[saag] Covert Web-to-App Tracking via Localhost

Hi,

A recently published attack [1] showcases how IETF-developed technologies can be (and are being) exploited to perform severe privacy intrusions. The assumptions baked into many protocols — that endpoints are inherently trustworthy — no longer hold in a world dominated by data-hoarding, surveillance-driven tech giants.

This is not a theoretical threat. It is an operational, real-world exploitation of protocol designs that have prioritized endpoint trust over user privacy. The attack demonstrates how easily users’ data can be exfiltrated via mechanisms that were standardized with good intentions but deployed in environments that weaponize those intentions against the users they’re meant to protect.

The Snowden revelations over a decade ago should have been the final warning bell. They revealed the extent to which surveillance capabilities can be embedded and abused by leveraging assumptions in infrastructure and endpoint control. Yet, the IETF and many “privacy” groups continues to treat endpoints as trustworthy.

How long will the IETF continue to design protocols under the illusion that endpoints act in the interest of the user? How long will it allow its standards to be co-opted by corporations whose business models rely on the systematic exploitation of privacy-sensitive data?

It is long past time for the IETF to reconsider its architectural assumptions. Trust should not be assigned freely to endpoints, especially in an environment where users have little choice or visibility into what those endpoints actually do. Privacy cannot survive if protocol design continues to ignore adversarial endpoints as a realistic and pervasive threat model.

I urge the broader Internet community to reevaluate current approaches, and to prioritize user privacy and safety over monetary donations from  data-hoarding, surveillance-driven tech giants.

Cheers,
John

[1] https://localmess.github.io/

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]