Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

141–150 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#141

Post by evan_ »

brudgers wrote: post #137

Google has a vested interest in information leakage. I have a suspicion that the Chromium project expresses a strategic desire to shape the direction of browser development away from stopping those leaks. The idea of signing into the browser with an identity is a core feature and in Google's branded version, Chrome, the big idea is that the user is signed into Google's services. Google only pitches the idea of multip…

Google is already really good at tracking people, why would it introduce vectors that would help other vendors catch up? You would have to demonstrate that Google itself was using these vectors for tracking.

Re: Online tracking: A 1-million-site measurement and analysis

#142

Post by rdancer »

com_kieffer wrote: post #31
nailer wrote: post #21

Earlier quoted context omitted.

So a regular site using, say, mixpanel doesn't need to show a warning?

No, from my understanding cookies are allowed by default only if they are essential to the function of the site. If you only use the cookie to handle logins and sessions then you don't need the warning. I you use the cookie for tracking or analytics then you need the warning. Note that you can use your webserver logs for analytics and that doesn't require the cookie banner.

> Note that you can use your webserver logs for analytics and that doesn't require the cookie banner

In the EU, tracking user IPs actually requires consent. Even logging them does.

Re: Online tracking: A 1-million-site measurement and analysis

#143

Post by rdancer »

JohnTHaller wrote: post #74
kuschku wrote: post #34

Earlier quoted context omitted.

If the cookies are purely technical (say, login cookies), no. If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent. And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already. Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you re…

Something that is best left to the browser to handle... by allowing the user to enable/disable 3rd party cookies. Which we already have. But no, the EU has stupid notifications on basically every single website as a result since everyone uses third party analytics. Why? If you want your analytics to be believed by anyone who wants to advertise with you, invest in you, partner with you, or buy you, they'd damn well be…

The EU Commission and the regulatory agencies actually agree with you. The stupidity is 100% with the web devs and customers.

Re: Online tracking: A 1-million-site measurement and analysis

#144

Post by DavideNL »

ultramancool wrote: post #115

As soon as I saw these APIs being added I immediately dropped into about:config and disabled them. How the hell do these people think this is a good idea to do without asking any permissions? Put these in your user prefs.js file on Firefox: user_pref("dom.battery.enabled", false); user_pref("device.sensors.enabled", false); user_pref("dom.vibrator.enabled", false); user_pref("dom.enable_performance", false); user_pre…

fyi, related: Firefox addon "Privacy Settings" : https://addons.mozilla.org/en-US/firefox/addon/privacy-setti...

Re: Online tracking: A 1-million-site measurement and analysis

#145

Post by vox_mollis »

Brakenshire wrote: post #120
englehardt wrote: post #49

Earlier quoted context omitted.

Yes, no sound is recorded. Access to the user's mic isn't possible without a permission. If there are sections of the website or paper that seem to imply that, let me know and we'll clarify.

It seems strange that access to the audio stack isn't also behind the permission.

Presumably, an application would need to enumerate audio capabilities before even offering the option.

Re: Online tracking: A 1-million-site measurement and analysis

#146

Post by cm3 »

rz2k wrote: post #132
amluto wrote: post #117

Earlier quoted context omitted.

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already:…

Actually, that makes me wonder — if I spoof 5% battery charge will I get fewer annoying features on any sites?

Good idea.

Re: Online tracking: A 1-million-site measurement and analysis

#147

Post by Klathmon »

Freak_NL wrote: post #123
amluto wrote: post #117

Earlier quoted context omitted.

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already:…

> browsers could standardize a list of system fonts available on each platform. It would probably make sense to completely disable support for local fonts unless permitted by the user (for legacy websites that depend on it). All modern browsers support @font-face, and without @font-face you can always depend on the special keywords serif , sans-serif , and monospace ; these will load the system's default font for tha…

I hope there is another way to solve it, as I have installed web-fonts to my PC to improve page loading speed for some common fonts I keep seeing (the most recent being the Roboto font stack from google).

It would be a shame to have to keep re-downloading that every time.

Re: Online tracking: A 1-million-site measurement and analysis

#148

Post by prof_hobart »

aub3bhat wrote: post #121
Fradow wrote: post #65

Earlier quoted context omitted.

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each p…

I never understood panopticlick, even when I repeatedly visit it, it always tells me that "Your browser fingerprint appears to be unique among the 135,054 tested so far." Shouldn't it tell me that my browser is not unique during my 10th attempt considering it has recorded my previous attempts. This warning actually never changes, regardless of duration between consecutive attempts. That can only mean that the panopti…

I thought the same thing, so I did a bit of digging.

Turns out they put a bunch of tracking cookies on your machine without asking you (it is mentioned in the about page though), which seem rather naughty for an organisation promoting online privacy.

When I removed all 4 of them, I get down to being "almost unique". I'm currently down to having the same fingerprint as 1 in 45132.3333333 browsers.

Re: Online tracking: A 1-million-site measurement and analysis

#149

Post by f- »

Although the emphasis on the actual abuse of newly-introduced APIs is much needed, it is probably important to note that they are not uniquely suited for fingerprinting, and that the existence of these properties is not necessarily a product of the ignorance of browser developers or standards bodies. For most part, these design decisions were made simply because the underlying features were badly needed to provide an attractive development platform - and introducing them did not make the existing browser fingerprinting potential substantially worse.

Conversely, going after that small set of APIs and ripping them out or slapping permission prompts in front of them is unlikely to meaningfully improve your privacy when visiting adversarial websites.

Few years back, we put together a less publicized paper that explored the fingerprintable "attack surface" of modern browsers:

https://www.chromium.org/Home/chromium-security/client-ident...

Overall, the picture is incredibly nuanced, and purely technical solutions to fingerprinting probably require breaking quite a few core properties of the web.

Re: Online tracking: A 1-million-site measurement and analysis

#150

Post by cm3 »

Freak_NL wrote: post #123
amluto wrote: post #117

Earlier quoted context omitted.

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already:…

> browsers could standardize a list of system fonts available on each platform. It would probably make sense to completely disable support for local fonts unless permitted by the user (for legacy websites that depend on it). All modern browsers support @font-face, and without @font-face you can always depend on the special keywords serif , sans-serif , and monospace ; these will load the system's default font for tha…

I would go further and disable remote fonts as well since it's not crucial like images and is an attack vector that should have been avoided. The better solution would have been a shared set of web fonts distributed with browsers, just like certificates.
Post reply on HN