3 ms·

This is a handful of GET requests for images. You would need a page to fingerprint. The site could get an IP, likely the user agent. Safe browsing requests are

This is a handful of GET requests for images. You would need a page to fingerprint. The site could get an IP, likely the user agent. Safe browsing requests are sandboxed from all the other Google cookies.

scottw 11y ago
You sure those are images? All we know for certain is that those are GET requests.
- girvo 11y ago
  I'd be willing to bet that Firefox would treat them as such, even if they returned something different. Still, those favicons should be bundled instead of making requests, IMO.
- bmelton 11y ago
  Because we can see the sum of the requests, I think it's safe to say that they are probably just images. There's nothing to stop, say, ebay from serving PHP scripts on ICO extension, processing the request as a pageload and then ultimately returning the icon file, but for anything useful to have been gleaned, it would have generated more requests. Either it did generate more requests and Mozilla didn't honor them (in which case, yay), or it didn't generate more requests (in which case, yay). The former would be slightly preferred as the latter doesn't prevent ebay from later changing their strategy.
takeda 11y ago
Geez did you guys even look at the URLs? https://safebrowsing.google.com/safebrowsing/downloads?client=Iceweasel&appver=38.1.0&pver=2.2&key=no-google-api-key https://safebrowsing.google.com/safebrowsing/downloads?clien... Isn't the API key your fingerprint? The key is not shown here, because the author was showing what the requests look like on first run, subsequent requests would contain your unique ID in them. Not picking on you specifically, I saw several responses saying the same thing.
- magicalist 11y ago
  > Isn't the API key your fingerprint? No, it's a per-application key, so in this case it would be IceWeasel's key.
  - takeda 11y ago
    In that case why would it make a request with "key=no-google-api-key" then why not use the IceWeasel key right from the start?
    - magicalist 11y ago
      No clue, but it's not like we have to guess about what it is. It's all covered in the Safe Browsing docs: https://developers.google.com/safe-browsing/lookup_guide#GettingStarted https://developers.google.com/safe-browsing/lookup_guide#Get...

scottw 11y ago

You sure those are images? All we know for certain is that those are GET requests.

girvo 11y ago
I'd be willing to bet that Firefox would treat them as such, even if they returned something different. Still, those favicons should be bundled instead of making requests, IMO.
bmelton 11y ago
Because we can see the sum of the requests, I think it's safe to say that they are probably just images. There's nothing to stop, say, ebay from serving PHP scripts on ICO extension, processing the request as a pageload and then ultimately returning the icon file, but for anything useful to have been gleaned, it would have generated more requests. Either it did generate more requests and Mozilla didn't honor them (in which case, yay), or it didn't generate more requests (in which case, yay). The former would be slightly preferred as the latter doesn't prevent ebay from later changing their strategy.

takeda 11y ago

Geez did you guys even look at the URLs? https://safebrowsing.google.com/safebrowsing/downloads?client=Iceweasel&appver=38.1.0&pver=2.2&key=no-google-api-key https://safebrowsing.google.com/safebrowsing/downloads?clien... Isn't the API key your fingerprint? The key is not shown here, because the author was showing what the requests look like on first run, subsequent requests would contain your unique ID in them. Not picking on you specifically, I saw several responses saying the same thing.

magicalist 11y ago
> Isn't the API key your fingerprint? No, it's a per-application key, so in this case it would be IceWeasel's key.
- takeda 11y ago
  In that case why would it make a request with "key=no-google-api-key" then why not use the IceWeasel key right from the start?
  - magicalist 11y ago
    No clue, but it's not like we have to guess about what it is. It's all covered in the Safe Browsing docs: https://developers.google.com/safe-browsing/lookup_guide#GettingStarted https://developers.google.com/safe-browsing/lookup_guide#Get...