Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

101–110 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#101

Post by aledalgrande »

dylz wrote: post #51
bsysop wrote: post #46

Earlier quoted context omitted.

Do you think ad companies will really trust reverse-proxied ad traffic? Seems like a tremendous opportunity for fraud. Right now with user agents hitting ad servers directly, there's much less opportunity for content publishers to fake impressions and clicks.

They already do - Instart Logic is one of the reverse proxies dedicated to serving ads first-party. For tracking and invasive device tracking (WebGL, plugin enumeration, Canvas, audiocontext, WebRTC, WebSocket-based portscanning of your LAN CIDR acquired from WebRTC, ...) there's Shape and Distil that both do inline reverse proxying.

Is this form of aggressive identification without consent not going against the GDPR?

Re: Cname cloaking, a disguise of third-party trackers

#102

Post by jefftk »

dessant wrote: post #98
jefftk wrote: post #86

Earlier quoted context omitted.

I do the work I do because it allows me to donate: https://www.jefftk.com/donations I would not do this work if I thought it was harmful, and if I decided it was harmful there are many jobs I could take instead. I'm open to being convinced that my work is net negative! I've quit Google before: https://www.jefftk.com/p/leaving-google-joining-wave

You're contributing to tech that erodes people's privacy, even when they actively fight against it. Don't delude yourself with net positives. The harm your employer causes still affects people, regadless of the useful things you may work on at Google, or the donations you give.

> when they actively fight against it

While this is definitely true for some adtech vendors, none of the work I do is in that category, and to my knowledge none of the work at my employer is either.

(Still speaking only for myself)

Re: Cname cloaking, a disguise of third-party trackers

#103

Post by linuxdude314 »

cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

I don't think you understood the article. Pihole or any blocking DNS server based on blacklists won't help here (thats the point).

By using random, frequently updating CNAME's it effectively defeats the mechanism Pihole uses.

You could still block IP addresses of the advertisers, but often time's they don't do BGP, so they aren't going to have blocks under the same ASN you can simply block.

It's a nuanced and challenging problem for sure.

Re: Cname cloaking, a disguise of third-party trackers

#104

Post by mr_toad »

A1kmm wrote: post #88
x0x0 wrote: post #57

Earlier quoted context omitted.

js running on your domain can read eg login cookies at least if you cname definitelynotads.yourdomain.com to js.ads.com, the javascript running on definitelynotads... can't read host-only login cookies on yourdomain.com.

In the vast majority of cases integration is by the including a script controlled by the advertising network in the page they are advertising on. So for the purposes of the browser security model, the script already runs in the domain of the host site. It can directly read any non-HttpOnly cookies, and can make any request it likes using XMLHttpRequest to APIs on the host site using the user's cookie without relying…

> The only very minor difference between first and third party script inclusion is access to HttpOnly cookies

That’s not a minor difference, http only is used for authentication.

Re: Cname cloaking, a disguise of third-party trackers

#105

Post by rnoises »

jefftk wrote: post #78
QUFB wrote: post #76

Earlier quoted context omitted.

Honest question, and I'm not making any value judgements: Do you have any moral issues working an adtech?

I've written some about this here: https://www.jefftk.com/p/value-of-working-in-ads

You could argue that display ads in general are a positive. (I personally disagree, but that I can see how reasonable people might see it differently.) But tracking is not close to being ethical. The difference is between someone handing out pamphlets for a new baby care product because you are walking into a baby clothing store, and one handing you the same pamphlet because he has gone through your trash and found your pregnancy test results.

Re: Cname cloaking, a disguise of third-party trackers

#106

Post by nugget »

IAM2019 wrote: post #87

The article explains that trackers traditionally loaded some external JS which then phoned home and tracked users via third-party cookies. I would like to point out that it has never been the case for Google Analytics and possibly other trackers. The developers of a website are supposed to copy/paste the Google Analytics snippet directly into their own JS, such that GA has access to first-party cookies. And then GA p…

How does the centralized ad server track the user as they move from site A to site B, since no cross-domain cookies can be used? Without resorting to fingerprinting which could be circumvented by the client. Absent behavioral profiles and persistent tracking, most ad formats are worth very little. Isn’t limiting all communication to the first party domain a form of sandboxing?

Re: Cname cloaking, a disguise of third-party trackers

#107

Post by throwaway7919 »

jefftk wrote: post #78
QUFB wrote: post #76

Earlier quoted context omitted.

Honest question, and I'm not making any value judgements: Do you have any moral issues working an adtech?

I've written some about this here: https://www.jefftk.com/p/value-of-working-in-ads

I work in ad-tech too, so I'm not judging you. The donations you've made are awesome, and I can see you've clearly thought a lot about how to best direct your money. But I think you're missing a few downsides.

The digital marketing/analytics industry doesn't spend a lot of time thinking about how to secure all that data they're collecting, and data breaches are happening more and more frequently. A lot of this data is supposedly anonymized, but often can be tied back to identifying information.

I would consider Google to be an exception here, as they have some of the best security people in the world working for them. But they are just that: an exception. Don't forget that the industry that Google enables is a lot less ethical (and a lot less competent) than Google itself.

There are other downsides too (e.g. the impact of advertising on editorial integrity, and the ethics of using political ads to tip the scales in an election).

Re: Cname cloaking, a disguise of third-party trackers

#108

Post by syshum »

snailmailman wrote: post #17
syshum wrote: post #14

Earlier quoted context omitted.

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

You can change your DoH resolver, so you could setup a raspberry pi as a DoH server theoretically, and still keep the benefits of a PiHole. Mozilla is making CloudFlare the default but they aren't forcing it, you can use another server.

My Browser should not be doing this at all in the first place,

I should not have to dig deep into the internals of Firefox to opt-out of sending all my traffic to CloudFlare, a company proven time and time again to be pro-censorship and anti-competitive

Re: Cname cloaking, a disguise of third-party trackers

#109

Post by [deleted] »

jefftk wrote: post #42

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking o…

[deleted]

Re: Cname cloaking, a disguise of third-party trackers

#110

Post by chii »

alkonaut wrote: post #90
homero wrote: post #16

Earlier quoted context omitted.

That also means most of their audience blocks ads. What are they to do?

The answer I keep returning to: if shady ads is what keeps your business running, stop running your business. Switch off the lights and the servers and go home.

easy for you to say when you're not financially involved in said company.
Post reply on HN