Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

181–190 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#181

Post by depr »

air7 wrote: post #180

> It also only takes 2 minutes to change dg3fkn.website.com to 3j4vdl.website.com (Hell, you can probably automate this). We mentioned above how much work it takes to gather all subdomains being used as a front for CNAME Cloaking. Now imagine they change every week, every day, or every hour. It’s just impossible to keep track. That's fear mongering. The ad company can't pester their clients to make changes to the DNS…

>The ad company can't pester their clients to make changes to the DNS on a regular basis.

Many DNS providers have APIs.

>And clients won't give control of their DNS to ad company, so automation is also not really possible.

Sure they will. Or they'll use another party that does it. They already add JS from the ad provider that does god knows what to all their pages, and give full control over their content to Cloudflare. So why wouldn't they give an ad provider API access to their DNS?

Re: Cname cloaking, a disguise of third-party trackers

#182

Post by earthboundkid »

jefftk wrote: post #176
earthboundkid wrote: post #131

Earlier quoted context omitted.

As a developer in publishing, I would support that bill in a heartbeat. Tracking means you can target a niche market without paying for niche content. It’s terrible for publishers and consumers. It’s good for ad people.

> Tracking means you can target a niche market without paying for niche content. It’s terrible for publishers and consumers. This only seems partly right to me. Let's say someone wants to sell fishing equipment. The traditional way of doing this is to buy ads on fishing sites. So now my fishing equipment purchases make there be more writing about fishing; yay! Then one of the fishing websites decides to put a trackin…

Good argument. I will think about it more.

Re: Cname cloaking, a disguise of third-party trackers

#183

Post by earthboundkid »

pas wrote: post #167
earthboundkid wrote: post #129

Earlier quoted context omitted.

Or we could make all of that illegal and have an ad ecosystem that works for publishers and consumers as it does in every field except for the web (print, broadcast, podcasts, billboards—all work without JS and are great for consumers). Web is the one weirdo market with tracking. Make that illegal and it will be good like all the other markets.

The GDPR does that. It doesn't matter if you have the data in your own DB, you can't utilize it for purposes you haven't secured informed consent for.

GDPR is a good first step.

Re: Cname cloaking, a disguise of third-party trackers

#184

Post by Thorrez »

ignoramous wrote: post #81
poitrus wrote: post #77

Earlier quoted context omitted.

1. Check https://github.com/nextdns/nextdns 2. JS can’t set a custom resolver, I don’t think DoH can help with that. If yes, source please

Thanks Olivier. Re: nextdns-cli: I think you may have misunderstood my question. I was more curious abt how the backend worked: Do you run one unbound instance per nextdns-configuration? Re: DoH: I was pointing to the fact that XHR request to 1.1.1.1 (or any DoH provider that supports application/dns-json ) can now resolve domain names. In this case, there's no reliance on either browser's DoH resolver or resolver se…

For DoH there are some problems in addition to what poitrus said.

In order to make an XHR to 1.1.1.1 you need to be running javascript. But the whole goal of these CNAME and other evasions is to run javascript (aka not get blocked by browser extensions and such). So they already need to achieve their goal before they can make the XHR. Since they've already achieved their goal, why are they bothering with additional complexity?

Adblocking browser extensions could probably block XHR DoH requests that have adcompany.com in the query parameters.

This isn't really specific to DoH. Any database that can be queried by an XHR could be used instead of DoH for this purpose.

Re: Cname cloaking, a disguise of third-party trackers

#185

Post by jefftk »

earthboundkid wrote: post #129
jefftk wrote: post #42

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking o…

Or we could make all of that illegal and have an ad ecosystem that works for publishers and consumers as it does in every field except for the web (print, broadcast, podcasts, billboards—all work without JS and are great for consumers). Web is the one weirdo market with tracking. Make that illegal and it will be good like all the other markets.

Offline isn't as different as you might think:

2012-02-19: Almost every major retailer, from grocery chains to investment banks to the U.S. Postal Service, has a “predictive analytics” department devoted to understanding not just consumers’ shopping habits but also their personal habits, so as to more efficiently market to them. “But Target has always been one of the smartest at this,” says Eric Siegel, a consultant and the chairman of a conference called Predictive Analytics World. “We’re living through a golden age of behavioral research. It’s amazing how much we can figure out about how people think now.” -- http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...

