5 ms·
Google could still uniquely identify sites while protecting your privacy by sending a hash of the URL from your browser, rather than the full URL itself, and co
by roryokane 15y ago
Google could still uniquely identify sites while protecting your privacy by sending a hash of the URL from your browser, rather than the full URL itself, and comparing that hash to the hashes of all +1ed sites. People are talking about tracking because Google hasn’t chosen to implement their extension like this.
- arebop 15y agoWould the hash scheme you have in mind be vulnerable to rainbow tables?
- eneveu 15y agoA problem with sending a hash of the URL, is that you cannot canonicalize the URL on the server side anymore. A simple example: the hash of "http://www.foo.com/bar/ http://www.foo.com/bar/ would differ from the hash of "http://www.foo.com/bar http://www.foo.com/bar. I guess you could do some canonicalization on the client-side, though...
- esrauch 15y agoI don't really understand how you imagine it to work. You want them to just have a huge dumb store of hash -> count mappings without them having any meaning? That would completely defeat the purpose of +1s, they couldn't put what +1s you had on your profile or use it for recommendations or whatever. Even if this was the case, it would be trivially easy for them to get the hash -> url mappings at any time since they already effectively crawl the entire internet or a daily or weekly basis, all they would have to do is add a single entry to the pipeline. If you are saying that they should have a database where the columns are (url, hash, count) and just have the browser send the hash, that is exactly the same as just encrypting the url, and the request is being sent of https. What sort of security do you think you would have from hashing that is lacking in SSL?