| Reposting from the other [1] thread: Basically Safari keeps track of which domains are being requested in a 3rd party context (i.e. I load example.com in my browser and the page loads the facebook sdk - Safari increments a counter for facebook by 1). Once a given domain reaches 3 hits, Safari will strip cookies and some other data in 3rd party requests to that domain. The problem is that advertisers can use this to fingerprint users: register arbitrary domains, make 3rd party requests to them, and detect whether or not that request is having data stripped. Each domain is an additional "bit" of data. This is similar to "HSTS Cookies" [2] and also to issues with Chrome's XSS auditor, which is why it was removed [3]. [1]: https://news.ycombinator.com/item?id=22120136 [2]: https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro.... [3]: https://twitter.com/justinschuh/status/1220021377064849410 |
Better still, when you see a split discussion, email hn@ycombinator.com so we can merge them. We'll make sure your comment ends up in the winning thread.
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...