Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

wired.com

Post reply on HN
Print view View original

141–150 of 151 posts

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#141

Post by joshtynjala »

joeshaw wrote: post #137
thezilch wrote: post #52

I'm not sure these researchers understand how private-browsing functions. The session in a private-browsing window is only private from the non-private sessions and only private from future private-sessions when all private sessions -- private-browsing windows -- are destroyed. http://imgur.com/a/LjjYf Here I have a non-private session, where I have request i.js (a second time), invoking an If-None-Match check with m…

The main exceptions to this are Flash cookies. These are shared between all browsers for a given user, since they're stored by the Flash plugin itself and independent of individual browsers' profile storage.

"Starting with Flash Player 10.1, Flash Player actively supports the browser's private browsing mode, managing data in local storage so that it is consistent with private browsing. So when a private browsing session ends, Flash Player will automatically clear any corresponding data in local storage."

Source: http://www.adobe.com/devnet/flashplayer/articles/privacy_mod...

Local storage here refers to "Flash cookies".

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#142

Post by lukeschlather »

sixtofour wrote: post #130
dredmorbius wrote: post #36

Earlier quoted context omitted.

Amen to JS from third-party domains. I see this as biting us in the butt sometime. Maybe not today, maybe not tomorrow, but soon, and for the rest of your life. What's more annoying is playing the "NoScript allow roulette" game of trying to figure out which domains/scripts you have to allow for some site feature to work.

This is why I don't bother with cookie monitoring at all, and why I plug my ears and say "la la la" and pretend that everything will be alright. I really don't want to spend the time figuring out how to make my bank work. I suppose when the government gets in the game, either through direct tracking or just making laws requiring tracking companies to keep particular data for particular lengths of time, then it will b…

For banking and stuff with way too much Javascript I use a second browser, and I do a complete wipe of all private information after every use.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#144

Post by ashkan »

great comments.

we're planning to follow up with a post that has the technical details of the Etag stuff (sorry about 'light on detail', it was a press piece after all).

you're right in that it's been a known method that has been written before (samy had it in evercookie which we site in the paper and a few others have blogged about it). what seemed new (at least to me) was actually encountering it 'in the wild' on a top50 site like hulu. if this type of thing been written about before, definitely let me know so we can cite it.

fwiw, yes noscript would block the javascript that kissmetrics uses to respawn using html5/etags, however there's still the swf that regenerates using flash cookies. also josh highlights ways the you could do this with javascript disabled using CSS (kissmetrics actually also uses hidden values in CSS as well if you look at the src)

either way, blocking javascript/flash would render hulu, and other 'rich media' services like it, largely useless unfortunately.

RE: foxnews/polldaddy. actually they were naming their database 'evercookie' some time ago although they've seemed to have changed that (now it's just called pd_poll__). you can see the script they use here which they use html5 and swf databases: http://pastebin.com/0ieZ2i22 (prettyfied from http://static.polldaddy.com/p/4424060.js )

it's likely that polldaddy/foxnews are using these techniques so to ensure that a given computer only gets to vote 'once'. however, i think there are probably much better ways to do this.

hope that helps. i'll link a blogpost down here somewhere (which means that i actually have to start blogging finally ;)

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#145

Post by mattmanser »

reinhardt wrote: post #127
mattmanser wrote: post #122

Earlier quoted context omitted.

I disagree completely. I bought this computer. I pay for my internet connection. And someone like KISSMetrics wants to spy on me using MY stuff? To profit from MY computer tracking me against my express commands? Incognito mode, cookies turned off and they're tricking my computer into tracking me? These are people who have lost all perspective of what's right and wrong. Analytics is a solved problem, there's no innov…

I bought this computer. I pay for my internet connection. And someone like KISSMetrics wants to spy on me using MY stuff? You may pay for your computer and internet connection but not for the (vast majority of) sites you visit. This popular sense of entitlement is problematic when "your" stuff live in 3rd party servers running 3rd party software that you're not paying for.

This is disingenous to the extreme.

Where on these sites does it warn you that all your browsing will be recorded without your permission? So they can sell your personal data?

I'm all for having advertising on google mail but this is totally different and any attempt to defend this position is treading on extremely thin ice.

This has nothing to do with entitlement and everything to do with immoral business practices. This is worse than being one of those 'we'll wipe off your debt' companies. It's a modern day scam that legislators have not caught up with, pure and simple.

Kissmterics are utter scum.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#146

Post by mwexler »

zedshaw wrote: post #87
teej wrote: post #29

Earlier quoted context omitted.

