How safe browsing fails to protect user privacy

Summary: Researchers found Apple was sending safe browsing data to Tencent for all Chinese users, prompting scrutiny of the protocol's privacy claims. The post argues that safe browsing's k-anonymity guarantee is weak: a 2015 Gerbet et al. study found each 32-bit hash prefix occurs roughly 14,757 times, but Google can cross-reference multiple queries and URL decompositions to narrow down which site a user visited.
Bottom line: The same URL decomposition that lets Google de-anonymize browsing data was shown by Gerbet et al. to identify a user's taste in pornography, and because the malware databases aren't public, there is no way to tell whether hash prefixes were adversarially inserted to track users.

Read the original at Trail of Bits Blog ↗