The cross-origin probe budget proposed in #73 is keyed by the requesting site. Review by @johannhof and @tomvangoethem surfaced that this key does not bound the attack it is meant to bound.
The attack. A page embeds N iframes, each at a site the attacker controls. Each draws a full budget, resolves its share of a fixed hash list, and postMessages the bits to the embedder, which reassembles an identifier N times wider than the budget. Sixteen registrable domains is not a meaningful cost for a tracker. Keying by site rather than origin, as #73 proposes, would raise the unit price from a subdomain to a domain but does not change the shape.
What is bounded and what is not. A <script src> tracker running in the first party's origin draws on the embedding site's budget, but it resolves the same hashes on every site, so its identifier width stays bounded by the budget. Assembly is the case that multiplies without limit, because the shares are disjoint and combine in one context.
Direction under consideration. A second budget keyed on the top-level site, charged in addition to the per-requesting-site one, and only when the requesting site differs from the top-level site. It would count distinct hashes across all third parties in that page context, which is exactly the quantity assembly maximises. Exempting same-site-as-top-level keeps a first party loading its own resources from competing with its embeds, and a single party cannot mount assembly against itself.
Open. Whether a shared page budget lets a hostile embed starve a legitimate one. Whether two budgets are worth the complexity versus keying solely on the top-level site.
From #73 (comment) and #73 (comment).
The cross-origin probe budget proposed in #73 is keyed by the requesting site. Review by @johannhof and @tomvangoethem surfaced that this key does not bound the attack it is meant to bound.
The attack. A page embeds N iframes, each at a site the attacker controls. Each draws a full budget, resolves its share of a fixed hash list, and
postMessages the bits to the embedder, which reassembles an identifier N times wider than the budget. Sixteen registrable domains is not a meaningful cost for a tracker. Keying by site rather than origin, as #73 proposes, would raise the unit price from a subdomain to a domain but does not change the shape.What is bounded and what is not. A
<script src>tracker running in the first party's origin draws on the embedding site's budget, but it resolves the same hashes on every site, so its identifier width stays bounded by the budget. Assembly is the case that multiplies without limit, because the shares are disjoint and combine in one context.Direction under consideration. A second budget keyed on the top-level site, charged in addition to the per-requesting-site one, and only when the requesting site differs from the top-level site. It would count distinct hashes across all third parties in that page context, which is exactly the quantity assembly maximises. Exempting same-site-as-top-level keeps a first party loading its own resources from competing with its embeds, and a single party cannot mount assembly against itself.
Open. Whether a shared page budget lets a hostile embed starve a legitimate one. Whether two budgets are worth the complexity versus keying solely on the top-level site.
From #73 (comment) and #73 (comment).