Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is a handful of GET requests for images. You would need a page to fingerprint. The site could get an IP, likely the user agent. Safe browsing requests are sandboxed from all the other Google cookies.


Geez did you guys even look at the URLs?

https://safebrowsing.google.com/safebrowsing/downloads?clien...

Isn't the API key your fingerprint? The key is not shown here, because the author was showing what the requests look like on first run, subsequent requests would contain your unique ID in them.

Not picking on you specifically, I saw several responses saying the same thing.


> Isn't the API key your fingerprint?

No, it's a per-application key, so in this case it would be IceWeasel's key.


In that case why would it make a request with "key=no-google-api-key" then why not use the IceWeasel key right from the start?


No clue, but it's not like we have to guess about what it is. It's all covered in the Safe Browsing docs: https://developers.google.com/safe-browsing/lookup_guide#Get...


You sure those are images? All we know for certain is that those are GET requests.


I'd be willing to bet that Firefox would treat them as such, even if they returned something different. Still, those favicons should be bundled instead of making requests, IMO.


Because we can see the sum of the requests, I think it's safe to say that they are probably just images.

There's nothing to stop, say, ebay from serving PHP scripts on ICO extension, processing the request as a pageload and then ultimately returning the icon file, but for anything useful to have been gleaned, it would have generated more requests.

Either it did generate more requests and Mozilla didn't honor them (in which case, yay), or it didn't generate more requests (in which case, yay). The former would be slightly preferred as the latter doesn't prevent ebay from later changing their strategy.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: