Hacker News Reader

This sentence from the doc referenced sums it up well I think:

> A naive implementation of this feature may allow an attacker to determine the existence of textual content across an origin boundary.

Security & privacy implications of that seem obvious, e.g. extracting an account number (or other sensitive information) from a page by searching for successive prefixes.

View on HN

Just to clarify, I do think there are real privacy concerns with a naive implement of this feature. Allowing sites to search across origin boundaries would be a huge issue!

I just don't think that the DNS query issue mentioned in the article is the thing to be worried about. It's just so much less severe than the fact that DNS isn't encrypted, and requires essentially the same fix.

Reply on news.ycombinator.com