Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

wired.com

Post reply on HN
Print view View original

11–20 of 151 posts

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#11

Post by gojomo »

_delirium wrote: post #2

The article focuses mostly on legal measures (e.g. lawsuits, regulation), but my guess is that those would only deter the largest companies. What I'm more worried about is why 'incognito' modes in current browsers don't appear to stymie this tracking, and how likely it is that that can be fixed.

I, too, would be rather surprised that incognito/private-browsing would share cached data (and thus ETags as sent on If-None-Match requests) with normal browsing.

Looking at the researchers' paper...

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1898390

...it's not clear that's what they're claiming. One quote is that "Even in private browsing mode, ETags can track the user during a browser session."

That suggests they may be concerned about cross-site tracking within a single private session, and the possible expectation that 'private browsing' prevents tracking from site to site. (I've never had that expectation; only that a private session is not connected to distinct prior private and non-private sessions.)

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#13

Post by RexRollman »

I usually use Firefox with it set to forget everything on exit, along with the Noscript plugin. Does anyone know if this tracking service would work on a FF user running Noscript?

By the way, using Noscript has made me aware of something that I didn't previously know: many sites call Javascript from lots of other domains. I've seen websites with as many as 18 other domains listed on the Noscript pull down menu. And I have seen an increasing number of XSS alerts as well.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#15

Post by code_duck »

Why single out Kiss Metrics? One example, I visited Fox News last month and found they set up an HTML5 database called, in a rather unsubtle choice, "evercookie". I can't confirm that this is the case currently, though since the ability to view HTML5 databases in Preferences seems to now be missing from all the browsers I have (which seems odd, too!).

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#16

Post by benregenspan »

thirsteh wrote: post #5
cleverjake wrote: post #3

is there any indication on where the data is stored?

Haven't looked at KISSmetrics, but I assume it's some manifestation of evercookie: http://samy.pl/evercookie/

Yep the "never before seen in the wild" ETag approach was implemented September 2010 in an easy-to-use library. Very clever, but it seems like Samy Kamkar deserves the credit here, not the brilliant researchers who found the library's approaches being used somewhere.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#17

Post by rhubarbquid »

code_duck wrote: post #15

Why single out Kiss Metrics? One example, I visited Fox News last month and found they set up an HTML5 database called, in a rather unsubtle choice, "evercookie". I can't confirm that this is the case currently, though since the ability to view HTML5 databases in Preferences seems to now be missing from all the browsers I have (which seems odd, too!).

In Chrome you can bring up the Developer Tools (View menu on the mac, I think it's in the wrench menu on other platforms). You can see databases, cookies, etc. in the Resources tab.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#18

Post by chubot »

trotsky wrote: post #8

That Can't Be Dodged Very interesting article, but the proclamation you can't avoid it seems a bit too far. When my browser exits it both deletes cookies and clears the cache, which looks like it's enough to break the tracks.

I do that too, but I don't think it's enough.

I use FlashBlock, which I think is enough, because they're apparently using flash cookies to recreate regular HTTP cookies (or something like that).

Flash is a huge POS in so many ways.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#19

Post by sp332 »

RexRollman wrote: post #13

I usually use Firefox with it set to forget everything on exit, along with the Noscript plugin. Does anyone know if this tracking service would work on a FF user running Noscript? By the way, using Noscript has made me aware of something that I didn't previously know: many sites call Javascript from lots of other domains. I've seen websites with as many as 18 other domains listed on the Noscript pull down menu. And I…

All the social sharing buttons use 3rd-party JS. You can see the "embed" code for Google's new +1 button here: http://googlewebmastercentral.blogspot.com/2011/07/1-button-... This lets the sites update APIs without breaking every page on the Internet :)

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#20

Post by Alex3917 »

maukdaddy wrote: post #9

There is nothing more evil in modern business than marketers. Between real life experience and MBA classes I have come to despise most everything involved in modern marketing, especially in the technology space.

Except for that virtually every single one of the biggest problems we face is a marketing problem, rather than an issue where we don't have the science or technology:

global warming, education reform, prison reform, the national debt, healthcare, literacy, food production, biodiversity, etc.

Marketing is probably the single most important career there is right now, and if there's any hope of humanity making it through the next thousand years then it'll almost certainly be due to improvements in our ability to market things rather than new technology.

Post reply on HN