Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged • Hacker News Board

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#91

Post by sorbus » Sat, Jul 30, 2011, 5:37 AM UTC

bandushrew wrote: post #85

inportb wrote: post #82

Earlier quoted context omitted.

Absolutely. You can easily choose not to participate. If, on the other hand, you choose to deny access to your data while continuing to use the Web services in question, you would be at fault (using grandparent's definition of fair trade).

great! how can I choose to deny access to my data? heh heh. the silly article made it sound as if that wasn't an option. trust the journalists to stuff things up. so how do I do it? Edit: I dont use Firefox, so AdBlock is out of the question, and I have no idea what websites do this. Is there a list available somewhere? How can I discover whether or not a website does this without visiting them in the first place?

Either don't use websites that use this (what the grandparent was suggesting, I believe), or block KISSmetrics in your hosts file. Apparently it's also blocked by Adblock Plus if you're subscribed to the right lists (which are linked to elsewhere in the comments on this story).

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#92

Post by meow » Sat, Jul 30, 2011, 5:59 AM UTC

Whats next.. tracking users using browser exploits ?

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#93

Post by jvdongen » Sat, Jul 30, 2011, 6:01 AM UTC

sp332 wrote: post #22

KISSmetrics has a post explaining how the tracking works. http://www.kissmetrics.com/how-it-works They claim that simply using AdBlock is enough to defeat the tracking. They also claim "KISSmetrics has never, and will never, share anonymous customer activity of what people did on customer A’s site with customer B."

If, as the article implies, the same user gets the same identifier across all KISSmetrics customers they ARE (implicitly) sharing customer activity between customers.

As the article states, customer A and B could simple put the information they each have about identity XYZ together. Without KISSmetrics having to be involved any further than in providing and maintaining the unique identity to each customer separately.

Even if it was not the intent of KISSmetrics for this to be possible (which I've a hard time believing), the chosen implementation makes it possible.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#94

Post by jacques_chester » Sat, Jul 30, 2011, 6:37 AM UTC

chubot wrote: post #18

trotsky wrote: post #8

That Can't Be Dodged Very interesting article, but the proclamation you can't avoid it seems a bit too far. When my browser exits it both deletes cookies and clears the cache, which looks like it's enough to break the tracks.

I do that too, but I don't think it's enough. I use FlashBlock, which I think is enough, because they're apparently using flash cookies to recreate regular HTTP cookies (or something like that). Flash is a huge POS in so many ways.

There's a whole bunch of places to stash unique identifiers. And you only need to overlook one of them, because they will repopulate all of them the next time you hit a KM-using site.

HTTP cookies, flash cookies, ETags, HTML5 databases ... it just goes on and on.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#95

Post by jacques_chester » Sat, Jul 30, 2011, 6:38 AM UTC

losvedir wrote: post #73

I generally browse with Javascript, cookies, and plug-ins off (except for a few whitelisted sites). From what I understand of the technology (it loads some javascripts initially), I think that would dodge it.

Sorry, but no. You'll get tracked through ETags at least; if you have a late-model browser you may also be tracked through an HTML5 DB or history object.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#96

Post by thezilch » Sat, Jul 30, 2011, 6:46 AM UTC

gojomo wrote: post #58

thezilch wrote: post #53

Earlier quoted context omitted.

Not true; http://news.ycombinator.com/item?id=2824760

I think you're agreeing with catch23; that 'it' is referring to 'incognito' not 'KISSmetrics technique'. Incognito mode does defeat the ETag tracking (at least across distinct sessions).

I'm not so sure, based on the comment the counterclaim was in reply to. Nonetheless, hopefully these tests better suit the depiction of what we can come to expect from these tracking techniques in mixed session types.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#97

Post by jaredmck » Sat, Jul 30, 2011, 7:24 AM UTC

itg wrote: post #42

teej wrote: post #29

Earlier quoted context omitted.

Give me a break. This isn't evil marketers hiding in their underground lair. This is web developers, designers, and product managers gaining insight about their users. They don't package this information and sell it wholesale to advertisers. They use it to make the product better . You are taking this -way- too seriously. The ability to have perfect information on how users interact with your product is one the earth…

Sure there is nothing wrong with that, but these are sneaky underhanded tactics. Users should be able to opt-out if they don't want to be tracked.

Want to opt out? Don't visit sites using tracking methods with which you disagree. This is a fairly trivial way of opting out of such tracking, and would help incentivize those sites to change their tracking policies and technologies. If you really care that much, vote with your actions. It won't change anything, much like voting in united states elections, but you can at least back up your stance while knowing that most people do not care one bit nor wish to think about what happens behind the scenes of each website, tv program, and news story they consume in the course of being entertained. You're free to choose, at least until you decide not to be.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#98

Post by jaredmck » Sat, Jul 30, 2011, 7:30 AM UTC

jefft wrote: post #48

palish wrote: post #40

Earlier quoted context omitted.

I think the reason you're being downvoted is because you didn't provide any proof.

Sites like Hulu and Spotify predominately use web analytics to gauge their audience in order to sell advertising, not to make their sites better. That may be a by-product, but that's not driving their analytics usage. Additionally, cross-site tracking isn't used for feature/usage tracking. It's used for highly targeted advertising. My point was the "shattering advantages" are really advantages for advertisers, not we…

Spotify has perhaps the least targeted ads i've ever seen/heard on any media source. We listen to indie rock and classics all day only to hear the latest Jason Derulo clip several times a day as an advertisement. That's clearly not targeted in any way. There is 0% chance we will do anything but hate the song as a result of this ad. None of the ads are in any way relevant or appear to be targeted by anything more accurate than "18-35 demographic, serve them ads for shitpop" without discretion:

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#99

Post by aerique » Sat, Jul 30, 2011, 7:31 AM UTC

newman314 wrote: post #66

sp332 wrote: post #22

KISSmetrics has a post explaining how the tracking works. http://www.kissmetrics.com/how-it-works They claim that simply using AdBlock is enough to defeat the tracking. They also claim "KISSmetrics has never, and will never, share anonymous customer activity of what people did on customer A’s site with customer B."

Unfortunately, this does not help with mobile devices which do not have the same capability. Well, I guess you can always maintain a hosts file but that's the only way I can think of.

There's Firewall iP for jailbroken iPhones. Also one can install other browsers than Safari from the Appstore and, for example, iCab Mobile has the ability to use filters (and comes with some).

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#100

Post by jaredmck » Sat, Jul 30, 2011, 7:35 AM UTC

zedshaw wrote: post #87

teej wrote: post #29

Earlier quoted context omitted.

Give me a break. This isn't evil marketers hiding in their underground lair. This is web developers, designers, and product managers gaining insight about their users. They don't package this information and sell it wholesale to advertisers. They use it to make the product better . You are taking this -way- too seriously. The ability to have perfect information on how users interact with your product is one the earth…

Bullshit. If it was used to improve a product, they wouldn't use a tracking method that tracks me between sites. They can track what I do on their site, but if I'm going from goat-sucking-maggot.com to hulu.com, then Hulu has no business knowing that and knowing that doesn't improve their damn product. This is entirely just an attempt to get competitive analysis about their competitors at the expense of user privacy.

Since when have users been entitled to privacy? It's just more obvious now when user data is collected, and things move much faster so it's on a more tangible scale. Small town gossip was used in much the same way to gain competitive edges at the expense of customer privacy, it just wasn't as easy to see/prove how the data moved from one spot to another back in the days of pre-electronic commerce.