* Safari SB policy: https://trac.webkit.org/browser/webkit/trunk/Source/WebKit2/...
* Chrome SB policy: https://cs.chromium.org/chromium/src/content/renderer/render...
And of course, that's before we get into more complex forms of isolation that Chrome implements, such as the sandboxed GPU process, or ongoing work into things like network sandboxing, the macOS bootstrap sandbox, and site isolation (origin-bound renderer sandboxing).
Another thing Chrome does out of the box that Safari doesn't is U2F.
Still another is Chrome's industry-leading TLS management, including the pioneering of HPKP and the Chrome/Firefox pin list, and the aggressive policing of the WebPKI CAs.
I've been pretty aggressively terse in this thread, because I didn't even realize this was a live argument anymore. Safari is simply not as secure as Chrome, and it's less secure in ways that are meaningful to normal users.
Again: iOS, different story.
If you add these things up, the difference in practical effectiveness is not as wide as one might think.
One specific area where Safari is better than Chrome is in private browsing mode. In Safari, each tab is completely separate, and the cookies aren't shared (as far as I can tell) whereas in Chrome, it's only separate as a whole "private browsing session." They each have their pros/cons but I prefer Safari's model.
https://medium.com/@justin.schuh/securing-browsers-through-i...
Then try to work back either Edge's or Chrome's approach to security to specific Safari features and design.
The Chrome security team is probably the most sophisticated software security team in the industry (lest you think I'm in the tank for Google, I'd say the iOS platform security team is a close 2nd --- and, to be clear: Safari is a different story on iOS).
Chrome may be relatively decent at preventing a webpage from compromising your OS, but in the modern era, a compromised browser is as bad or worse anyways, since that's where most of your sensitive activity goes.
While many HN readers will know to avoid the perils of this crud, I don't feel Chrome can be recommended over IE6 to the wider Internet while this remains so commonplace. Safe use of Chrome requires constant vigilance.
In light of Chrome's issues, I feel like a claim that switching to Chrome is important for security to require an exceptional evidence of vulnerability in the other browser.
Or is it just assumed to be an easy target/too niche/no money from Apple?
That being said, and I've never used Cortana or Alexa, but I hear they're pretty decent compared to Siri.
https://arstechnica.com/tech-policy/2017/03/isps-say-your-we...
> CTIA is the main lobbyist group representing mobile broadband providers such as AT&T, Verizon Wireless, T-Mobile USA, and Sprint.
It doesn't just represent them, Apple is also a member:
It's like Mozilla can't even embrace its privacy stance fully.
> We believe these additions will help us take the next step toward shipping Tracking Protection in Firefox beyond Private Browsing Mode. Look for that study in late 2017.
[1] https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...
[2] https://en.wikipedia.org/wiki/Do_Not_Track#Effectiveness
[3] https://techcrunch.com/2017/06/05/apple-adds-a-tracker-block...
While this is flexible, open, and that's all good, the lack of a common sense default and a multi-step setup process is probably why like... even I am not using this right now.
If Apple does this by default, it's gonna make a huge dent in Google Analytics' numbers, whereas probably almost nobody uses the feature in IE.
So Google may lose data because then they can't track you all over the web, but the websites don't because they still see you as one user.
I say this as someone who does a lot of analytical research and re-targeting and would be hurt if this was rolled out on a larger scale; I just don't think I have a right to the data.
> segregate the _cross-site_ scripting data
So if you "just want to quantify your traffic", use self-hosted Piwik (i.e. not cross-site), as many of us do already.
Test your browser: https://panopticlick.eff.org/
I found this one rather interesting, it was the most unique of the ones listed:
HTTP_ACCEPT Headers
One in several thousand have the same headers as me. But the headers themselves are quite a small little string, I'm surprised it is that unique.
Why isn't this illegal already?
Apple Pay does something called tokenization, and the goal is more fraud protection than privacy. It generates one new number at card enrollment and uses that exclusively. By using a unique account number which can only be issued by Apple Pay devices, it means it doesn't matter if someone hacks the merchant and steals your number. They can't use it without the associated Apple Pay generated cryptogram, secured by your PIN / fingerprint.
Honestly the enhanced security of Apple Pay is underhyped. It's really great.
Recently too I've noticed that Amazon is putting ads in my Instagram feed for specifically things that I've looked at on Amazon within the last day or two. I'll literally click a link to a book or do a search, and then four hours later it'll show up in an ad in the app.
