This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.
So a regular site using, say, mixpanel doesn't need to show a warning?
Online tracking: A 1-million-site measurement and analysis
21–30 of 272 posts
Re: Online tracking: A 1-million-site measurement and analysis
#22Malware filtering is needed.
Re: Online tracking: A 1-million-site measurement and analysis
#23NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?
If you use Firefox or Iceweasel, you can disable most of those apis in about:config or user.js. For example, media.peerconnection.enabled = false, to disable WebRTC. dom.battery.enabled = false for battery, etc.
Re: Online tracking: A 1-million-site measurement and analysis
#24Whoa, what's the use case for exposing battery information?
Some application want access to the battery info as they might want to disable some functionality in case your battery runs low. It would be smarter if instead of giving exact battery level it will get a callback once the battery runs low.
Re: Online tracking: A 1-million-site measurement and analysis
#25Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.
I am going to ask about a really basic question: what is fingerprinting?
I had to dig around, from the paper is sounds like a stateless form of tracking.
The audio example made sense:
1. the mic comes on, and it identifies a particular background noise.
2. I browse to another site, or a different page without a cookie.
3. The mic comes on again, matches the ambient noise and realizes I am the same person.
Is that what you mean? If this is the case, how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there.
Anyway, if it is what I understand it to be, then it sounds very interesting. I bet some science fiction author wishes they had though to use it.
Re: Online tracking: A 1-million-site measurement and analysis
#26NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?
By disabling specific APIs, you would make your browser even more identifiable.
It would only work if many users have disabled exactly the same APIs as you and all other non-disabled APIs don't provide any information useful for fingerprinting.
Re: Online tracking: A 1-million-site measurement and analysis
#27NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?
If you disable a unique combination of APIs that combination becomes your fingerprint.
Re: Online tracking: A 1-million-site measurement and analysis
#28Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.
I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…
Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.
Re: Online tracking: A 1-million-site measurement and analysis
#29All these things make the websites the new apps. Most probably we won't need to use many desktop applications a few years later.
That's the line Apple took with iOS shortly before it introduced the App store. Mozilla, Palm/HP, and even Microsoft with it's Win 8 Metro Apps tried to make websites the new apps. It has some short comings. Web apps are definitely getting better, I haven't used an actual email client in 10 years, but they have a long way to go before they can replace dedicated clients entirely.
> Web apps are definitely getting better, I haven't used an actual email client in 10 years
Oddly enough, just yesterday I started using an email client once more (emacs+gnus, for Gmail). It just felt so _nice_. And fast too!
Re: Online tracking: A 1-million-site measurement and analysis
#30All these things make the websites the new apps. Most probably we won't need to use many desktop applications a few years later.
That's the line Apple took with iOS shortly before it introduced the App store. Mozilla, Palm/HP, and even Microsoft with it's Win 8 Metro Apps tried to make websites the new apps. It has some short comings. Web apps are definitely getting better, I haven't used an actual email client in 10 years, but they have a long way to go before they can replace dedicated clients entirely.
> Web apps are definitely getting better, ... but they have a long way to go before they can replace dedicated clients entirely.
And yet, just yesterday there was a great discussion on Virtual Desktop Infrastructures, where entire operating systems are accessed and operated virtually through just the browser [0].
The current top comment indicates that while there are some setup hoops to jump through to use a specific OS, the performance itself "works very well" [1]. Does this not qualify as a web app replacing a client entirely?
[0] https://news.ycombinator.com/item?id=11721466 [1] https://news.ycombinator.com/item?id=11722141