So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?
Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
11–20 of 48 posts
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#12So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?
[deleted]
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#13So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?
NextDNS blocks those trackers, see: https://medium.com/nextdns/nextdns-added-cname-uncloaking-su...
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#14So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?
NextDNS blocks those trackers, see: https://medium.com/nextdns/nextdns-added-cname-uncloaking-su...
That's like a tiny bandaid; in the next iteration they'll copy the A/AAAA records instead of CNAMEing them; that would make CNAME uncloaking useless _and_ save one DNS roundtrip reducing browser latency.
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#15We now have trackers acting like first-party properties, but where do you draw the line between first-party and third-party? What I mean is, if I build my own in-house analytics app that does a lot of what Adobe's product does, should that be blocked too?
I specifically mean for site analytics, like Experience Cloud or GA, not serving ads. Ad block is different IMO.
If this is hosted on a first party subdomain you're already blocking the ability of it to set third-party cookies and track you across sites. So, in practical terms, what's the difference between this CNAME trick and building the same thing in-house to run your own analytics?
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#16We now have trackers acting like first-party properties, but where do you draw the line between first-party and third-party? What I mean is, if I build my own in-house analytics app that does a lot of what Adobe's product does, should that be blocked too? I specifically mean for site analytics, like Experience Cloud or GA, not serving ads. Ad block is different IMO. If this is hosted on a first party subdomain you're…
It depends on why you care about the distinction. If you're talking from a purely privacy perspective, the important questions are (1) are you taking analytics? (2) what are you doing with them? (3) is that in line with users' expectations?
Third party, or third party disguised as first party, is only problematic because of an implied "there's very little keeping the third party from using your data for things that aren't just analytics for the first party." It's the red flag for "this site may not be using your data the way you would want it to."
Third party ad trackers disguised as first party cookies specifically violate the general assumption that first party data stays first party, because those third parties have specific mechanisms to track you across multiple first parties.
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#17Earlier quoted context omitted.
Seems like most of these use Adobe Experience Cloud. I'm guessing they offer some kind of HOWTO to set it up as disguised. Good on Adobe for keeping it up. Flash wasn't enough to fuck the internet up for years.
Yes, for Adobe Experience Cloud, see: https://docs.adobe.com/content/help/en/core-services/interfa...
> In order to circumvent tracking limitations imposed by browsers and programs, you can implement first-party cookies.
Well at least they're forthcoming about knowing they're intentionally circumventing users privacy settings.
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#18So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?
> anything a user can do to avoid third-party tracking at sites like these?
Not really, other than as you say simply going elsewhere. The trouble is most users don't know to go elsewhere as they don't know about the matter without digging.
You could start treating changes of sub-domain the same way cross-domain references are handled by tools that block 3rd party cookies, but there are plenty of sites that use multiple sub-domains which have genuine uses for shared cookies (single sign-on for instance) that might be broken by this so you'll have an initial inconvenience of white-listing them. Also if a previously white-listed site goes rouge, detecting that could be difficult, or at least fraught with false positives.
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#19So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?
disable javascript.
Re: Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers?
#20From the site:
> While our analysis tool were not able to confirm that session cookies were sent as well, a long list of leaking cookies could mean that they would be. Anyone in possession of those cookies can impersonate you on that website — i.e., access your account.
I hadn't considered that before, but they're right, it's extremely easy to accidentally leak session cookies through first party subdomains. I look forward to the inevitable conference talks that will be discussing this vulnerability.