Aside from being kind of pointless (I already know about these items, why are you showing them to me later that day?), it's also all kinds of creepy and unsettling to see Amazon advertising six things I've seen recently, and not even on the same device I was viewing them on.
It would be really cool if it generated new numbers each time and had an amount coded to that number. So when I wave my Apple Pay device over the reader it would display the amount on the device, I would approve, and then a number would be handed back that's only good for that amount.
But would you rather see ads for something you might be interested in (however tangentially) or something completely random? Personally I prefer the former, as long as there is some basic sanity filtering involved.
Does this mean browser fingerprint is somehow scrambled before it is sent to the tracker instead of blocking?
It might be homogenized instead of scrambled. Every iOS device could be given (barring IP etc.) the same fingerprint.
1. Search Google for hockey sticks
2. Click on search result hockeystick.com
3. hockeystick.com issues a 302 to adcompany.com which then issues a 302 back to hockeystick.com
Why the 302? Because in Safari, you could only access cookies in a 3rd party context if you've seen a domain in a 1st party context. Setting a cookie in adcompany.com in a 1st party context gives you the ability to read that cookie in a 3rd party context which could be used for tracking purposes.
website.com
ad.com?u=website.com
website.com?loaded
They're just being a little sophisticated in how they block third-party cookies. This will hardly stop other tracking scripts, tracking images, widely-used fingerprinting techniques and related js calls. So nothing remotely close to even Brave let alone a TOR or the Epic Privacy Browser.
This blocks more than just cookies by the way, it affects all client-side state. And client-side state is still the primary and most reliable tool used for tracking, even though other methods exist, such as browser fingerprinting, behavioral fingerprinting, and IP-based tracking.
Then we have a problem where the industry is reliant enough on CDN's that browsers can't simply block access.
Uhhh, not really. Even if the behavior is unwanted, the web will not "behave" the same - otherwise the feature does nothing.
> Siri now suggests searches in Safari based on what you were just reading. And when you confirm an appointment or a flight on a travel website, Siri asks if you want to add it to your calendar.
Search for "Smarter about you." on this page: https://www.apple.com/ios/ios-11-preview/ Looks like it's done on the device though, End-to-end encrypted with your other devices.
There is no option to turn off phoning home to Apple in Apple's pre-installed operating systems. Every user of iOS is constantly pinging Apple servers all day every day.
Connect an iOS device to the internet and watch the network. The user is given no control over this. All users are assumed to need Apple's help setting the system time.
The networking functionality of NeXT/Apple's operating systems is based on open source BSD operating system code.
But BSD does not phone home to some organization when you install it. Why not? Surely Apple's approach is the best one for all users, right?
It is amusing to watch these companies proclaim they will block others from tracking and serving ads while continuing to siphon user data themselves, often in ways that are all but transparent to users. Apple can block everyone else, then I can block Apple. OK by me.
Someone in this thread made some comment about Microsoft Edge not tracking users. Do people seriously believe nonsense like that? MS was dumping debug output via DrWatson to the network long before collecting user data for profit was even a strategy.
Connect a Windows computer to the internet and watch the network. All on by default. Unlike Apple, they have no prepared explanation/justification why they need to do this.
And even if they did, who cares? Users prefer not to be tracked. Companies are admitting they know this.
Users could opt-in to tracking if they believed they were getting some benefit.
But that is not how this game works. There is no "opt-in". It is on by default. There was no intention to make tracking a "choice".
Probably because companies know what the choice of users would be and it would not be favorable to the company.
But that is not something we are allowed to discuss.
I suspect you'd have fewer down votes (and thus perhaps some discussion) without this. Congratulations on the self-fulfilling prophecy.
It makes me wonder how many publishers at national newspapers and magazines are even aware of what’s going on.
As in 192.168.0.2o7.net. Remember, "SWF" stands for Small Web File. Yes, they actually tried to get users to swallow this when Shockwave Flash started to be used in devious ways, such as to track users.
Omniture's business is third party tracking cookies similar to Google Analytics or KISSmetrics. Not sure and don't care whether Flash is used so much anymore. If too young to rememeber search and ye shall find information about "permanent, Flash cookies" that could not be removed.
Apple is not saying "We will not engage with companies selling third party tracking cookie services." Clearly they are not opposed to third party tracking cookies in principle.
Instead they are announcing some change to their browser. Wow, exciting. It is not clear what exactly this announcement accomplishes for users. Probably nothing. If you are trying to avoid ads and tracking, popular browsers (without extensions, etc.) are not your friends.
