Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

251–260 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#251

Earlier quoted context omitted.

The fact of standard templates needn't prevent the possibility of novel templates. But it ought make the prospect slightly more user-controllable. Design-by-committee isn't the alternative to design-by-fuckwits, the present mode. Github and Gmail are both tools which now face the dilemma of gratuitous changes -- many of the recent innovations haven't done much for usability, for numerous reasons (familiarity itself i…

> The fact of standard templates needn't prevent the possibility of novel templates. If your stance is "provide well established default templates, but don't enforce their use", then I have no disagreement. That's not how I interpreted "I've considered what might be necessary to dispose of server-side CSS." > Github, Gmail, Google Maps, etc., are largely the exception to long-form informational content pages. I'm OK…

Defaulting to standard formats, and, on the basis of improved semantic parsing and ranking, promoting them through higher Search rankings (ceterus paribus) would be a Good Thing.

Among the problems of present Web design is that the Web is an error condition (there's a wonderful essay exploring this), and browsers default to allowing broken behavior, even adapting themselves to it, explicitly.

The lack of a publishing gateway, even a minimal one which enforces markup correctness to the Web is a problem.

Layout frippery as pertains textual content has a rather well-supported basis. Complexity is the enemy of reliability, and more complex layouts offer far more ways for sites to break. That's a well-established fact that successive generations eventual learn (or fail to learn) at their peril.

(The phrase "Complexity is the enemy" itself dates to the 1950s. I'd have to check the year, but have remarked on it before. Source is The Economist newspaper.)

I've seen what happens when documents and other media are aimed at very specific readers. Eventually, they rot.

Bog-standard HTML (or some alternative markup -- I'm increasingly partial to LaTeX) tends, strongly, to avoid this.

You're also going back to ignoring points raised earlier in this conversation about security, privacy, and usability.

And yes, if there's a call for an app-based runtime environment, which Google seem quite bent on producing, well, that's a thing. But no need to fuck up the game for the rest of us.

And models which prove useful could and should be incorporated.

I'm pretty gobstopped, for example, that 25 years after its introduction there's no affordance in HTML for notes (e.g., footnotes, endnotes, sidenotes, as presentation is a client issue), or for hierarchical presentation, e.g., of comments threads.

On can create nested hierarchies, but one with an integrated expand/collapse/sort/filter functionality doesn't exist. This was extant in Usenet newsreaders and mail clients 20 years ago. Why not the Web?

Re: Online tracking: A 1-million-site measurement and analysis

#252

Earlier quoted context omitted.

> My most common response when landing on a website is to sigh, roll my eyes, and dump it to something more readable. Firefox's Reader Mode. Pocket. Straight ASCII text. w3m. > My half-serious response to this is to create a new web browser embodying these and a few other principles. In all seriousness, I wonder if spoofing a mobile client (easily done through most browser developer console's or an extension) might i…

The majority of my browsing is mobile these days. 10" tablet. Even sites which are otherwise well-designed (Aeon and Medium come to mind) insist on dark-pattern behavior such as fixed headers/footers. Again: straight to reader-mode for that. Except for the sites which break that. Violet Blue's Peerlyst comes to mind: https://plus.google.com/104092656004159577193/posts/PWuVmx2r... (Screenshots contrasting site and a R…

> 10" tablet.

Really? That seems unlikely. I mostly see people use phones, and small tables, so > Except for the sites which break that. Violet Blue's Peerlyst comes to mind

There will always be someone thwarting best practices, just as there will always be those that skirt or break the rules in systems that are less lenient. There's not a lot of recourse, you want what they've got, so you are at their whim unless you can work around their imposed difficulties or find another source.

> I've written directly with the site designer who seems utterly insensate to why 14pt font isn't in fact a majickal solution to all readability problems.

See above :/

> HN itself is only barely usable.

Yeah, but I think the reasoning behind HN is slightly different. I suspect HN assumes you will takes some appropriate steps to optimize your use of the platform. Instead of "we will tailor the view to our artistic vision and you shall not besmirch it!" it's more of a "we believe in user agency, so get off your ass and make it better for yourself." Depending on your point of view, skill level, and site usage, you might find one more appealing than the other.

Personally, I use one of the browser extensions that allows collapsible comments, inline replying, and user info on hover over username.

Re: Online tracking: A 1-million-site measurement and analysis

#253
post #3

After reading this it makes me want to disable JavaScript entirely, along with cookies, and go back to text browsing. I've been using Ghostery on my phone, it's been pretty good.

I'd say that's pretty needless. I run ghostery and ABP simultaneously and they do a great job catching these trackers.

The downside of having no JS compared to accidentally a getting fingerprinted is a no brainer for me. Modern web is pretty useless without JS for me.

Re: Online tracking: A 1-million-site measurement and analysis

#254

Earlier quoted context omitted.

> The fact of standard templates needn't prevent the possibility of novel templates. If your stance is "provide well established default templates, but don't enforce their use", then I have no disagreement. That's not how I interpreted "I've considered what might be necessary to dispose of server-side CSS." > Github, Gmail, Google Maps, etc., are largely the exception to long-form informational content pages. I'm OK…

Defaulting to standard formats, and, on the basis of improved semantic parsing and ranking , promoting them through higher Search rankings (ceterus paribus) would be a Good Thing. Among the problems of present Web design is that the Web is an error condition (there's a wonderful essay exploring this), and browsers default to allowing broken behavior , even adapting themselves to it, explicitly . The lack of a publish…

I don't really have any issue with most of what you are saying, except "The lack of a publishing gateway, even a minimal one which enforces markup correctness to the Web is a problem.", and my issue with that really depends on how what you mean by "problem". Sure, a publishing gateway would enforce some conformity, and some level of conformity is beneficial (I'll even allow that more conformity than we currently have would be beneficial), but too much conformity is not. Too much conformity breeds stagnation. So i'll re-frame my stance: How do you enforce or encourage conformity without going to far? How do you keep the entity or entities you've entrusted this task to from going to far?

