Find me somewhere better than here. Bluesky: https://nitter.cf/t.co/q85OOqXQrD Mastodon: @englehardt@infosec.exchange
New Jersey
Joined April 2014
- Tweets634
- Following197
- Followers2.2K
- Likes855
Pinned Tweet
I'm inactive on Twitter, find me over at:
bsky.app/profile/englehardt.…
or
infosec.exchange/@englehardt
Steven Englehardt retweeted
PS: this is not even due to the United States's terrible privacy laws alone. Under Trump congress killed the regulatory rules that would have stopped this specific practice krebsonsecurity.com/2018/05/…
NEW: We watched as privacy advocates geofenced an abortion clinic in Florida, where the procedure remains legal, and identified specific devices that came from Alabama, where it is not.
Inside the wild world of phone tracking data for sale.
notus.org/technology/cell-ph…
Steven Englehardt retweeted
No, hashing still doesn’t make your data anonymous: bit.ly/3WgR7V4 /1
Steven Englehardt retweeted
New from 404 Media: Google is now the only search engine that works on Reddit thanks to its AI deal. Try to search for Reddit results with Bing, DuckDuckGo, or a bunch of others you won't get full results. Further monopoly on valuable information 404media.co/google-is-the-on…
Mozilla completely flubbed the communication of their PPA release, so I understand the frustration.
IMO a big part of that is failing to communicate their own relationship and dependence on advertising to fund browser development.
Firefox testing privacy-preserving ad measurement is a good thing.
I say that not because I like adtech built into browsers, but because it's better than the current ad measurement that happens with third-party scripts collecting cookies, click IDs, and IP addresses.
I'm glad Mozilla is participating here because, if not, the only players in the space will be much larger companies with different incentives and relationships with the web.
Mozilla's participation in the Private Advertising Technology Community Group has been meaningful.
Steven Englehardt retweeted
Private Browsing 2.0 – the details on Safari’s latest, industry-leading privacy protections: webkit.org/blog/15697/privat…
Apple requires that any alternate iOS browser engine block third-party cookies and partition state.
Interesting leverage point. I wonder whether those requirements will advance as WebKit's default tracking protections expand.
developer.apple.com/support/…
Steven Englehardt retweeted
📢 Announcement! I will be presenting my work “CookieGraph" /w @sansib @umaarr6 @zubair_shafiq @s_englehardt @carmelatroncoso at @acm_ccs. Join me in Session 10F on November 29, 1515-1530 to hear about our work on first-party tracking cookies. #ACMCCS2023 #Privacy #CookieGraph
Steven Englehardt retweeted
Exciting Web Privacy News
The Web is undergoing a significant advance in privacy at the moment. In recent weeks, the Chrome browser enabled cross-site storage partitioning. That is: many features in Chrome that used to leak data between websites, no longer leak.
In Chrome 117, our "State Partitioning test" results (see the table) indicate that 11 browser features no longer leak across sites!
Because several popular browsers are based on Chromium, including Edge, Opera, and Vivaldi, I expect this protection will shortly be enabled in those browsers as well. And because other browsers (including Brave, Firefox, Safari and Tor) have previously fixed these leaks, these protections will soon be universal for all Web users. (Current results for a range of browsers are at PrivacyTests.org)
What features are left that still need to be partitioned? In Chrome, it's the Blob API, the HSTS cache, and most important of all, third-party cookies. Chrome should fix these leaks as quickly as possible.
Congratulations to the Chrome team for making this major step forward! Here's hoping that browser teams will continue to make major progress in fixing other privacy flaws, including by expanding protections against fingerprinting, query parameter tracking, and IP address logging. We'll be watching. ✅❌
Wild. MTA site allows anyone to query the past 7 days of ride history associated with a credit card number.
You know, the number that creepy server at a restaurant might jot down, that is easily accessible to abusive spouses, etc.
New: I tracked the precise movements of an NYC subway rider. Saw what specific time they got on and at what station. It became obvious which station was nearest to their home.
This was all because of a 'feature' on the MTA website
Wide open to abuse 404media.co/i-tracked-nyc-su…
WebKit just released a proposal for ad attribution measurement that builds on top of Prio: github.com/patcg/proposals/i…
Steven Englehardt retweeted
New from the TLS meeting at IETF 117: Encrypted Client Hello (ECH) is enabled for 1% of Chrome stable users. A big step for privacy online!
datatracker.ietf.org/doc/dra…
Steven Englehardt retweeted
Chrome is partitioning storage in 115 🪣|🪣
If you use APIs like LocalStorage, Clear-Site-Data, SharedWorker, etc. embedded across sites, then there's testing instructions and we've extended the deprecation trial if you need extra time to update ⤵
developer.chrome.com/blog/st…