Light

Episode #935 Quiz

"Topics" Arrives
Date: 2023-08-15 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Google’s Topics API replaces third-party-cookie tracking with client-side interest profiling in Chrome. Browsers classify visited sites into a public taxonomy, keep rolling four-week topic histories, and expose at most three randomized topics per site via document.browsingTopics(). HMAC per-site selection, 5% noise, opt-outs, incognito, and history-clearing reduce cross-site correlation.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, which browser event determines when a user’s accumulated Topics are rolled forward and older interest data is discarded?

Question 1

According to the episode, which browser event determines when a user’s accumulated Topics are rolled forward and older interest data is discarded?

A browser restart that clears the previous topic window A daily reset tied to the user’s local midnight boundary A browser-chosen week-long epoch that starts and ends at random times A calendar week that begins each Monday at midnight UTC

Question 2: What is the purpose of the 5% wildcard in Topics selection when a site queries document.browsingTopics()?

Question 2

What is the purpose of the 5% wildcard in Topics selection when a site queries document.browsingTopics()?

To ensure each topic has a minimum population and provide plausible deniability To force every site to receive at least one topic from the current week To synchronize topic answers across sites so advertisers see the same result everywhere To hide the user’s entire topic history by returning only random values

Question 3: Why does Gibson say the JPMorganChase password policy is especially harmful from a security perspective?

Question 3

Why does Gibson say the JPMorganChase password policy is especially harmful from a security perspective?

It allows only eight-character passwords but otherwise leaves users unconstrained It requires passwords to be rotated after every successful login It permits too many special characters and makes passwords overly flexible It pushes users toward short passwords while shrinking the attacker’s search space

Question 4: What was the key privacy safeguard Gibson highlighted as correcting the problem FLoC had?

Question 4

What was the key privacy safeguard Gibson highlighted as correcting the problem FLoC had?

A browser-level ban on all ad-related JavaScript execution A per-site filtering rule that only returns topics an advertiser had previously encountered A global cohort identifier that changes every week A requirement that every topic query be approved by the user before disclosure

Question 5: Under the Topics design described in the episode, what has to happen before a site can learn one of a user’s topics for that week?

Question 5

Under the Topics design described in the episode, what has to happen before a site can learn one of a user’s topics for that week?

The site must be on a manually approved whitelist maintained by Google The user must have visited the querying site at least three times in the same week The site or its advertiser must have queried the browser during the prior three weeks on a relevant site The browser must have shared the user’s full browsing history with the querying site

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.