Staggering how far #Meta will go to de-anonymise users.
https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/
I was actually surprised it took so long because this is not a new loophole. We discussed this issue almost 10 years ago in a different context: #WebRTC allows to circumvent the secure origin policy.
https://github.com/w3c/webappsec-csp/issues/92
I made a PoC back then
https://lgrahl.de/examples/dc/webrtc-circumvent-secure-origin.html
which still works to this day. It is also hard to prevent because the PoC doesn't do anything that is forbidden. It leverages a currently essential part of the STUN protocol.
Don't get me wrong, I'm all in for making an effort to remove all user-controllable input, but now we might see shortcuts being taken to get things fixed quickly, potentially destroying a bunch of nice and niche use cases along the way.