You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Jan 29, 2024. It is now read-only.
Lets say I have a site called "tackcuriosity.com", which is a feed of items that users can click on. When the user loads the page, I grab n bits of entropy, which is under the budget.
When a user clicks on an item, I open a new page to "tаckcuriosity.com/?item=abc&session=foo" (in this example, 'a' is replaced with the unicode lookalike 'а' or any other such substitution in the domain, using subdomains, completely different domains), then grab n bits more entropy on the new domain, which I combine on a server with the previously recorded entropy using a linking session identifier in the URL.
Another example would be news sites that have a tap to continue reading button, which could also perform this trick. The page could load a new page with the article expanded, but use it as a chance to grab more entropy. Really any time a user needs to interact (or you can force them to interact), you can take a chance to grab more bits (with a poorer user experience, but that hasn't stopped these sorts of things so far), then tie together the identifying information.
If you have something like the portals proposal, I believe you could go to your intermediary domain, grab entropy, then use the portal to display content on the original domain to the user. Or maybe you can even use a portal to make the whole thing look seemless to the user (unless they share a limit like iframes).
The text was updated successfully, but these errors were encountered:
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Lets say I have a site called "tackcuriosity.com", which is a feed of items that users can click on. When the user loads the page, I grab n bits of entropy, which is under the budget.
When a user clicks on an item, I open a new page to "tаckcuriosity.com/?item=abc&session=foo" (in this example, 'a' is replaced with the unicode lookalike 'а' or any other such substitution in the domain, using subdomains, completely different domains), then grab n bits more entropy on the new domain, which I combine on a server with the previously recorded entropy using a linking session identifier in the URL.
Another example would be news sites that have a tap to continue reading button, which could also perform this trick. The page could load a new page with the article expanded, but use it as a chance to grab more entropy. Really any time a user needs to interact (or you can force them to interact), you can take a chance to grab more bits (with a poorer user experience, but that hasn't stopped these sorts of things so far), then tie together the identifying information.
If you have something like the portals proposal, I believe you could go to your intermediary domain, grab entropy, then use the portal to display content on the original domain to the user. Or maybe you can even use a portal to make the whole thing look seemless to the user (unless they share a limit like iframes).
The text was updated successfully, but these errors were encountered: