Re:Open letter: Ban surveillance-based advertising
by jefftk on Thursday July 08, 2021 @08:24PM
(#27779240)
> What is stopping, legally, them from taking e.g. HTTP Headers from independent connections and linking them together through fingerprinting?
Setting aside legality, the attack you're describing will be thwarted by network state partitioning: https://www.chromestatus.com/feature/6713488334389248
Re:Open letter: Ban surveillance-based advertising
by btdmaster on Friday July 09, 2021 @08:12AM
(#27782860)
Am I missing something, or does this not address the fact that https://whatsmybrowser.info/ will always yield the same thing whether a connection is made to GA, Firebase, YouTube or Blogger? That seems to have to do with connection timing and caching, not with what the connection itself leaks.
Re:Open letter: Ban surveillance-based advertising
by jefftk on Friday July 09, 2021 @08:21AM
(#27782916)
I thought the parent was talking about using information about the network connection to link users across sites hosted by the same entity?
If you're talking about fingerprinting in general, that is also something that all the browsers are working on. I'm most familiar with Chrome's strategy, which is to first switch APIs that provide a lot of entropy from something you get by default to something you have to actively request, figure out how to provide similar functionality more privately, and then enforce a privacy budget that does not allow collecting enough information to identify users: https://www.chromium.org/Home/chromium-privacy/privacy-sandb...
"When you’re not signed in to a Google Account, we store the information we collect with unique identifiers tied to the browser, application, or device you’re using."
What is stopping, legally, them from taking e.g. HTTP Headers from independent connections and linking them together through fingerprinting? Maybe this is not implemented in Google Analytics, but that is certainly not the only connection made to Google on most websites (see e.g. gstatic and Firebase). Since there is practically no technical barrier, it seems that the vague privacy policy leads to the only question being what the 'unique identifiers' are exactly.
[1] https://policies.google.com/privacy?hl=en#infocollect