Live data from Hacker News

I too know the websites you visited

oxplot.github.com

71–80 of 98 posts

Re: I too know the websites you visited

#71

Earlier quoted context omitted.

That's because the second time you ran it, all the images were in your cache from the first time you ran it. That's the expected result.

Yet another reason this test is useless. If site A uses it, it may get partially correct data, but when you browse to site B, it will return 100% positive, most of these being false positives. I just don't see any practical application for this method with such high error rates. The methods mentioned above are only valuable if you can guarantee at least relative reliability. By and large the results have been seeming…

First, it's a proof of concept, that's all.

Even so, even without doing any work to ameliorate these flaws, it could still be (ab)used. Don't assume that it's only useful if everyone can scan which of the top 100 websites you've visited.

Any site could use this to check which competitors' sites have been visited. It's unlikely anyone else has an interest in checking that information, so the cache is not going to be poisoned by anyone else. With knowledge of which competitors a potential customer has checked out, you could do some effective price discrimination -- the guy looking at the $10 solutions sees your lowest price, while the guy looking at some competing Microsoft Dynamics package enters a more enterprisey sales funnel.

It's also useful for retargeting. Throw the code up on an ad network and you only test for cache hits against domains of current advertisers. If there's a hit, store it in a cookie so you don't need to check the (now filled) cache again. You can now show ads for companies a person has already had an interaction with, without having to cookie every visitor to the advertisers' sites first.

It doesn't take much to come up with (mostly nefarious) uses for this, even without perfect accuracy and even without the ability to have multiple parties check the same URLs.

It also doesn't take much to come up with ways to improve the process. You can ameliorate the problem of overlapping testers by having a large pool of URLs from each site to check. The average top 1000 site probably has dozens and dozens of images and other resources per page, each of which can be used for a cache test.

Re: I too know the websites you visited

#75

I think it got 100% for me, on Safari/Mac. Note that it doesn't need to be 100% accurate to be effective. If it guesses better than 50% (i.e. coin flip), then it could be used to give guesses with at least some confidence. No different than analyzing any other noisy dataset. Because this all works client-side, it can also be done quite invisibly.

It would have to guess better than anonymous modelling, not 50%. I'd happily bet even odds layout that each of my site visitors visit Google.

Re: I too know the websites you visited

#76
post #75

I think it got 100% for me, on Safari/Mac. Note that it doesn't need to be 100% accurate to be effective. If it guesses better than 50% (i.e. coin flip), then it could be used to give guesses with at least some confidence. No different than analyzing any other noisy dataset. Because this all works client-side, it can also be done quite invisibly.

It would have to guess better than anonymous modelling, not 50%. I'd happily bet even odds layout that each of my site visitors visit Google.

If the question is "Has this user visited site X?" then I'd hope that any kind of modelling is better than 50%, as simulating a coin toss would be at least as good.

Re: I too know the websites you visited

#79

Throwaway account. My company created an analytics product around the ability to track which sites your visitors have visited. It used a different and (at the time) more reliable technique. About a year after the product launch we were contacted by a powerful washington based lobby group and they wanted to chat. They felt it violated a site visitor's "reasonable expectation of privacy". I agreed. So we pulled the fea…

I wonder if they have contacted Facebook about some of their practices, which may be similar?
Post reply on HN