Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Saying, ‘We Take Your Privacy and Security Seriously’

techcrunch.com

Post reply on HN
Print view View original

61–70 of 112 posts

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#61

Post by majewsky »

atoav wrote: post #14
vntok wrote: post #4

Earlier quoted context omitted.

Tracking cookies provide incommensurable value to site owners for improving the quality of their web properties, which ultimately benefits users. Example abound: finding out where people are the most frustrated (high exit rates), what content drives the most interest (page views), what content is missing or inaccurate (high bounce rate and low visit duration for visitors coming from Google), how they are using the si…

While I understand the need for reliable and granular information on your users, it should technically possible to get most of that without selling your users off to third party services whose practies you never checked for yourself. Furthermore it should be possible to sell ad space without directly embedding potentially malicious stuff from foreign whose content might change on such a granular level even you as the…

> It is possible to verify real users without training the AI models of monopolist webcompanies.

Honest question: How?

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#62

Post by sleavey »

dkersten wrote: post #27
emilis_info wrote: post #5

Also stop saying "Before you go further..." we need to share your data with tens of corporations. /s Note to non-EU users: Techcrunch is completely blocking the page with a popup asking me to share my location and behavioral data (for advertising purposes) with a probably very long list of companies (something called "Oath" family). The logos shown are for Yahoo, Aol, Autoblog, Huffpost and Engadget. Nah. I'll skip a…

The Oath websites and Medium are on my mental blacklists of sites I simply don’t bother with. The content isn’t good enough to care. It does mean I hit comment threads like this and can’t read the article. Oh well, I’m trying to reduce my internet time anyway.

If I get these redirect popups (not just popups over the content, which I can remove with Nuke Anything [1] or use Firefox's distraction free mode), I either just don't visit the site if I don't care that much about its content, or I open a private browser window, accept whatever popups they present, read the article then close the window to purge all their tracking shit.

[1] https://addons.mozilla.org/en-GB/firefox/addon/nuke-anything...

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#63

Post by mnw21cam »

Fnoord wrote: post #22
_rrnv wrote: post #13

Earlier quoted context omitted.

Oath has one of the more nagging GDPR pop-ups. I like Slashdot, they at least give an opt-out option to access the content. On TC you are either opting-in or forbidden to access. And it's not like a technical necessity either. My company, ProcessOne, has a Wordpress blog that doesn't set any cookies or local storage. It uses Google Analytics and internal WP stats. But they are properly configured to not track, just m…

> On TC you are either opting-in or forbidden to access. And it remains to be seen whether that is legal.

I don't think there is any "remains to be seen" about it. It's illegal.

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#64

Post by dotancohen »

Fnoord wrote: post #22
_rrnv wrote: post #13

Earlier quoted context omitted.

Oath has one of the more nagging GDPR pop-ups. I like Slashdot, they at least give an opt-out option to access the content. On TC you are either opting-in or forbidden to access. And it's not like a technical necessity either. My company, ProcessOne, has a Wordpress blog that doesn't set any cookies or local storage. It uses Google Analytics and internal WP stats. But they are properly configured to not track, just m…

> On TC you are either opting-in or forbidden to access. And it remains to be seen whether that is legal.

According to the GDPR, it is not legal. What remains to be seen is whether the EU will enforce or not.

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#65

Post by Fnoord »

mnw21cam wrote: post #63
Fnoord wrote: post #22

Earlier quoted context omitted.

> On TC you are either opting-in or forbidden to access. And it remains to be seen whether that is legal.

I don't think there is any "remains to be seen" about it. It's illegal.

Tweakers.net had their lawyer take a look at it, and they claim it is legal. I'd love to see it on trial.

My take on it is it is BS and a cost/benefit analysis.

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#66

Post by kilburn »

majewsky wrote: post #61
atoav wrote: post #14

Earlier quoted context omitted.

While I understand the need for reliable and granular information on your users, it should technically possible to get most of that without selling your users off to third party services whose practies you never checked for yourself. Furthermore it should be possible to sell ad space without directly embedding potentially malicious stuff from foreign whose content might change on such a granular level even you as the…

> It is possible to verify real users without training the AI models of monopolist webcompanies. Honest question: How?

I'm pretty sure that "verify real users" was about captchas. Solving that problem in general is probably impossible, I grant you that. However, reaching a good-enough solution for a particular site is often doable.

In increasing order of strictness and complexity:

- Use hidden/visible field shenanigans

- Ask questions your audience should be able to answer (chess-captchas, maths-questions, etc.)

- Require registration with e-mail validation

- Require registration with SMS validation

- Make that part of the site invitation-only

- Use some kind of trust-based system (e.g.: users can invite other users)

- Manually approve stuff

- Ask for ID scans and manually check them

- Combinations of the above

Unless you are a juicy enough target (not many sites are), just a few measures will get you to that good-enough point. Of course, implementing any of the above will be harder than slapping a recaptcha and calling it a day ;)

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#67

Post by dredmorbius »

emilis_info wrote: post #5

Also stop saying "Before you go further..." we need to share your data with tens of corporations. /s Note to non-EU users: Techcrunch is completely blocking the page with a popup asking me to share my location and behavioral data (for advertising purposes) with a probably very long list of companies (something called "Oath" family). The logos shown are for Yahoo, Aol, Autoblog, Huffpost and Engadget. Nah. I'll skip a…

https://outline.com/https://techcrunch.com/2019/02/17/we-tak...

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#68

Post by mattkevan »

jjjensen90 wrote: post #33
arethuza wrote: post #30

Earlier quoted context omitted.

I just realised I had been reading "Oath" as "OAuth" - not that I am aware of visiting the site but I wonder if they chose that name to get some additional credibility?

Probably not directly tied to its similarity to OAuth, but I'm sure the name Oath came from thousands of man hours of brand psychology assessment and audience testing. Oath is the stapled together corpses of the adtech of Verizon and AOL and was/is ridiculed for being a poor name choice, but branding decisions at corporations of that size go through so many committees and data points and marketing schlubs, who knows…

  Oath, noun - profane or obscene expression usually of surprise or anger.
It's an apt name, because it describes exactly what I say whenever I land on one of their sites.

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#69

Post by arpinum »

Spent 10 minutes trying to prevent TC / Oath from using my personal data. 5 clicks and proving I'm not a robot before reaching a privacy dashboard. Except, to actually set my preferences to not track me I first need to agree to tracking! And if I don't allow 3rd party cookies to track me I cannot withdraw consent.

GDPR was meant to allow users to refuse consent without detriment, and to not to force consent to use the service. Oath clearly violates GDPR, yet regulators have done nothing in 10 months.

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#70

Post by kkm »

Lot of companies are shooting themselves in their own foot by sharing critical data with a plethora of third-parties.

They put sensitive information like username, orderid in the URL which is then shared with all the third-parties on that page, simply because referrers are not sanitized.

This happens:

- Without user-consent

- More dangerously without the companies knowing it too.

On reporting, the companies do not want to fix these issues.

Shameless plug: You can find some of such cases, which I've been trying to highlight to the companies:

- https://medium.freecodecamp.org/how-airlines-dont-care-about...

- https://threatpost.com/def-con-2018-telltale-urls-leak-pii-t...

- https://cliqz.com/en/magazine/lufthansa-data-leak-what-a-sin...

- https://fosdem.org/2019/schedule/event/web_extensions_exposi...

Post reply on HN