56
Fighting cookie theft using device bound sessions
(blog.chromium.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 03 Apr 2024
56 points (96.7% liked)
Technology
59020 readers
3018 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Be careful since it is a double edged sword. Device bound session means the browser has the capabilities to differentiate devices, and thus can be used for more accurate tracking information. Of course I'm not saying it is not useful, having created a fair share of websites myself, I know the pain of authentication on the web and how it can be challenging to secure from tons of possible attack vectors. And in my experience, the weakest link is always the user.
My bad, I worded that badly. What I meant is that the website now has access to those features via the browser (js or some other mechanism). Now suddenly fingerprinting a device can be made easier.
That's a valid concern, but according to the article all the website can access is the random public key, or the fact that the feature is unsupported in this browser (for an unspecified reason).
Yeah, I've also read the article. I am just being cautious on how it can be used for other things that cause privacy concern. And so far, I've come up blank too.