Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

wired.com

Post reply on HN
Print view View original

51–60 of 151 posts

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#51

Post by rjbond3rd »

Groxx wrote: post #46
rjbond3rd wrote: post #27

Earlier quoted context omitted.

The trick is the server generates a unique Etag for each visitor. Then the visitor's browser sends the Etag back to the server (in an "If-None-Match" header), and thus it acts as a quasi-cookie.

That's the picture I get too, but I don't see how clearing the cache doesn't, you know, clear the cache . It would seem to imply that if the Etag is still around, it's not really cleared - maybe the data is gone, but the knowledge that the data existed isn't. And it persists through privacy-mode. Which means I/we am/are either misunderstanding something, or the people who designed privacy and cache-clearing tools had…

There are many other techniques employed. As soon as one of the techniques works, it re-populates the others. (Cache clearing doesn't affect Flash cookies [LSO's]).

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#52

Post by thezilch »

I'm not sure these researchers understand how private-browsing functions. The session in a private-browsing window is only private from the non-private sessions and only private from future private-sessions when all private sessions -- private-browsing windows -- are destroyed.

http://imgur.com/a/LjjYf

Here I have a non-private session, where I have request i.js (a second time), invoking an If-None-Match check with my non-private ETag of i.js. Opening a private session, my request to i.js does not invoke my non-private session's ETag and subsequent If-None-Match -- i.js is fetched as if my session has no memory of the URI.

In the second shot, I had closed my private session opened in the first test, and I then opened a new private session, without closing my previous non-private session. Again, my private session requests a new i.js, with no idea of the non-private session's nor the first, now closed, private session's version.

The onus is on browsers to restrict inner-private-session storage from leaking between tabs, but it could be quite messy.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#53

Post by thezilch »

catch23 wrote: post #24
gojomo wrote: post #11

Earlier quoted context omitted.

I, too, would be rather surprised that incognito/private-browsing would share cached data (and thus ETags as sent on If-None-Match requests) with normal browsing. Looking at the researchers' paper... http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1898390 ...it's not clear that's what they're claiming. One quote is that "Even in private browsing mode, ETags can track the user during a browser session." That sugges…

I just tested incognito, it seems to defeat the etags mechanism of tracking.

Not true; http://news.ycombinator.com/item?id=2824760

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#54

Post by ktsmith »

sp332 wrote: post #19
RexRollman wrote: post #13

I usually use Firefox with it set to forget everything on exit, along with the Noscript plugin. Does anyone know if this tracking service would work on a FF user running Noscript? By the way, using Noscript has made me aware of something that I didn't previously know: many sites call Javascript from lots of other domains. I've seen websites with as many as 18 other domains listed on the Noscript pull down menu. And I…

All the social sharing buttons use 3rd-party JS. You can see the "embed" code for Google's new +1 button here: http://googlewebmastercentral.blogspot.com/2011/07/1-button-... This lets the sites update APIs without breaking every page on the Internet :)

And disabling all those crappy social sharing buttons makes the pages so much better. From faster loading to less clutter there are a bunch of benefits. Sometimes I'm flabbergasted how crappy sites are when I sit down to a machine without a javascript blocker.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#55

Post by k33n »

I've worked with the KM folks. Great people, genuinely kind, and they want to make a great product. I think it's disgusting to single out a startup like this, especially right as they are gaining traction with some big-name clients.

There is value in what they are doing, and there's absolutely nothing wrong with it. They are tracking user behavior completely anonymously.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#56

Post by fungi »

sp332 wrote: post #22

KISSmetrics has a post explaining how the tracking works. http://www.kissmetrics.com/how-it-works They claim that simply using AdBlock is enough to defeat the tracking. They also claim "KISSmetrics has never, and will never, share anonymous customer activity of what people did on customer A’s site with customer B."

hazza for adblock, as much as i like to see the legislature and courts support privacy this is fundamentally a technological problem.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#57

Post by AndyIngram »

k33n wrote: post #55

I've worked with the KM folks. Great people, genuinely kind, and they want to make a great product. I think it's disgusting to single out a startup like this, especially right as they are gaining traction with some big-name clients. There is value in what they are doing, and there's absolutely nothing wrong with it. They are tracking user behavior completely anonymously.

If a user requests not to be tracked they should not be tracked. Even when the information is harmless, as I am sure it most likely is in this case, it sets a bad example and will make it worse for the industry.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#58

Post by gojomo »

thezilch wrote: post #53
catch23 wrote: post #24

Earlier quoted context omitted.

I just tested incognito, it seems to defeat the etags mechanism of tracking.

Not true; http://news.ycombinator.com/item?id=2824760

I think you're agreeing with catch23; that 'it' is referring to 'incognito' not 'KISSmetrics technique'. Incognito mode does defeat the ETag tracking (at least across distinct sessions).

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#59

Post by techiferous »

"This is yet another example of the continued arms-race that consumers are engaged in when trying to protect their privacy online..."

I don't think arms race is a good analogy here. Arms race is a good analogy for virus-makers and antivirus software, since their goals are exact opposites.

The goal of analytics sites like KISSmetrics is to measure and understand the behavior of their customers as a group, not as specific individuals. The goal of people who wish to remain untracked is to avoid having personally identifiable information about them stored without their consent. These goals are not opposites and don't necessarily result in an arms race.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#60

Post by anyidiot »

You know, when individuals access a company's computer using technically valid means (e.g. a username and password or by logging in from multiple locations), then its criminal charges, international arrest warrants, and jail time. [1] [2]

But when companies do it to people, oh its just a clever programming trick, and its not a problem because you could install additional software to prevent it from happening [3].

The law is showing up pretty clear that simply because you can access a computer system, does not mean that you may, and indeed that doing so without the user's permission is a crime. Causing a computer to store data on a user and then serve that data back to another computer seems dodgy without permission. Doing it when the user has taken reasonable steps to prevent it from happening? Class action time!

[1] http://www.techdirt.com/articles/20110722/02351315202/how-ci...

[2] http://www.geek.com/articles/geek-pick/aaron-swartz-spent-mo...

[3] http://www.kissmetrics.com/how-it-works

Post reply on HN