Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

111–120 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#111

Post by e2le »

homero wrote: post #16
kerpele wrote: post #15

I can’t believe Ars Technica would do this. Do they not realize who their audience is?

That also means most of their audience blocks ads. What are they to do?

I think simple ads most people are OK with however you start to lose people when those ads track your movements like a creepy stalker, sell that data without your knowledge or consent, and tax your system with resource hungry js that adds precious seconds to your wait only to be served with a zero day or other malware.

Sites and ad networks have being engaged in a abusive relationship with users for a long time now and it's wrong to expect them to not try to protect themselves. If you want users to stop blocking your ads then stop serving them ads worth blocking.

Re: Cname cloaking, a disguise of third-party trackers

#112

Post by jefftk »

mr_toad wrote: post #104
A1kmm wrote: post #88

Earlier quoted context omitted.

In the vast majority of cases integration is by the including a script controlled by the advertising network in the page they are advertising on. So for the purposes of the browser security model, the script already runs in the domain of the host site. It can directly read any non-HttpOnly cookies, and can make any request it likes using XMLHttpRequest to APIs on the host site using the user's cookie without relying…

> The only very minor difference between first and third party script inclusion is access to HttpOnly cookies That’s not a minor difference, http only is used for authentication.

Correct. Authentication should always be via cookies with "HttpOnly" set, since (a) the cookie is not needed client side and (b) it somewhat limits the damage XSS can do.

Re: Cname cloaking, a disguise of third-party trackers

#113

Post by techslave »

zelly wrote: post #54

I knew something like this would come up. I always wondered why ad/tracking companies never proxied through the first-party domain (or in a more extreme case, the first-party server itself) to skirt adblock. Suppose you load example.com/article. Ad Agency serves ad/tracking assets from example.com/article/Zqj7MOm.js. When you reload, it serves from example.com/article/llc9h76.js. How do you block it? You can't. Getti…

no. the reason it hasn’t happened is because a) it’s very very hard (ie even harder) to detect click fraud. and b) you can’t track the user.

Re: Cname cloaking, a disguise of third-party trackers

#114

Post by pitay »

brian-armstrong wrote: post #64
zelly wrote: post #54

I knew something like this would come up. I always wondered why ad/tracking companies never proxied through the first-party domain (or in a more extreme case, the first-party server itself) to skirt adblock. Suppose you load example.com/article. Ad Agency serves ad/tracking assets from example.com/article/Zqj7MOm.js. When you reload, it serves from example.com/article/llc9h76.js. How do you block it? You can't. Getti…

As I understand it, ad companies and the people who sell their websites to ad companies have some base level of distrust of one another, which has kept them from integrating like this. Ad companies want to serve the code to be sure that no click fraud is occurring, and people who run websites don't want to completely hand over their domain. But it's easy to see them forging this alliance if ad delivery depended on it…

This may be tremendously ignorant but...

What is to stop ad tech companies creating a cryptographically secured reverse proxy device[1] that clients can install in their network between the web server and requests from the internet?

The ad tech company only has to trust that their device is secure and the company that sells their website doesn't have to give up control of their domain or anything else.

They would have to isolate the ad tech device from the rest of the network and only allow it to communicate to the web server inside the network and the ad tech server outside their network. If something goes wrong with the device then it is trivial for the web serving company to bypass it.

-------

As is mentioned in the grandparent comment, this allows anything to be done to the content being served from the website and not only domains cannot be trusted, individual URLS cannot either. Ad blockers will have to rely on examining the content directly even more than they already do. This would make it much less scalable for the ad blockers to deal with, they have to identify ad content individually, by their signatures or page structure in the best case, or examining arbitrary code behaviour in a worse case. Ad blockers may then have to deal with identifying ad content which changes as fast or faster than new ads appear, which is a lot worse than the relatively few(and relatively static) domains, URLS, bits of HTML and Javascript that are there now. Ad blockers may lose eventually due to incomputability, but who knows.

-------

[1] Using a TPM is one possibility

Re: Cname cloaking, a disguise of third-party trackers

#115

Post by bradleyjg »

QUFB wrote: post #76
jefftk wrote: post #42

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking o…

Honest question, and I'm not making any value judgements: Do you have any moral issues working an adtech?

I get that you have the caveat and all, but seriously? The tech industry has widespread cooperation with a regime in China that is brutalizing Hong Kong and committing ethnic cleansing of the Uigurs--and you want to know if he can sleep at night because he codes software to show ads for socks to people that don't want to see ads (but somehow can't bring themselves to live without content that's ad supported)?

Re: Cname cloaking, a disguise of third-party trackers

#116

Post by acdha »

alkonaut wrote: post #90
homero wrote: post #16

Earlier quoted context omitted.

That also means most of their audience blocks ads. What are they to do?

The answer I keep returning to: if shady ads is what keeps your business running, stop running your business. Switch off the lights and the servers and go home.

That’s too simplistic a take: they aren’t running shady ads and unlike many sites they allow you to you subscribe and not see ads at all. Unfortunately, large chunks of the public — especially tech site visitors — have been conditioned to think of content as free, and the adtech bubble hasn’t pooped yet so we can’t reverse that trend.

Re: Cname cloaking, a disguise of third-party trackers

#118

Post by dmm »

bradleyjg wrote: post #115
QUFB wrote: post #76

Earlier quoted context omitted.

Honest question, and I'm not making any value judgements: Do you have any moral issues working an adtech?

I get that you have the caveat and all, but seriously? The tech industry has widespread cooperation with a regime in China that is brutalizing Hong Kong and committing ethnic cleansing of the Uigurs--and you want to know if he can sleep at night because he codes software to show ads for socks to people that don't want to see ads (but somehow can't bring themselves to live without content that's ad supported)?

> (but somehow can't bring themselves to live without content that's ad supported)?

Every day that becomes less and less of an option and presenting it as an option is disingenuous. Are you seriously suggesting that people live without search engines?

I think it's valid to question the role of cars in our society even if the critic took a car to the meeting, for example.

Re: Cname cloaking, a disguise of third-party trackers

#119

Post by jhhh »

jefftk wrote: post #78
QUFB wrote: post #76

Earlier quoted context omitted.

Honest question, and I'm not making any value judgements: Do you have any moral issues working an adtech?

I've written some about this here: https://www.jefftk.com/p/value-of-working-in-ads

Unpersonalized ads can still serve the same democratic funding model you're identifying as the main positive reason for online advertising's existence. You present a false choice between obnoxious (visibility intrusive) ads versus these odious information gathering schemes. Since the latter make more money and people hate obnoxious ads we must choose personalization. Thankfully we're now fully aligned with how Google has implemented their ad targeting.

Hypothetically if congress could ban both obnoxious and targeted ads (somehow) leaving us with the unpersonalized newspaper model of ads would you be for or against that bill?

Re: Cname cloaking, a disguise of third-party trackers

#120

Post by mmastrac »

hk__2 wrote: post #85
fwxwi wrote: post #83

What's the difference between this and what Instart Logic has been doing for years now? https://github.com/gorhill/uBO-Extra#purpose

Wow it goes even further: https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO... > Instart Logic will detect when the developer console opens, and cleanup everything then to hide what it does. I had to trick IL's script into thinking the dev console was not open to take the pic above.

How does it do this?
Post reply on HN