Cname cloaking, a disguise of third-party trackers

Banks rely on a very small number of software vendors, so that the apparent abunance of bank options is all but eliminated at the middleware tier.

"What Is Your Bank’s Security Banking On?"

FIS, Fiserv or Jack Henry ... collectively control approximately 70 percent of the market for bank core processors (according to FedFIS.com, Fiserv is by far the largest).

https://krebsonsecurity.com/2018/03/what-is-your-banks-secur...

Covered at HN:

https://news.ycombinator.com/item?id=20203482

I don't get one thing. Isn't CNAME also bad for "them". I mean with CNAME, they can serve adds, cookies ... from site subdomain, bypassing blockers. But how will they track users on different sites, like user vising website1 and then website2? Since their tracking cookies are now part of website1, they won't be sent to website2.

I mean is there any replacement for them, not using cookies? Because cookies seems to be the only global storage for user identification data. Since tracking script was hosted on their domains (and included into websites with script tag), cookies were shared across all site, that included that tracking script. IMO when they switch to CNAME trick, they will loose this capability.

On top of using Firefox as my default browser everywhere because I want to see it have more than the 5% user share mentioned at the end of the article, I've additionally replaced Chrome itself with Brave when I need Chromium rendering. I have no idea if BAT coins will be a thing, but the idea is neat (and relevant to your comment) and the care towards privacy plus the ability to turn all the BAT stuff off is satisfactory.

More broadly, though, I agree with your comment and think there are additional unlisted problems.

I pay for Ars Technica because they offer an amazing cross-format (HTML, RSS, PDF, etc) clean browsing experience for paying customers plus sent a branded Yubikey plus had clear online cancel buttons instead of hoops like other publishers. In my personal utopia, every news site would be served in this cross-format ad-free fashion.

I honestly wish they'd send a new branded Yubikey every year so I'd always have an important branded physical reminder of their existence as its the best and most useful tschotske I've received as a thank-you-for-subscribing gift (and probably likely so for others in the HN crowd).

Ars Technica is one of the few sites I regularly visit directly (just like I visit hckrnews.com to often and directly). Just like here on HN, I directly visit for the content curation and occasional comment (both of which is better than social media algorithms).

Which lead me to the consideration of a third problem...

3) Users try before the buy. You can only begin the process of receiving money after they've read enough content.

I'm surprised I haven't seen more cryptocurrency-based $1/week type subscriptions to unlock the content/features/etc for a week at a time (or perhaps forever, if a user sent enough cryptocurrency).

> Or we could make all of that illegal

I don't see a good way to do that, at least.. a way that's practical to actually enforce. As it is, the FTC is fairly toothless and is better at offering guidelines than policing.

> as it does in every field except for the web

Well.. that's just because they have dedicated account executives and sell advertising through a combination of direct solicitation and much smaller amount of "walk-in" business, that's not practical for all creators or formats.

> Web is the one weirdo market with tracking.

This has always been the holy grail for advertising, the other industries put up with statistical "audience modelling" only because they have to; however, working in one of those 'other fields' I can tell you.. our account executives will take as much direct tracking data as they can get. e.g. "Have you installed our Radio App?!"

> Make that illegal and it will be good like all the other markets.

I feel like we lost the fight a long time ago.. I remember when the 'Flash Blocker' plugin was a great tool. Unfortunately, too many modern sites are entirely reliant on JS in a way they never really were for Flash and the idea of using 'Script Blocker' that's on by default makes navigating the web exceptionally difficult.

It's too bad, because it's probably the right solution.. why should the sites we visit have the right to execute programs on my computer by default?

> It doesn't need to have every cname in it. The cname resolves to the actual "bad" domain, which should be in your list already.

That doesn't help if dnsmasq only checks the incoming request against the list, and not the whole cname chain of the result.