Earlier today we published the details of a set of vulnerabilities in Safari's Intelligent Tracking Prevention privacy mechanism: https://arxiv.org/abs/2001.07421 . They are... interesting. [1/9]
@kkotowicz @empijei @we1x
Prikaži ovu nit
-
The second problem is that when the browser uses this model to change its behavior (e.g removes cookies or the `Referer' header from some requests), its underlying data gets exposed to any website (How, you ask? -> Section 1.2.1) [4/9]
Prikaži ovu nit
What you end up with is a personalized anti-tracking model baked into your browser. That model is not only a unique identifier, but also reveals information about sites you visited since last clearing browsing state. That's not great. [5/9]
-
-
As far as mitigations go, there are definitely useful things the browser can do to address such leaks (and Safari has done them: https://webkit.org/blog/9661/preventing-tracking-prevention-tracking/ …). But completely fixing this is hard. [6/9]
Prikaži ovu nit -
There is an important and somewhat unexpected lesson in all of this. It's that if you alter browser behavior based on locally gathered data, then if your changes have web-observable consequences, you're going to have a bad time. [7/9]
Prikaži ovu nit -
This is a concern not just for Safari and ITP, but for all other anti-tracking proposals. For example, Chrome's Privacy Budget idea will have to grapple with the same kinds of issues as it develops. [8/9]
Prikaži ovu nit -
One last thing: it's clear that Apple is trying to do the right thing and the WebKit folks we've interacted with care deeply about privacy. We hope that these results will help Safari & guide other browser vendors in the long run. [fin]
Prikaži ovu nit
Kraj razgovora
Novi razgovor -
-
-
Maybe they can/will get rid of the personalized tracker list once they block all third-party cookies. https://bugs.webkit.org/show_bug.cgi?id=203266 … Maybe not. https://bugs.webkit.org/show_bug.cgi?id=203432 … "Expose basic ITP data from the database for future API/SPI use. " "Safari ITP UI or any other potential clients."
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
But surely it’s better to use a browser like Safari that is actively trying to stop companies like Google tracking you , than use Chrome that actively tracks everything you do?
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.