News for hackers. Stuff that matters.
Re:Open letter: Ban surveillance-based advertising by jefftk on Thursday July 08, 2021 @08:24PM (#27779240)
> What is stopping, legally, them from taking e.g. HTTP Headers from independent connections and linking them together through fingerprinting?

Setting aside legality, the attack you're describing will be thwarted by network state partitioning: https://www.chromestatus.com/feature/6713488334389248

Re:Open letter: Ban surveillance-based advertising by btdmaster on Friday July 09, 2021 @08:12AM (#27782860)
Am I missing something, or does this not address the fact that https://whatsmybrowser.info/ will always yield the same thing whether a connection is made to GA, Firebase, YouTube or Blogger? That seems to have to do with connection timing and caching, not with what the connection itself leaks.
Re:Open letter: Ban surveillance-based advertising by jefftk on Friday July 09, 2021 @08:21AM (#27782916)
I thought the parent was talking about using information about the network connection to link users across sites hosted by the same entity?

If you're talking about fingerprinting in general, that is also something that all the browsers are working on. I'm most familiar with Chrome's strategy, which is to first switch APIs that provide a lot of entropy from something you get by default to something you have to actively request, figure out how to provide similar functionality more privately, and then enforce a privacy budget that does not allow collecting enough information to identify users: https://www.chromium.org/Home/chromium-privacy/privacy-sandb...