinting, I get 0 always.
  - amelius 6y ago
    Thank you, that was insightful. > Here's an example of a very short and easy way to see if someone is probably gay Ok, but now the resource is in my cache, so from now on they will think I'm gay?
    - tzot 6y ago
      You could have run this on a private window of the browser (and in that case, they would surely think you're a closeted gay).
    - ev1 6y ago
      > Ok, but now the resource is in my cache, so from now on they will think I'm gay? This resource is just generic, so probably not, but if you actually visited grindr's site without adblocking heavily, they load googletagmanager and a significant number of other tracking services, which will almost certainly associate your advertising profile and identifiers as 'gay' I also can't believe they send/sell your information to 3 pages worth of third party monetization providers/adtech companies for something that is this critically sensitive.

It can be used to track users across domains to some degree.

mmcwilliams 6y ago

Not to be dense but wasn't that always the purpose of running a CDN service for common scripts and libraries?

daveFNbuck 6y ago
The script wouldn't have to be from a CDN to track people using the browser cache. I could infer whether you've visited a site that doesn't use CDNs or trackers by asking you to load something from that site and inferring whether you have that resource cached by the time it took you to load it.
- mmcwilliams 6y ago
  This is true, but if you're running a CDN you have access to cross-domain user information just based on the headers, no?
  - daveoc64 6y ago
    The CDN is not the place you have to worried about. If Site A loads a specific JavaScript file for users with an administrator account, Site B can check to see if the JavaScript file is in your cache, and infer that you must have an administrator account if the file is there. The attack can happen with different types of resources (such as images).
    - mmcwilliams 6y ago
      This I understand, the risk of third-parties monitoring. The attacks are pretty obvious. My confusion is over what the business model of a commercial CDN is if not to track users across multiple sites? How do they pay for bandwidth?
dathinab 6y ago
The problem is not the CDN (or arbitrary shared source domain) being able to track you but the sites which use the CDN. Furthermore a CDN can't track you as simple as you might think, it often would require thinks which need explicitly opt-in agreements on a per website basis to be legal. Furthermore due to technical limitations you can only get that permission from the user after the CDN was already used. CDNs can still track aggregated information to some degree but they can't legally act like a tracker cookie.

GordonS 6y ago

Thanks, I understand the issue now - I haven't thought about CDNs from a privacy perspective before. I suppose with HTTP2 some of the benefits of serving JS through CDNs are gone anyway, so I guess it's time to stop using them.

amelius 6y ago

How serious is this type of threat? Compared to all the info about us that is already shared by data brokers?

ev1 6y ago
There are several data-broker-esque "services" that actually do this already with FB, Google, etc assets (favicon.ico and similar, loggedIn urls, ...) to check whether you have visited those pages, or whether you are logged in to those services by trying to request a URL that might return a large image if logged in, or fail rapidly if logged out. -- This has been a thing for a long time: https://news.ycombinator.com/item?id=15499917 https://news.ycombinator.com/item?id=15499917 If you don't use any of those sites, you're considered higher risk/fraudulent user/bot. Here's an example of a very short and easy way to see if someone is probably gay: https://pastebin.com/raw/CFaTet0K https://pastebin.com/raw/CFaTet0K On chrome, I consistently get 1-5 back after it's been cached, and 100+ on a clean visit. On Firefox with resistFingerprinting, I get 0 always.
- amelius 6y ago
  Thank you, that was insightful. > Here's an example of a very short and easy way to see if someone is probably gay Ok, but now the resource is in my cache, so from now on they will think I'm gay?
  - tzot 6y ago
    You could have run this on a private window of the browser (and in that case, they would surely think you're a closeted gay).
  - ev1 6y ago
    > Ok, but now the resource is in my cache, so from now on they will think I'm gay? This resource is just generic, so probably not, but if you actually visited grindr's site without adblocking heavily, they load googletagmanager and a significant number of other tracking services, which will almost certainly associate your advertising profile and identifiers as 'gay' I also can't believe they send/sell your information to 3 pages worth of third party monetization providers/adtech companies for something that is this critically sensitive.