So given this information, how can we poison the results that the trackers get?
Online tracking: A 1-million-site measurement and analysis
11–20 of 272 posts
Re: Online tracking: A 1-million-site measurement and analysis
#12Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.
This is much-needed research. Thank you for your work. Regarding the WebRTC tracking- would it be possible for WebRTC to work without exposing the local IP? I.e. is there any real reason that fingerprint needs to be there?
Re: Online tracking: A 1-million-site measurement and analysis
#13Well, who would have guessed. Surprise surprise.
The web is such a shit technology.
Re: Online tracking: A 1-million-site measurement and analysis
#14Whoa, what's the use case for exposing battery information?
Re: Online tracking: A 1-million-site measurement and analysis
#15Well, who would have guessed. Surprise surprise. The web is such a shit technology.
And how would Silverlight or Java applets or Flash or any other client side technology be better in this regard?
You have to expose capabilities and those capabilities can be used to create an unique fingerprint based on your device.
How would you design the stack so that this kind of thing is impossible? Feel free to use your favorite tech stack as a base.
Re: Online tracking: A 1-million-site measurement and analysis
#16All of this makes me wonder how some of these interfaces should be more closely guarded by the user agent. Perhaps instead of a site probing for capabilities, they should instead publish a list of what the site/page can leverage and what it absolutely needs to work. Maybe meta tags in the head or something like the robots.txt. Browsers can then pull the list and present it to the end user for white-listing. You could…
Users don't want to do this though.
I mean, how many people are dealing with the hassle of noscript? That's probably most of the users that are going to do anything other than tell the browser to stop asking questions.
Re: Online tracking: A 1-million-site measurement and analysis
#17NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?
I don't know of any. I would think it would be fairly easy to create a userscript or extension to stub built-in APIs (maybe using something like testdouble.js or sinon.js to override the default global objects that you are trying to "disable"). I'm not sure what issues you'd run into on various pages if you did that though (so it'd probably need a lot of iteration- and fixing bug reports).
It might be a fun project to start though. I've been really enjoying testdouble's API (and have started using that for my unit tests).
Re: Online tracking: A 1-million-site measurement and analysis
#18All these things make the websites the new apps. Most probably we won't need to use many desktop applications a few years later.
That's the line Apple took with iOS shortly before it introduced the App store. Mozilla, Palm/HP, and even Microsoft with it's Win 8 Metro Apps tried to make websites the new apps. It has some short comings. Web apps are definitely getting better, I haven't used an actual email client in 10 years, but they have a long way to go before they can replace dedicated clients entirely.
Full replacements will probably have to wait for mass adoption of WebAssembly, web workers and probably some other things as well.
Heck, what would be really interesting would be hardware acceleration for the final version of WebAssembly. That should (?) make it competitive with regular assembly.
Re: Online tracking: A 1-million-site measurement and analysis
#19NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?
It's kind of surprising that there isn't an extension to provide this functionality (at least in desktop browsers). All you'd have to do is monkey patch the methods that get called and throw up a confirm("are you sure you want to allow [X]")
Re: Online tracking: A 1-million-site measurement and analysis
#20Well, who would have guessed. Surprise surprise. The web is such a shit technology.
"The web" is such a shit technology?
No one denies that the web as we know it is kind of a clusterfuck of things duct taped together, but to say it's "a shit technology" is maybe giving too little credit.