Hacker News Reader

Sheesh, the google conspiracy theories are getting out of hand. Why would you use this for setting cookies when you could just use cookies? If for some reason you dont want to use real cookies, why wouldnt you just use the cache side channel directly?

This doesn't really add any fingerprinting that doesnt already exist.

View on HN

Because groups want to track people without cookies. This re-introduces the problem of shared caches. Site A can know if someone visited Site B by whether or not they have the dictionary for some shared resource. Site A never has to show a cookie banner to do this tracking because there's no cookie set. This is just reintroducing the "feature" of cross-site tracking with shared caches in the browser.

Are you sure? I would assume that available dictionaries would be partioned by site (eTLD+1).

Nope. The dictionaries are partitioned the same way as the caches and cookies (whichever is partitioned more aggressively for a given browser). Usually by site and frame so there are no cross-site vectors that it opens.

Reply on news.ycombinator.com