Re: [Model-t] Web Tracking

[Eric Rescorla <[e-mail]>]

On Mon, Feb 17, 2020 at 1:48 PM Töma Gavrichenkov <[e-mail]> wrote:

> Peace,
>
> On Tue, Feb 18, 2020, 12:34 AM Eric Rescorla <[e-mail]> wrote:
>
>> Thanks for your note. I feel like both of these attacks fall into the
>> category of "local compromise" and thus are in a distinct bucket from Web
>> tracking.
>>
>
> There are different shades of "local" on the user's machine.  E.g. I think
> one of the purposes of QLOG was to provide transparency about what
> applications are doing by resurrecting the side reporting channel (which
> existed ad-hoc before the applications began to carry their own encryption
> stacks) to the system.
>
> I personally feel there are different *scopes* of tracking rather than
> different types.  The difference is basically that we won't be able to find
> a MECE segmentation which won't be biased.
>

I don't really agree with this. Web Tracking uses existing Web APIs in an
unexpected (and largely undesirable) way. It is a totally different threat
model from the attacker running malicious code on the user's machine.

Anyway, I'm not sure debating this is that useful, as we're not writing a
document here; my note was merely my description of a specific topic. If
you'd like to write your own description of some set of threats, you should
go ahead.

-Ekr