Re:The CNAME of the Game: Large-scale Analysis of DNS-based ...
by thrwwy0304 on Thursday March 04, 2021 @09:29PM
(#26351764)
Agreed - letting the request fire at all is the critical point, and I believe that's the true motivation behind using CNAMEs (they evade blacklists).
CNAMEs and first-party cookie access aren't helping networks link identities across sites in Firefox and Safari - at this point they're stuck relying on browser fingerprinting. And as you point out, fingerprinting can be quite effective, especially for people on static IPs :|
This paper is claiming that CNAMEs are evading the protections offered by Safari and Firefox but that's just not the case. Or at least, the paper hasn't explained how.
Yes, that's right. I'm making the assumption that letting the request succeed at all is on the losing side of the battle.
For me, I know I'm 100% trackable across the internet with my IP address (it hasn't changed in 2 years) and my screen resolution (the only 4k monitors behind that IP). If I don't block the request in the first place, the tracking company fingerprints my browser and sets that as a cookie.
The reason I say we're completely screwed is that I think we'll see all kinds of dirty tricks. Ex: auth = ads under the header and auth.example.net is actually a tracking domain. That's much harder to prevent than sending ads.example.com to a black hole.