Comment by handoflixue
3 days ago
Does it actually batch them in an identifying way?
Is there any realistic value to knowing "how many unique passwords you use"? If you already have one of my passwords compromised, you'd presumably try it on the rest of my accounts regardless?
My browser fingerprint leaks, what, thousands of times more information than that - surely fixing applications like Chrome to have sensible privacy-preserving opt-in-only behavior is vastly more important than nagging some obscure open source software about an edge case that can barely be exploited?
By "batching" I was referring to whether they deduplicate requests -- if they do one HTTP request for every password then you get some extra information about how passwords are shared that you would have to infer otherwise.
If you know someone with N logins has N passwords it's a decent indication they use a password manager and so passwords are unlikely to be weak, if they have 1 password it's probably shared elsewhere and weak.
I also wasn't responding to a question asking about practical exploits, I was responding to a question that claimed the k-anonymity model is "provably anonymous" and "harmless". Since it clearly leaks some information it's definitely not the former and one could argue it's not the later though the "harm" is minimal.
> My browser fingerprint leaks, what, thousands of times more information than that - surely fixing applications like Chrome ...
I fail to see how the privacy nightmare of modern browsers is relevant to a discussion on whether opt-out signalling to third-party services is a reasonable stance for an open source project? By that metric no privacy bug is worth reporting because Chrome continues to exist. If only there was a term for this kind of non-sequitur...
If you want to claim something is harmful, you have to actually demonstrate that harm. Otherwise your claim is merely that it could be harmful, which is by default true of basically everything, and thus not a very interesting point.
"Leaks information" is perfectly compatible with "provably anonymous"
You have to prove that the leak is enough to actually de-anonymize someone to disprove anonymity.
I'm not saying it can't be done, but you're jumping ahead and skipping a very important step.