3 ms·

> extras.example.net is still third-party to awesome.example.org Yes, that's right. I'm making the assumption that letting the request succeed at all is on th

> extras.example.net is still third-party to awesome.example.org Yes, that's right. I'm making the assumption that letting the request succeed at all is on the losing side of the battle. For me, I know I'm 100% trackable across the internet with my IP address (it hasn't changed in 2 years) and my screen resolution (the only 4k monitors behind that IP). If I don't block the request in the first place, the tracking company fingerprints my browser and sets that as a cookie. The reason I say we're completely screwed is that I think we'll see all kinds of dirty tricks. Ex: auth = ads under the header and auth.example.net is actually a tracking domain. That's much harder to prevent than sending ads.example.com to a black hole.

thrwwy0304 6y ago
Agreed - letting the request fire at all is the critical point, and I believe that's the true motivation behind using CNAMEs (they evade blacklists). CNAMEs and first-party cookie access aren't helping networks link identities across sites in Firefox and Safari - at this point they're stuck relying on browser fingerprinting. And as you point out, fingerprinting can be quite effective, especially for people on static IPs :| This paper is claiming that CNAMEs are evading the protections offered by Safari and Firefox but that's just not the case. Or at least, the paper hasn't explained how.