It is a disgusting practice especially when you see it cheered for and being proud about it officially,, this is quite informational how it works, I am not in the position though to follow all details without an extensive study on the matter, which requires a LOT of time, and many many tests with inspecting all 1st-party cookies involved as well, therefore I said that it should be looked and maintained by Vivaldi in the first place. Yes, CNAME is not new, it's just that some abuse it which can lead to fatal consequences, I don't remember if this is included in the links above The use of CNAME aliases are very common for sites that use a CDN for their content, and it does not have to mean it's for tracking purposes. It could also mean that browsing would be a little slower, as the browser/extension has to check if the host has a CNAME on another domain for each request, and possibly also if that domain is on a said in Brave blocks CNAME tracking, what about Vivaldi?: However, it might cause issues with sites that rely on these cookies for site functions, media playback or similar. In principle I definitely agree that requests that use CNAMEs for other domains should not be allowed to set cookies. 7087 IN CNAME .ĭo you know how this exactly works in uBlock (Firefox)? Where are the rules or settings to control CNAME blocking, are there special lists? I tested in Firefox (+uBlockO) with the site mentioned in the Reg article, and the CNAME host is blocked:ġ. But not really surprising that advertisers will do anything they can to track users, even abusing the DNS system. P.S.2 But as these methods of tracking are so sophisticated, one couldn't rely just on a "mazochistic" uMatrix configuration and whatever a user says, a native "solution" would be welcomed, where at least you know that these things and their shenanigans are being monitored and overlooked by Thanks for the informative articles, I did not know about this. about those tests, well they don't say anything to me in general, I find them too vague and thus unreliable, html5 fingerprinting is also another subject. You can read all details in the 1st link which links to brave's post and test, and I'm sure the real paper contains much more and far more juicy info, but I don't have the time to study it now. So to overcome this with uMatrix one should block everything 1st-party, have the domain list always expanded, check the subdomains if they include a CNAME redirection with the drill command for example, then leave their scripts blocked. The difference between a newer version of uBlock for Firefox and an older one for it and the Chromium browsers, is that because of Firefox's API it can reveal the CNAME redirections and block them by default now, making it easier for the user, while in uMatrix if you don't block 1st-party scripts by default (which usually nobody does), a subdomain of it (for which you have also most probably accepted a cookie) can use a CNAME and redirect you to another url that tracks you, with its script or with the shared cookie. supported) less granular and less verbose (& abandoned) uMatrix now -it used to be the ad-block part of the 2 contained in HTTP-Switchboard as we know- so they are both content blockers, so imo what is said there applies to both, it's just that with uMatrix you have more power to overcome the hurdles, but you have to do it manually which can become a real pain. Tl dr: you can do it with uMatrix (I think and I believe I am right) but it can be a pain. Most content blockers distinguish between first and third party resources, and CNAME tracking uses this to avoid detection. I don't know whether this is a bug as the "Log out" works and the search in "PageLive" also works without problem.And Internet marketing companies may use CNAME cloaking to avoid detection by content blockers, regardless of whether they are integrated in the browser natively, provided by browser extensions, or through other means such as the HOSTS file or DNS.ĬNAME tracking, also called CNAME cloaking, works through redirects by using subdomains of the main domain which are then redirected automatically to a tracking domain. delete / 2 Parameters: % Expected behavior
POST / users / log_out Processing with PlayWeb.UserSessionController.
0 kommentar(er)
