807852 - Position of real request is predictable in Completion requests with noise

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, defect)

Description

[Gian-Carlo Pascutto [:gcp]]

To obscure the URL the user hit even further, we add noise to our gethash requests to the Google SafeBrowsing server. We do this by appending fake 
(noise) requests to the list of completions. The list of completions is sent out IN ORDER to the server.

Need I say more?

At least this isn't a bug the recent rewrite added. It's been in Firefox in the old code, too.

Comment 1

[Gian-Carlo Pascutto [:gcp]]

Attachment: Patch 1. Shuffle completion requests

Comment 2

[Gian-Carlo Pascutto [:gcp]]

https://tbpl.mozilla.org/?tree=Try&rev=caa492f7913b

https://hg.mozilla.org/mozilla-central/rev/2718739a1c83