2016-02-28: Pass a billboard while driving in the next few months, and there is a good chance the company that owns it will know you were there and what you did afterward. Clear Channel Outdoor Americas, which has tens of thousands of billboards across the United States, will announce on Monday that it has partnered with several companies, including AT&T, to track people’s travel patterns and behaviors through their mobile phones. -- https://www.nytimes.com/2016/02/29/business/media/see-that-b...

2019-03-07: Location-tracking technology can now monitor people so precisely that retailers know, for instance, which customers visited a fitting room but never made it to the cash register. -- https://www.cnbc.com/2019/03/08/how-retailers-can-track-your...

Re: Cname cloaking, a disguise of third-party trackers

#186

Post by privateSFacct »

aledalgrande wrote: post #134
privateSFacct wrote: post #133

Earlier quoted context omitted.

When I browse European sites I'm always having to click through permissions - I imagine most folks are on autopilot by now in terms of saying "yes" especially in Europe - how can you even browse the web if you don't click yes one everything in Europe? What's the data on folks actually saying no to these popups / clickthrough alerts? I used to skim the relatively few permission / yes agreements (ie, this will auto sig…

I might be wrong, but GDPR was supposed to force businesses to provide a DNT option unless completely vital to the business. If that is true, most sites are liable for forcing you to click "yes". Update: I went and found this[1]: > this provision means that companies will process only the data absolutely necessary for the completion of its business and limit access to personal data to only those employees needing the…

If your business model involves keeping statistics on users use of your site is that necessary for the business?

Re: Cname cloaking, a disguise of third-party trackers

#187

Post by takeda »

earthboundkid wrote: post #183
pas wrote: post #167

Earlier quoted context omitted.

The GDPR does that. It doesn't matter if you have the data in your own DB, you can't utilize it for purposes you haven't secured informed consent for.

GDPR is a good first step.

California's version, CCPA, should take effect starting January.

Re: Cname cloaking, a disguise of third-party trackers

#188

Post by aledalgrande »

privateSFacct wrote: post #186
aledalgrande wrote: post #134

Earlier quoted context omitted.

I might be wrong, but GDPR was supposed to force businesses to provide a DNT option unless completely vital to the business. If that is true, most sites are liable for forcing you to click "yes". Update: I went and found this[1]: > this provision means that companies will process only the data absolutely necessary for the completion of its business and limit access to personal data to only those employees needing the…

If your business model involves keeping statistics on users use of your site is that necessary for the business?

"involves" doesn't mean "would be dead without"

Re: Cname cloaking, a disguise of third-party trackers

#189

Post by poitrus »

air7 wrote: post #170

Something is missing here: HTTPS links and SSL. Either website.com hands over its certificate to dnsdelegation.io (which is unlikely and definitely not a 2 min trust-less process) or dnsdelegation.io has the ability to generate any certificate like a certificate authority which is really terrible (and also unlikely).

With ACME enabled CAs like letsencrypt, having a domain pointing to an IP you control is all you need to obtain a valid certificate.

Re: Cname cloaking, a disguise of third-party trackers

#190

Post by takeda »

ignoramous wrote: post #53
bsysop wrote: post #46

Earlier quoted context omitted.

Do you think ad companies will really trust reverse-proxied ad traffic? Seems like a tremendous opportunity for fraud. Right now with user agents hitting ad servers directly, there's much less opportunity for content publishers to fake impressions and clicks.

Instead of websites deploying reverse-proxies to tunnel ads through, Google has entire websites tunnel through their edge via AMP. Wouldn't surprise me if BigTech gets together and introduces standards that open up more avenues for CDNs to take away even more control and monetize the traffic they serve, on their terms. Google has pretty much checkmate d content-blockers in that they control the servers, the OS, and t…

I hate AMP but maybe it is ad blockers, but I believe I can count on my fingers how many times I visited an AMP page.
Post reply on HN