Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

111–120 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#111

Post by throwanem »

hvm wrote: post #57
MatekCopatek wrote: post #42

Earlier quoted context omitted.

This would make absolute sense. Certain requests (like location) already trigger popups that ask you for permission. If it turns out other APIs can be equally revealing as far as privacy goes, it would make sense to present the same popup. I mean, using a web app for the first time would be no different then installing a mobile app - I wouldn't be surprised if I had to give it a few permissions.

I was thinking the same thing. We need a permission system for websites. Preferably useable on a per-domain basis so I can disable those APIs on adnetworks' domains.

The (currently embryonic) Permissions API [1] looks like it's aimed at precisely this use case.

[1] https://developer.mozilla.org/en-US/docs/Web/API/Permissions...

Re: Online tracking: A 1-million-site measurement and analysis

#112

Post by madeofpalk »

Freak_NL wrote: post #91
madeofpalk wrote: post #77

Earlier quoted context omitted.

The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.…

> […] but being able to read pixel data out of a canvas is completely reasonable. Not for every website. Most websites don't need canvas at all. One option would be to ask users to activate canvas support for a website that does need it, so users can judge for themselves if the request is legitimate. This is how the geo-location API works after all. I am not convinced that this will work very well though.

Seems like just another vector to fingerprint that browser by :)

Re: Online tracking: A 1-million-site measurement and analysis

#113

Post by throwanem »

beardog wrote: post #67
anexprogrammer wrote: post #66

Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't…

If your VPN is configured correctly, your IP will not be exposed.

Not all of my devices make it possible to disable WebRTC, which makes defense in depth a necessity. Can you provide pointers to more information?

Re: Online tracking: A 1-million-site measurement and analysis

#114

Post by cptskippy »

metasean wrote: post #30
cptskippy wrote: post #9

Earlier quoted context omitted.

That's the line Apple took with iOS shortly before it introduced the App store. Mozilla, Palm/HP, and even Microsoft with it's Win 8 Metro Apps tried to make websites the new apps. It has some short comings. Web apps are definitely getting better, I haven't used an actual email client in 10 years, but they have a long way to go before they can replace dedicated clients entirely.

> Web apps are definitely getting better, ... but they have a long way to go before they can replace dedicated clients entirely. And yet, just yesterday there was a great discussion on Virtual Desktop Infrastructures, where entire operating systems are accessed and operated virtually through just the browser [0]. The current top comment indicates that while there are some setup hoops to jump through to use a specific…

> Does this not qualify as a web app replacing a client entirely?

If you can pull up a video stream from a surveillance camera in your house then you no longer need a home?

When you watch Daredevil on the Netflix App on your phone do you think that the actors are inside your phone performing live action for you?

What they're discussing is a web app that allows you to interact with a remote client. That client OS still exists and the UI/UX is still being rendered by a nonweb technology, the pixels rendered are just being streamed to your web browser instead of to a monitor and your inputs are being captured and transmitted to that client OS.

Re: Online tracking: A 1-million-site measurement and analysis

#115

Post by ultramancool »

As soon as I saw these APIs being added I immediately dropped into about:config and disabled them. How the hell do these people think this is a good idea to do without asking any permissions?

Put these in your user prefs.js file on Firefox:

user_pref("dom.battery.enabled", false);

user_pref("device.sensors.enabled", false);

user_pref("dom.vibrator.enabled", false);

user_pref("dom.enable_performance", false);

user_pref("dom.network.enabled", false);

user_pref("toolkit.metrics.ping.enabled", false);

user_pref("dom.gamepad.enabled", false);

Here's my full firefox config currently:

https://up1.ca/#nUSA1WtY13ECfmYC5c825w

Privacy on the web keeps getting harder and harder. Of course this should only be used in conjunction with maxed out ad blockers, anti-anti-adblockers, privacy badger and disconnect.

We need browsers to start asking permission. When you install an app on Android or iOS it says "here's what it's going to use, do you want this?". The mere presence of the popup would annoy people and prevent them from using these APIs.

Re: Online tracking: A 1-million-site measurement and analysis

#117

Post by amluto »

Freak_NL wrote: post #80
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

The browser vendors could start taking the idea of asking for permission seriously.

For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already.

For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status?

For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already: web fonts are here, are widely supported, and no legitimate website should be relying on some oddball manually installed font.

This problem is hard to solve, but the Tor browser has it mostly solved. Other browsers could learn from it.

Re: Online tracking: A 1-million-site measurement and analysis

#118

Post by kbenson »

manigandham wrote: post #109
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

Thanks for this research, really interesting to see. I do want to state for the record that instinctiveads.com was testing augur.io and that's why we're listed there. We don't use them anymore but unfortunate timing, especially considering we're trying to be a better ad network than the rest. Also I'd like to point out that one of the most pervasive tracking methods is done through form submissions. Anywhere you subm…

Having the insight of of someone who works in online advertising would be interesting and informative. Is there anything you can share that we might find interesting?

Re: Online tracking: A 1-million-site measurement and analysis

#119

Post by TazeTSchnitzel »

pmlnr wrote: post #55
TazeTSchnitzel wrote: post #40

Earlier quoted context omitted.

I think Tor Browser tries to do this for some types of fingerprinting.

The Tor Browser does not send misinformation; it just blocks. A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way.

That's not true, Tor Browser does sometimes lie, see what englehardt linked.

Re: Online tracking: A 1-million-site measurement and analysis

#120

Post by Brakenshire »

englehardt wrote: post #49
crispyambulance wrote: post #39

Earlier quoted context omitted.

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha. https://audiofingerprint.openwpm.com/ > "This page tests b…

Yes, no sound is recorded. Access to the user's mic isn't possible without a permission. If there are sections of the website or paper that seem to imply that, let me know and we'll clarify.

It seems strange that access to the audio stack isn't also behind the permission.
Post reply on HN