If you have one browsing history and one Twitter profile, it is easy to compare them. However, the main technical challenge is that we have to find some way to compare a given browsing history to every single profile on Twitter, which in theory is hundreds of millions of comparisons, plus we would have to find some way to get hundreds of millions of news feeds. Solving this took us several months. Of course in the paper we explained how we reduced the search space so we only have to consider a limited set of candidates, and only have to crawl part of the news feed in real time.

Of course if a couple of grad students could do this in a few months with only publicly available data (plus donated browsing history), then I'm sure ad networks could easily do this too, and given how many ad networks have parts of your browsing history I would say that it's scary that it's so "easy."

Well as the paper notes, we don't quite have their browsing history, just the domains (since HTTPS encrypts the paths). But yes, the domains you visit make you unique and therefore identifiable.

It's never too hard to figure something out if you're given the whole shebang instead of a loose breadcrumb trail.