Hacker News Reader

SRI might prevent you from getting malicious code, but these privacy enhancing methods feel like smoke and mirrors to me.

View on HN

Wouldn't it also be useful when the browser retrieves resources from a local disk cache?

Nope, no longer. Some large advertising companies like Taboola have abused caches to store unique identifiers. I won't be shocked if Google and Facebook have also used this, so Safari (from 2013, https://bugs.webkit.org/show_bug.cgi?id=110269), Firefox (depending on settings from 2018 and widely deployed in 2020, https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...) and Chrome (from 2020, https://developer.chrome.com/blog/http-cache-partitioning/) now separate caches.

With SRI you can't store unique identifiers in the cache since the cached content has to match the hash in the URI. The only real privacy leak would be potentially determining whether certain data was already cached.

While you're correct, it's too little too late. You should assume that everyone effectively don't have a web cache. It's like the effect of Spectre and Meltdown: JS timers are no longer accurate to compensate for them.

Reply on news.ycombinator.com