Paresh DaveOvjeren akaunt

This is a bigger problem than Safari's ITP introducing far more serious privacy vulnerabilities than the kinds of tracking that it's supposed to mitigate. The cross-site search and related side-channels it exposes are also abusable security vulnerabilities.https://twitter.com/lukOlejnik/status/1219873289230856198 …

To add some context, Chrome's XSS Auditor was found to introduce exactly the same class of side-channel vulnerabilities. After several back and forths with the team that discovered the issue, we determined that it was inherent to the design and had to remove the code.

I have no idea what Apple plans to do about this, because it's been a defining theme in their anti-tracking approach (and one of our major concerns). They attempt to mitigate tracking by adding state mechanisms, but adding state often introduces worse privacy/security issues.