
Google Just Gave Millions Of Users A Reason To Quit Chrome - obituary_latte
https://www.forbes.com/sites/gordonkelly/2020/02/20/google-chrome-80-upgrade-deep-linking-update-chrome-browser/
======
mdtusz
Correct me if I'm wrong, but the example given of a link with "cancer" in the
scroll-to-text part wouldn't show up in a DNS query would it?

My understanding was that only the domain is queried, but the full path is not
seen by a DNS server.

~~~
torstenvl
The images and other resources _would_ be part of the query. I don't know how
Chrome prioritizes loading of resources, but if it prioritizes those resources
in the current view, it might be possible to tell specific information about a
page based on DNS traffic.

Example: Let's say Chrome loads resources in the current view first, and you
send a deep link with "cancer" as a search term. If a gullible user follows
that link, then...

\- If "cancer" does _not_ appear, the first resources queried will be those at
the top of the page.

\- If "cancer" _does_ appear, the first resources queried might be those used
elsewhere in the page.

~~~
inshadows
Doesn't it mean that by watching DNS requests for resources, one can also
derive which path on a web server I am visiting? For instance when fetching
over TLS, such attacker should be able to tell whether I requested
[https://example.com/dank-memes.html](https://example.com/dank-memes.html) or
[https://example.com/just-text.html](https://example.com/just-text.html),
right? If that's the case, then this feature (ScrollToTextFragment) will not
make privacy worse that it is already and the worries are just contemporary
security theatre.

------
codycraven
I'm missing something here. Fragments (everything from #to-the-end-of-url) are
never sent as part of the request to the server.

As a developer, I can't even know if a user has a fragment server side.
Instead, I'm forced to use JavaScript to read it.

------
boublepop
The example that keeps getting put forwards seem unrelated to the new feature
in the sense that you can do the exact same with a
[https://url#cancer](https://url#cancer) link .

------
e-clinton
Don’t see a security issue here. Only the domain is sent to DNS, not the full
uri.

------
zodiakzz
Holy hyperbole batman. Flagged.

