4 ms·
True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams. Heck,
by JohnTHaller 12y ago
True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams. Heck, you may even be able to hijack a website login using it.
- julianj 12y agosomething like this? https://github.com/lightswitch05/Bogus_X-UIDH https://github.com/lightswitch05/Bogus_X-UIDH
- JohnTHaller 12y agoExactly. But instead of using it to try to change your UIDH within Verizon, it should encourage non-Verizon customers to just pollute the space with random UIDH values from all over the place.
- nl 12y agoAnd (as I previously noted) all Verizon has to do is *check the IP address of the client(!). They know the IPs they own. Assuming that your adversary is dumb as well as malicious is a mistake.
- julianj 12y agoTrue, but this header is presented to all sites visited. This wouldn't pollute Verizon's tracking (they could do this without the header). This may instead pollute the third parties which are taking advantage.
- hwysft 12y agoSadly it'd probably be quite easy for Turn to ignore headers like those coming from non-Verizon IP space
- JadeNB 12y ago> True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams. nl (https://news.ycombinator.com/item?id=8890677 https://news.ycombinator.com/item?id=8890677) addressed this: > If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.