Chrome deploys deep-linking tech in latest browser build despite privacy concerns

guest · Feb 21, 2020

Chrome deploys deep-linking tech in latest browser build despite privacy concerns
It's not a bug, it's a feature, explains the Chocolate Factory
February 20, 2020
https://www.theregister.co.uk/2020/02/20/chrome_deploys_deeplinking/

Google has implemented a browser capability in Chrome called ScrollToTextFragment that enables deep links to web documents, but it has done so despite unresolved privacy concerns and lack of support from other browser makers.

[...] ScrollToTextFragment shipped earlier this month in Chrome 80 unflagged, meaning it's active, despite privacy issues that have been raised.

"Imposing privacy and security leaks to existing sites (many of which will never be updated) REALLY should be a 'don't break the web,' never-cross redline," he wrote. "This spec does that."
The debate over the feature percolated last year on mailing lists and in GitHub issues posts and picked up in October when the team working on Chrome's Blink engine declared their intent to implement the specification.

But because Chrome so dominates the browser market, its unilateral innovations tend to become obligations for competitors, particularly if web developers embrace them.

"I think that Google has dramatically more power in web standards than any other party, among other reasons because it knows that other browsers will need implement non-standard Google functionality, or round privacy protections down to meet Google's implementation out of web compatibility concern," Synder said in an email to The Register.
Click to expand...

https://www.theregister.co.uk/#:~:text=about us
It could be quite useful, particularly if you run a search engine and want to offer users more specific page navigation.

Snyder spelled out some worries about the spec back in December in a GitHub issues post, noting that it appears to enable some privacy attacks by exposing new types of information to new types of observers.

"Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer," he wrote. "On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested."
To their credit, they've gathered them together into a single document and they've clearly been engaged in understanding what people are worried about. It's just that they've concluded the concerns aren't that big a deal or can be dealt with to their satisfaction.
Click to expand...

guest · Feb 21, 2020

GitHub Issues: privacy concerns with proposal through inducing network requests #76

Comment
The proposal seems to enable some privacy attacks, by exposing new types of information to new types of observers.

For example: Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer. On certain page layouts, i might be able tell if the employee has cancer by looking for lower-on-the-page resources being requested

Comment [Chromium engineer]
It relies on specific circumstances so this isn't generally exploitable but I agree it's a potential vector.
There are a few cases we're aware of like this where, given a number of factors, an attacker could extract a bit from the page. Another example is if the target page embeds an iframe from an attacker, the attacker can use intersection observer to detect the scroll. [...]
Click to expand...

guest · Feb 23, 2020

Privacy Concerns Raised Over New Google Chrome Feature
February 23, 2020
https://www.bleepingcomputer.com/ne...ncerns-raised-over-new-google-chrome-feature/

With the release of Google Chrome 80, Google quietly slipped in a new feature that allows users to create a link directly to a specific word or phrase on a page. A Brave Browser researcher, though, sees this as a potential privacy risk and is concerned Google added it too quickly.

In February 2019, we reported about a new web feature created by Google called 'Scroll To Text Fragment' that allows users to create links to a specific word on a web page and automatically highlight it.

As an example, to create a link to the phrase "man with a beret" in the XKCD Wikipedia article, you would use the https://en.wikipedia.org/wiki/Xkcd#:~:text=man%20with%20a%20beret URL.
At first glance, this feature seems very useful as it makes it easy to share specific locations on a web page with someone else.

With Google enabling the feature without further discussion, Snyder raised an important issue on Twitter. What is the point of using WICG to propose new web platform features if the developers for the most widely used browser, Google Chrome, adds these features regardless of the expressed concerns or at least giving a final response to open issues?
Click to expand...

The good news is that Google appears to be considering an opt-in option for sites to allow this feature and hopes to have it ready in Chrome 82.
Click to expand...

guest · Jun 5, 2020

Microsoft Edge supports controversial deep-linking feature
Scroll to text fragment is supported in Microsoft Edge
June 5, 2020
https://windowsreport.com/microsoft-edge-deep-linking/

Back in February, Google announced it was implementing a feature called scroll to text fragment in Chrome. The capability debuted with version 80, before several other Chromium-based browsers followed suit, including Microsoft Edge.
Scroll to text fragment allows developers or website owners to deep link a text snippet in the URL to any part of a web page.
Scroll to text fragment works in Microsoft Edge
Recently, the folks at Techdows experimented on the deep-linking feature in Microsoft Edge. They found that the capability is supported in the new Chromium-based browser.

However, it appears that the implementation of scroll to text fragment in Edge isn’t perfect yet.
So, when you click a featured snippet, Edge will not highlight the intended block of text or phrase on the target web page.
Click to expand...

Why scroll to text fragment is controversial
Right now, Chrome, new Microsoft Edge, and Opera are some of the browsers that support scroll to text fragment. But Firefox isn’t joining them anytime soon.
Those opposed to deep-linking argue that the capability is open to abuse. For example, a bad actor may send such links to a web page looking to retrieve potentially confidential data or information.
Click to expand...

Log in or Sign up

Chrome deploys deep-linking tech in latest browser build despite privacy concerns

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Chrome deploys deep-linking tech in latest browser build despite privacy concerns

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches