Skip to content
This repository has been archived by the owner on Jan 29, 2024. It is now read-only.

Is there any mechanism to prevent gathering entropy through links? #9

Open
sparhami opened this issue Dec 15, 2020 · 0 comments
Open

Comments

@sparhami
Copy link

Lets say I have a site called "tackcuriosity.com", which is a feed of items that users can click on. When the user loads the page, I grab n bits of entropy, which is under the budget.

When a user clicks on an item, I open a new page to "tаckcuriosity.com/?item=abc&session=foo" (in this example, 'a' is replaced with the unicode lookalike 'а' or any other such substitution in the domain, using subdomains, completely different domains), then grab n bits more entropy on the new domain, which I combine on a server with the previously recorded entropy using a linking session identifier in the URL.

Another example would be news sites that have a tap to continue reading button, which could also perform this trick. The page could load a new page with the article expanded, but use it as a chance to grab more entropy. Really any time a user needs to interact (or you can force them to interact), you can take a chance to grab more bits (with a poorer user experience, but that hasn't stopped these sorts of things so far), then tie together the identifying information.

If you have something like the portals proposal, I believe you could go to your intermediary domain, grab entropy, then use the portal to display content on the original domain to the user. Or maybe you can even use a portal to make the whole thing look seemless to the user (unless they share a limit like iframes).

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant