Light

Episode #807 Quiz

Dependency Confusion: The Build Chain Hack
Date: 2021-02-23 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Trend Micro exposed SHAREit Android flaws after ignored disclosure, leaving billion-plus users vulnerable to permission abuse until a patch. Researchers then showed favicon cache tracking using 32 subdomain redirects, bypassing cache clears and incognito modes. Brave fixed .onion DNS leaks; Microsoft emphasized secrets-free code, Zero Trust, and credential protection.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the favicon-tracking attack described in the episode, what mechanism did the researchers use to encode and later reconstruct a browser identifier?

Question 1

In the favicon-tracking attack described in the episode, what mechanism did the researchers use to encode and later reconstruct a browser identifier?

They stored the identifier in TLS session tickets and reconstructed it from resumed handshake patterns They stored the identifier in cookie values and reconstructed it from third-party cookie synchronization They stored the identifier in ETag values and reconstructed it from conditional HTTP cache misses They stored the identifier as favicon entries across subdomains and reconstructed it from redirect-driven favicon requests

Question 2: What browser behavior made the favicon-based tracking especially persistent and privacy-breaking, according to the episode?

Question 2

What browser behavior made the favicon-based tracking especially persistent and privacy-breaking, according to the episode?

The favicon cache survives data clearing and is shared between normal and incognito browsing The favicon cache is synchronized across devices through browser cloud sync The favicon cache is stored only inside private browsing profiles and never in normal mode The favicon cache is rebuilt from DNS history whenever the browser restarts

Question 3: Why was Firefox, at the time of the researchers' submission, not actually vulnerable to the favicon tracking attack despite having favicon cache code?

Question 3

Why was Firefox, at the time of the researchers' submission, not actually vulnerable to the favicon tracking attack despite having favicon cache code?

Firefox stripped favicons from redirected responses before they could be cached Firefox encrypted favicon cache entries so subdomain probing could not distinguish them Firefox created favicon cache entries but never used them to fetch icons Firefox disabled favicon caching entirely in private browsing mode

Question 4: In Brave's .onion privacy bug, what internal feature caused DNS queries for onion domains to leak onto the public Internet?

Question 4

In Brave's .onion privacy bug, what internal feature caused DNS queries for onion domains to leak onto the public Internet?

Its sync service resolved onion names to populate bookmark metadata Its ad-blocking component performed DNS checks and failed to exclude .onion names Its phishing protection service pre-fetched onion sites to classify them as safe Its Tor window used public DNS resolvers to speed up hidden-service lookups

Question 5: What was the key flaw in Python dependency resolution that Alex Birsan highlighted as enabling dependency confusion?

Question 5

What was the key flaw in Python dependency resolution that Alex Birsan highlighted as enabling dependency confusion?

Using --require-hashes caused pip to accept the newest public release automatically Using --no-cache-dir forced pip to reinstall packages from the public registry on every build Using --extra-index-url caused pip to consult public and private indexes and prefer the higher version Using --trusted-host forced pip to ignore package signatures and install unsigned code

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.