This is a cool side-channel attack that makes use of two nuances in the web.<p>First, the cache storage mechanism in service workers allows a site&#x27;s javascript to cache a 3rd party request it has loaded through the fetch API. Caches aren&#x27;t thinking about timing attacks, and in general are performance sensitive, so it&#x27;s reasonable to expect that larger resources will take longer to cache and this time can be observed by the page.<p>Second, you can generate facebook posts which are targeted to specific demographics - like age ranges or specific ages. This will generate URLs which will have a different page length when loaded by logged in users in the target demographic compared to others. It looks like this is possible because there is not an explicit &#x27;access-control-allow-origin&#x27; header set on facebook, and while the &#x27;x-frame-options:deny&#x27; prevents loading of the content, it can still be cached by a 3rd party.