Hacker News new | past | comments | ask | show | jobs | submit login

I don't know where microtimes comes from either. It's entirely possible the per-user key is or contains a microtime - I've never investigated.

The per-user key does allow the entity operating the blacklist to easily detect any user who's moving between network access points. This is known. The feature is and was always stripped out in stuff like Tor browser for that reason.

There's good reasons to believe it wasn't malicious (it was necessary for secure updates pre-universal-HTTPS, and was removed as soon as HTTPS was deployed universally at Google), but it's also not really arguable it could be used for that purpose, either.




Are you saying that the "google api key" passed by Firefox is user-specific?


No, not at all. SafeBrowsing had a separate encryption/MAC key. I think some of the confusion is because the parent poster posted a link to v3 of the protocol, which dropped the key in favor of HTTPS, but the old Firefox version implements v2.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: