Safari API bug leaks browsing data that can reveal a user's identity

the latest tech news, global tech news daily, tech news today, startups, usa tech, asia tech, china tech, eu tech, global tech, in-depth electronics reviews, 24h tech news, 24h tech news, top mobile apps, tech news daily, gaming hardware, big tech news, useful technology tips, expert interviews, reporting on the business of technology, venture capital funding, programing language

introduction of initiatives, Safari Privacy Report, blog post

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content.

the latest tech news, global tech news daily, tech news today, startups, usa tech, asia tech, china tech, eu tech, global tech, in-depth electronics reviews, 24h tech news, 24h tech news, top mobile apps, tech news daily, gaming hardware, big tech news, useful technology tips, expert interviews, reporting on the business of technology, venture capital funding, programing language

A bug in Safari in how it handles the IndexedDB API is potentially leaking information about a user’s browsing habits, an issue that could be used to reveal the user’s identity.

Apple has continuously attempted to make Safari privacy-focused, with the introduction of initiatives to prevent cross-site tracking and the Safari Privacy Report meant to help protect users. However, a bug in how Safari functions may have undone all of that work.

Global Tech News Daily

A blog post by browser fingerprinting service FingerprintJS points out that there’s a problem with the way Apple implemented IndexedDB API in Safari 15. According to the researchers, the bug can allow any website to track a browser’s internet activity, and potentially determine their identity.

IndexedDB is a browser API used by major web browsers as client-side storage, holding data such as databases. Normally, the use of a “same-origin policy” will limit what data can be accessed by which website, and typically makes it so that a site can only access data that it generated, not those of other sites.

Global Tech News Daily

In the case of Safari 15 for macOS, iOS, and iPadOS, it was found that IndexedDB is violating the same-origin policy. The researchers claim that whenever a website interacts with its database, a new empty database using the same name is created “in all other active frames, tabs, and windows within the same browser session.”

The leak is an issue as it can allow websites to learn what other websites a user visits in different tabs or windows within the same session. In part, this is due to databases having generally unique and website-specific names.

The problem is worsened as some websites use database names that include unique identifiers specific to a user. For websites that can share the same authentication credentials, such as Gmail and YouTube, the database name can include the same authenticated Google User ID.

That Google User ID is used as an internal identifier within Google, and relates to a single account. It is also possible to pull personal information from Google’s APIs using this identifier, which could help sites fully identify the user.

In testing, it was found that indexed databases with universally unique identifiers were created by ad networks. However, Safari’s tracking prevention features prevented those database names from being leaked in this manner.

Using a private window doesn’t protect users from the phenomena, however, browsing sessions are limited to a single tab, limiting its effect.

introduction of initiatives, Safari Privacy Report, blog post

A webpage demonstrating the leak has been created by FingerprintJS, with it able to display the Google User ID as well as websites loaded from the same browsing session from after the point the demo was accessed.

The list of affected browsers consists of Safari 15 on macOS, and effectively all browsers on iOS 15 and iPadOS 15, due to the requirement that they all use WebKit.

Protecting Yourself

Due to the way the problem manifests, there’s little that Safari users can actually do about the problem. It is possible to block JavaScript by default but enable it only on trusted sites, but that may harm the browsing experience.

Another alternative on macOS is to use a different browser as a temporary measure. This option is not available to iOS and iPadOS users.

Ultimately, the researchers admit, “the only real protection is to update your browser or OS once the issue is resolved by Apple.” A bug report has been submitted to the WebKit maintainers to try and get it fixed as soon as possible.

News Related

OTHER NEWS

Season two of Apple TV+ docuseries 'Dear...' coming on March 4

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Apple TV+ anthology 'Roar' to premiere on April 15

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Apple Music cuts free trial period from three months to one month

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. New ... Read more »

Belkin reveals new 12-port Connect Pro Thunderbolt 4 Dock

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Deals: get 1 year of Microsoft 365 Personal or a Luminar AI photo editing software bundle for Mac for $39

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Software ... Read more »

Apple TV+ announces 'Slow Horses' spy drama to stream in April

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Apple, Broadcom win new damages trial in $1.1B Caltech patent case

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Creative TiKTok user converts an iBook G3 into iPad case

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. By ... Read more »

Michigan toddler dials 911 on Apple Watch

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Best deals Feb. 4: $70 off Powerbeats Pro, $220 27-inch 2K monitor, $40 400GB microSD card, more!

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Friday’s ... Read more »

iMac Pro, AirPods Pro 2, and hands-on with Universal Control on the AppleInsider podcast

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. On ... Read more »

MacBook Pro, Pro Display XDR will automatically dim when hot

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Second class action suit targets Powerbeats Pro battery life, charging issues

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Amazon Prime raising annual subscription to $139

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Apple cuts commission by 3% for Dutch apps using third-party payments

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Following ... Read more »

Dark Souls tabletop RPG gets rid of D&D magic and erodes your humanity if you die

© Provided by GamesRadar Dark Souls: The Roleplaying Game Steamforged Games has lifted the curtain on how its Dark Souls tabletop RPG rules differ from the Dungeons and Dragons system ... Read more »

Victrola Revolution Go review: a portable record player perfect for budding music enthusiasts

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Take ... Read more »

UK woman orders iPhone 13 Pro Max, gets a $1 bottle of hand soap instead

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Former Tesla worker sues company claiming abuse 'reminiscent of the Jim Crow Era'

Kaylen Barker, a Black woman who worked at a Tesla manufacturing plant, filed a lawsuit this week in California claiming that the automaker tolerates “rampant acts of racism” in its ... Read more »

Microsoft tracking increasingly sophisticated Mac trojan that delivers adware

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Microsoft’s ... Read more »

Apple releases trailer for 'Lincoln's Dilemma,' coming to Apple TV+ on Feb. 18

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Glenn Close joins the cast for season 2 of 'Tehran' on Apple TV+, premiering May 6

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Lowest price ever: Apple 24-inch iMac dips to $1,149 for a limited time only

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

AirTags with disabled anti-stalking speakers briefly surface on eBay, Etsy

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Apple's December quarter was its best yet for iPhone sales in India

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple’s ... Read more »

iPad delivery estimates remained extended as Apple prioritizes iPhone 13

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. New ... Read more »

Senate Judiciary advances bill that would force Apple to allow iOS side-loading

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Putting Face ID unlock with masks to the test in iOS 15.4 & how to set it up

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. In ... Read more »

Best deals Feb. 3: AirPods Pro w/ MagSafe $180, $550 off 55-inch LG OLED, 30% off an Eero router, more!

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Thursday’s ... Read more »

Apple TV+ picks up four Bafta film nominations

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Judge dismisses proposed iPhone water resistance class action suit

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Second Israeli firm developed & sold exploit to break into iPhones remotely

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Apple opens 'reimagined' new Abu Dhabi retail store

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

South Korea says Apple's alternative payment plan 'lacks detail'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. South ... Read more »

Battle of the super yachts: Jeff Bezos' Y721 versus Steve Jobs' 'Venus'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Apple urges lawmakers to reject bill that would force it to allow side-loading

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Facebook rebuilding ad platform due to App Tracking Transparency, data laws

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Meta ... Read more »

Apple's board recommends voting against all shareholder proposals

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Unsurprisingly, ... Read more »

How AppleInsider staff continue to work from home, two years later

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. All ... Read more »

Apple Watch Series 7 has a fast charging problem

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. One ... Read more »