您现在的位置是:百科 >>正文
【】
百科27人已围观
简介A vulnerability in Safari can be exploited to expose your browser history — and possibly eleme ...
A vulnerability in Safari can be exploited to expose your browser history — and possibly elements of your identity.
Revealed in a Saturday blog post by FingerprintJS, the bug was introduced to Safari 15 via the Indexed Database API(IndexedDB), which is part of Apple's WebKitweb browser development engine. To put it simply, IndexedDB can be used to save data on your computer such as websites you've visited, making them load quicker when you return to them later.
IndexedDB also usually follows the same-origin policysecurity mechanism, which doesn't let websites freely interact with each other unless they have the same domain name (among other requirements). Think of it like being in quarantine and only being allowed to hang out with members of your household. So for example, Netflix can't access IndexedDB's saved data to find out you've been cheating on them with YouTube.
SEE ALSO:How to move Safari's search bar back to the top in iOS 15Unfortunately, the bug revealed by FingerprintJS causes IndexedDB to violate the same-origin policy, exposing data it has collected to websites it didn't collect it from. Even worse, some websites such as those in Google's network use unique user-specific identifiers in the data provided to IndexedDB. This means that, if you're logged into your Google account, the collected data can be used to precisely identify both your browsing history and details of your account. And if you're logged into more than one account, it can figure that out too.
Prime Day deals you can shop right now
Products available for purchase here through affiliate links are selected by our merchandising team. If you buy something through links on our site, Mashable may earn an affiliate commission.iRobot Roomba Combo i3+ Self-Emptying Robot Vacuum and Mop—$329.99(List Price $599.99)
Samsung Galaxy Tab A9+ 10.9" 64GB Wi-Fi Tablet—$169.99(List Price $219.99)
Apple AirPods Pro 2nd Gen With MagSafe USB-C Charging Case—$189.99(List Price $249.00)
Eero 6 Dual-Band Mesh Wi-Fi 6 System (Router + 2 Extenders)—$149.99(List Price $199.99)
Apple Watch Series 9 (GPS, 41mm, Midnight, S/M, Sports Band)—$299.00(List Price $399.00)
"Not only does this imply that untrusted or malicious websites can learn a user’s identity, but it also allows the linking together of multiple separate accounts used by the same user," wrote FingerprintJS. They also released a demonstrationshowing the type of information the exploit can reveal.
FingerprintJS reported the bugat the end of last November, but Apple still hasn't fixed it. Mashable has reached out to Apple for comment.
All of this is concerning, but there isn't much you can do about it right now. Browsing in Safari's Private mode can mitigate the potential damage, since a private tab can't tell what's going on in any other tabs regardless of whether they're private or public. However it still isn't foolproof.
"[I]f you visit multiple different websites within the same [private] tab, all databases these websites interact with are leaked to all subsequently visited websites," wrote FingerprintJS.
Mac users can avoid the vulnerability by switching from Safari to a different browser, but people on iOS or iPadOS are out of luck. While only Safari has been impacted on Mac, Apple's requirement that all iOS and iPad web browsers use WebKit means the IndexedDB bug has impacted every browser on these systems. The best we can do is either wait for Apple to come out with a patch, switch to an Android, or just log off.
TopicsAppleCybersecurity
Tags:
转载:欢迎各位朋友分享到网络,但转载请说明文章出处“夫榮妻貴網”。http://new.maomao321.com/news/40b33099629.html
相关文章
'Wonder Woman' blows past 'Batman v Superman' at box office
百科Did you hear that distant drumming? That was 。 Wonder Woman。pounding the entire DC Comics cinematic u ...
【百科】
阅读更多A bonkers NFL touchdown went viral and it's sweet, sweet chaos
百科Whatever you think of professional football, or even organized sports as a whole, the breathtaking c ...
【百科】
阅读更多Apple Wallet can now carry your driver's license or photo ID
百科Thanks to Apple, the digital wallet is one step closer to replacing its bulky predecessor.On Wednesd ...
【百科】
阅读更多
热门文章
- Elon Musk's SpaceX is planning two rocket launches in three days
- Say hello to the crowded starscape in NASA's new Hubble image share
- Devastatingly, Dolly Parton is not on TikTok
- 'Last Week Tonight' team publicly thirst over Adam Driver at the Emmys
- KFC is releasing a smartphone, so you can show off your love for fried chicken
- Apple mounts iPhone on motorcycle after telling everyone not to do that
最新文章
Nobody can get their head around this woman's unusual commuting setup
A new book about Tesla is already causing drama
5 things you can't do on Tinder
Facebook is adding Messenger's voice and video calls to main app
Michelle Obama's appearance at the ESPYs was the best part of the show
Sorry, the iPhone 13's satellite features will likely be only for emergencies