Give me a break. This isn't evil marketers hiding in their underground lair. This is web developers, designers, and product managers gaining insight about their users. They don't package this information and sell it wholesale to advertisers. They use it to make the product better . You are taking this -way- too seriously. The ability to have perfect information on how users interact with your product is one the earth…

Bullshit. If it was used to improve a product, they wouldn't use a tracking method that tracks me between sites. They can track what I do on their site, but if I'm going from goat-sucking-maggot.com to hulu.com, then Hulu has no business knowing that and knowing that doesn't improve their damn product. This is entirely just an attempt to get competitive analysis about their competitors at the expense of user privacy.

Accd to the article, Hulu didn't know that the ID was the same between sites, and (imho) probably didn't care. The fact that it's the same was revealed by Wired, and users of KissMetrics appear to have not known. It sounds like KissMetrics didn't do much more than could be gained from a referrer in their linking between sites, though clearly more could be done if they wanted to be bad. (Yes, I understand the bad in placing an "unkillable" cookie even on folks who didn't want to be tracked; I'm referring to the specific concern you raised).

There is no evidence in the article that Kissmetrics stitched these together in any way other than what is available in standard referrers. If you hand typed the info in, referrer is blank, and I don't think Kissmetrics imputed the referrer from their data. I don't use the tool, however; can actual customers let HN know if it actually does what Zed thinks it does? Because that would clearly be stepping some bounds if it did this even on "do not track" folks.

And is the fact that it CAN do this is different from the fact that it CAN but isn't (well, if it actually isn't, see previous paragraph)? If they are, then let's yell. But if it's just possibility, then it's like yelling about Google seeing all my searches. The answer: Yes, they do. I can choose not to use Google, or I can benefit from their tech at the cost of sharing some info.

Instead of believing that no one has any right to collect any data on my usage in a world where we leave digital tracks all over the place, lets instead work to minimize risk and maximize value for users. There is always data leakage, and that data can actually help folks if treated with respect and ethics.

And yes, actually, Hulu could use that data to improve their product. But if you don't want to tracked, it's none of their business and they'll have to find another way.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#147

Post by Tobu »

lukeschlather wrote: post #142
sixtofour wrote: post #130

Earlier quoted context omitted.

This is why I don't bother with cookie monitoring at all, and why I plug my ears and say "la la la" and pretend that everything will be alright. I really don't want to spend the time figuring out how to make my bank work. I suppose when the government gets in the game, either through direct tracking or just making laws requiring tracking companies to keep particular data for particular lengths of time, then it will b…

For banking and stuff with way too much Javascript I use a second browser, and I do a complete wipe of all private information after every use.

chromium --temp-profile --no-first-run is the ticket for me.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#148

Post by Tobu »

chubot wrote: post #18
trotsky wrote: post #8

That Can't Be Dodged Very interesting article, but the proclamation you can't avoid it seems a bit too far. When my browser exits it both deletes cookies and clears the cache, which looks like it's enough to break the tracks.

I do that too, but I don't think it's enough. I use FlashBlock, which I think is enough, because they're apparently using flash cookies to recreate regular HTTP cookies (or something like that). Flash is a huge POS in so many ways.

Flashblock isn't enough. The Firefox implementation lets the flash load, then hides it immediately.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#149

Post by scythe »

klbarry wrote: post #139
scythe wrote: post #39

Earlier quoted context omitted.

>not all tracking is evil. Tracking isn't evil. Tracking people who specifically do not want to be tracked is evil.

What if I specifically don't want you on my website if you won't let me track you? You're using technology to circumvent me (adblock), why can't I use technology to circumvent your wishes (evercookie et. al.)?

You can specifically disallow such people from viewing your website, without being evil.

Re: Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

#150

Post by speleding »

nikcub wrote: post #119

This has been known about for years, and was a concern on various mailing lists years ago. The solution at the time was said to be that browser vendors will build in tools for cache control in the same way they have for cookie controls. The first sites to exploit this were, as always, porn sites. They used Etags in referral tracking to avoid webmaster fraud. (the webmaster would have to include a script from the affi…

Interesting. I looked at the RFC and it says it has to be in the format "Sun, 06 Nov 1994 08:49:37 GMT" (RFC2616/RFC1123).

But even if browsers makers would check the "If-modified-since" against that format then it would still be doable to give each visitor a slightly different date and track them that way.

Combining the date stamps on 2 or 3 jpg or css files present on every page on the site should give you enough entropy for even the highest traffic sites and make it very hard to detect.

Post reply on HN