TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Information Leaks via Safari’s Intelligent Tracking Prevention

151 pointsby GuardLlamaover 5 years ago

8 comments

om2over 5 years ago
We&#x27;ve addressed the issues disclosed to us, and if you try any of the 5 POCs in the paper you will find they no longer work in the latest Safari. Details of the fixes here: <a href="https:&#x2F;&#x2F;webkit.org&#x2F;blog&#x2F;9661&#x2F;preventing-tracking-prevention-tracking&#x2F;" rel="nofollow">https:&#x2F;&#x2F;webkit.org&#x2F;blog&#x2F;9661&#x2F;preventing-tracking-prevention-...</a><p>There may be room for more improvement here but be aware what the POCs illustrate is not an active vulnerability any more.<p>In addition, we don&#x27;t believe this channel was ever exploited in the wild.<p>(If anyone is aware of other issues in this area, I encourage you to practice responsible disclosure and report to Apple or to the WebKit project.)
评论 #22124777 未加载
评论 #22124125 未加载
arkadiytover 5 years ago
Reposting from the other [1] thread:<p>Basically Safari keeps track of which domains are being requested in a 3rd party context (i.e. I load example.com in my browser and the page loads the facebook sdk - Safari increments a counter for facebook by 1). Once a given domain reaches 3 hits, Safari will strip cookies and some other data in 3rd party requests to that domain.<p>The problem is that advertisers can use this to fingerprint users: register arbitrary domains, make 3rd party requests to them, and detect whether or not that request is having data stripped. Each domain is an additional &quot;bit&quot; of data.<p>This is similar to &quot;HSTS Cookies&quot; [2] and also to issues with Chrome&#x27;s XSS auditor, which is why it was removed [3].<p>[1]: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22120136" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22120136</a><p>[2]: <a href="https:&#x2F;&#x2F;nakedsecurity.sophos.com&#x2F;2015&#x2F;02&#x2F;02&#x2F;anatomy-of-a-bro.." rel="nofollow">https:&#x2F;&#x2F;nakedsecurity.sophos.com&#x2F;2015&#x2F;02&#x2F;02&#x2F;anatomy-of-a-bro...</a>.<p>[3]: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;justinschuh&#x2F;status&#x2F;1220021377064849410" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;justinschuh&#x2F;status&#x2F;1220021377064849410</a>
评论 #22122334 未加载
评论 #22122467 未加载
评论 #22121741 未加载
评论 #22124180 未加载
评论 #22120499 未加载
lmkgover 5 years ago
There is a fundamental difficulty when trying to implement privacy: A limit on the disclosure of information is <i>itself</i> a disclosure of information.<p>A good privacy design needs to confront this issue directly. Sometimes there&#x27;s nothing to be done. I think in some cases it&#x27;s mathematically unsolvable (cf. Cynthia Dwork&#x27;s paper on Differential Privacy). But an explicit consideration can at least surface some trade-offs. The more fine-grained and selective your redactions, the more information they reveal.
评论 #22121368 未加载
raszover 5 years ago
Last time Google researchers made similar discoveries, 2012, it was used to ... track users :-)<p><a href="https:&#x2F;&#x2F;www.ghacks.net&#x2F;2012&#x2F;02&#x2F;21&#x2F;microsoft-google-is-also-bypassing-ie-privacy-settings&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.ghacks.net&#x2F;2012&#x2F;02&#x2F;21&#x2F;microsoft-google-is-also-b...</a><p>&quot;We used known Safari functionality to provide features that signed-in Google users had enabled. It’s important to stress that these advertising cookies do not collect personal information.&quot;<p>and bypassing IE third party cookie protection: &quot;impractical to comply with Microsoft’s request while providing modern web functionality.&quot; Google says complying with tracking protection is Impractical!
_underfl0w_over 5 years ago
Haven&#x27;t read TFA yet, but at first glance this sounds similar to the approach used by the &quot;Privacy Badger&quot; browser extension - if it sees the same tracker on multiple sites, it &quot;learns&quot; and begins blocking it. Would it also be susceptible to similar information leaks with this threat model?
评论 #22122419 未加载
noizejoyover 5 years ago
I’ve been following privacy issues and technology for a while, but haven’t come across a foundational discussion of (a) the merits of and (b) technical implementations of different approaches to avoid fingerprinting:<p>“hiding” vs “blending in”(making me look identical to countless others - maybe even randomizing who I look like in a smart way).<p>I wonder if any subject area experts reading this thread would be willing to share a summary of their knowledge and thoughts here.
评论 #22121692 未加载
评论 #22124871 未加载
nattaylorover 5 years ago
Conversely, Chrome is heading in the right direction:<p>&gt;Chrome plans to more aggressively restrict fingerprinting across the web. One way in which we’ll be doing this is reducing the ways in which browsers can be passively fingerprinted, so that we can detect and intervene against active fingerprinting efforts as they happen. [0]<p>This will include things like restricting the volume of Browser API checks allowed, etc, to reduce the number of bits that can be used in a fingerprint.<p>[0] <a href="https:&#x2F;&#x2F;blog.chromium.org&#x2F;2019&#x2F;05&#x2F;improving-privacy-and-security-on-web.html" rel="nofollow">https:&#x2F;&#x2F;blog.chromium.org&#x2F;2019&#x2F;05&#x2F;improving-privacy-and-secu...</a>
评论 #22121497 未加载
summerlightover 5 years ago
Wow. I understand ITP&#x27;s high level design, but didn&#x27;t know it&#x27;s implementation is so naive. Maintaining global database with a few rules which can be easily reverse engineered and giving its access to any documents? How did it go through the internal review process? Does Apple have any privacy&#x2F;security review process for its major products?<p>I understand that privacy engineering is <i>very</i> hard and sometime can get not very obvious with implicit statistical dependency chains, but this kind of direct problem could (or should?) be caught in an early stage of design. Anyway, ITP is all about privacy and deserves attentions from dedicated privacy engineers.
评论 #22122489 未加载