> You're also going back to ignoring points raised earlier in this conversation about security, privacy, and usability.

I was just working off your points, which all seemed to be about usability. I've been treating this discussion as somewhat distinct from that one. I can definitely make arguments about conformity having it's own negative aspects with regard to security.

Re: Online tracking: A 1-million-site measurement and analysis

#255
post #237

Earlier quoted context omitted.

Consider the implications of what this means though. If sites are not free to innovate, things like Github and Gmail wouldn't exist . They only reason we aren't stuck with a Hotmail interface circa 2002 is because people were able to innovate on the web. To lock down CSS (or Javascript, there's no reason I can think of you would lock CSS and not Javascript) to a specific set of capabilities is both a statement that i…

But that's not what I'm suggesting. We can begin by actually reviving browser user style sheets and having a well known and respected sets of names will allow for appropriate styling on the client.

I'm all for user style sheets, I see no problem in people overriding site defaults. Re: sites breaking existing functionality while changing, maybe I just don't see big regressions as having happened in Gmail (which I always have open) or Github (which I rarely have open, as my source is in a local repo, but I visit on a regular basis from links here and elsewhere). It is interesting that you mention keyboard mouse combos, when to my knowledge both sites have put specific effort into making keyboard shortcuts that work and allow some level of navigation without any mouse.

Re: Online tracking: A 1-million-site measurement and analysis

#256
post #168

Earlier quoted context omitted.

Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214... Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Turning that mode in…

> Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting Obviously. Google is in the business of destroying your privacy: Advertising revenue is maximized when the consumer is/remains completely tracked and profiled at all times. Other browser vendors which are not in the ad business could use this as an opportunity to differentiate themselves from Google: Int…

Google already has that info without these hacks.

In fact it is in googles best interest to remove these security holes so other advertisers lose whatever minor advantage they can get.

Re: Online tracking: A 1-million-site measurement and analysis

#257
post #117

Earlier quoted context omitted.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already:…

Exactly - most sites don't need my exact location, or access to WebAudio or whatever. It should be a red flag for most sites, however most users won't know how to react in such a situation.

Re: Online tracking: A 1-million-site measurement and analysis

#258

Earlier quoted context omitted.

The majority of my browsing is mobile these days. 10" tablet. Even sites which are otherwise well-designed (Aeon and Medium come to mind) insist on dark-pattern behavior such as fixed headers/footers. Again: straight to reader-mode for that. Except for the sites which break that. Violet Blue's Peerlyst comes to mind: https://plus.google.com/104092656004159577193/posts/PWuVmx2r... (Screenshots contrasting site and a R…

> 10" tablet. Really? That seems unlikely. I mostly see people use phones, and small tables, so > Except for the sites which break that. Violet Blue's Peerlyst comes to mind There will always be someone thwarting best practices, just as there will always be those that skirt or break the rules in systems that are less lenient. There's not a lot of recourse, you want what they've got, so you are at their whim unless yo…

>> 10" tablet.

> Really? That seems unlikely. I mostly see people use phones, and small tables, so Ignore that, I misread the sentence. I thought you were saying most mobile browsing is with a 10" tablet. I'm not trying to tell you that you're wrong about your own reported habits...

Re: Online tracking: A 1-million-site measurement and analysis

#259

There is an acceptable tradeoff between pseudo anonymous access through browsers vs non-anonymous access through native apps. To interpret this research as reason for crippling web or browsers would be a giant mistake. Crippling browsers will only work against users, who will be then forced into installing apps by companies. Two popular shopping companies in India exactly did this, they completely abandoned their web…

> Two popular shopping companies in India exactly did this, they completely abandoned their websites and went native app only. This combined with large set of permission requested by apps lead to worse experience in terms of privacy for consumers.

I'm surprised nobody has commented on your comment yet. I was in a meeting just this morning where my interlocutor assured me that over 70% of advertising in 10 years will be native apps since everything else is getting blocked or abandoned (and presenting it as an opportunity to do all the stuff you "can't do anymore" on browser).

Re: Online tracking: A 1-million-site measurement and analysis

#260
post #196

Earlier quoted context omitted.

On iOS I use safari and disable access to location etc, also disable cookies, advertisementID, etc, etc. Then I feel quite save when using a VPN. Does that still hold?

Yes. Changing common settings might in fact even make you stand out _more_. Check the EFF's Panopticlick [0] to see how your specific configurations leaks identifying information. [0] https://panopticlick.eff.org/

This week’s http://www.heise.de/artikel-archiv/ct/2016/11/144_kiosk states “Viele .. fingerprinting-verfarhen laufen auf Mobilgeräten ins Leere. … Zudem gibt es kein Mittel, mit dem man über gezielt gegen Fingerprinting über die Sensoreigenschaften vorgehen kan - weder unter iOS noch unter Android.” And then it concludes recommending Adblockers for Safari on iOS noting that it depends on the quality of the block-list. It also mentions that adblockers on iOS don’t work in Apps, other than in Android.

IOW most fingerprinting fail on mobile devices and that sensors, eg batteries, are one of the few remains for fingerprining on iOS. Do you disagree with Heise? Could you please substantiate your statements regarding iOS fingerprinting?

Post reply on HN