Ask HN: Refusing all cookies, still targeted by ads. How? • Hacker News Board

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#21

Post by leonidasv » Wed, Jun 21, 2023, 2:10 PM UTC

jerf wrote: post #14

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entir…

> You can program a website to use local storage and submit a token on every URL click with a fairly simple handler

That still falls into the EU Cookie definition in the law. [0] If a website is doing this regardless of the user choosing not to allow cookies, it's committing a violation in the eyes of the law (in the EU at least).

[0] https://softwareengineering.stackexchange.com/a/295212

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#22

Post by gcoakes » Wed, Jun 21, 2023, 2:15 PM UTC

jerf wrote: post #14

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entir…

My favorite thing from that uniqueness website is that it shows cookies enabled as more common and thus more anonymizing. Not that they wouldn't just fingerprint you using those cookies if it was enabled.

The other interesting thing is that it lists my plugins and "do not track" settings. They are both fairly unique. So, someone who attempts to anonimize themselves using plugins or browser features are just highlighting themselves.

I wonder how unique `wget` would be.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#23

Post by misja111 » Wed, Jun 21, 2023, 2:18 PM UTC

mnw21cam wrote: post #19

jerf wrote: post #14

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entir…

The important bit is that the cookies not only are irrelevant from the point of view of allowing tracking to occur technically, they're also irrelevant from a legal point of view. A company must have your consent to hold and process your information for a specific purpose , regardless of whether or not that is done using cookies or fingerprinting. If you have been presented with a consent popup and have not consented…

Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#24

Post by princevegeta89 » Wed, Jun 21, 2023, 2:18 PM UTC

This shit is so hard to control. The only way to control it is adblockers like uBlock and/or DNS-wide solutions like PiHole

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#25

Post by Yujf » Wed, Jun 21, 2023, 2:20 PM UTC

misja111 wrote: post #23

mnw21cam wrote: post #19

Earlier quoted context omitted.

The important bit is that the cookies not only are irrelevant from the point of view of allowing tracking to occur technically, they're also irrelevant from a legal point of view. A company must have your consent to hold and process your information for a specific purpose , regardless of whether or not that is done using cookies or fingerprinting. If you have been presented with a consent popup and have not consented…

Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.

GDPR

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#26

Post by awinter-py » Wed, Jun 21, 2023, 2:21 PM UTC

brucethemoose2 wrote: post #3

You need tracker blocking extensions, and/or a "degoogled" version of Chrome like Thorium or Brave. My usual loadout is Thorium + the EFF's Privacy Badger extension, and sometimes UBO.

can you say why degoogled chromium matters for tracking, or link to a writeup?

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#27

Post by leonidasv » Wed, Jun 21, 2023, 2:21 PM UTC

Recently, I discovered that SwiftKey keyboard (I assume) was leaking tracking data from Incognito on Android. I would open an Incognito tab in Chrome, the keyboard would show up in "anonymous" mode, but products I searched for still turned into ads in Facebook/Instagram and AdSense in a couple of minutes.

I assume it was SwiftKey since it was the only piece of software that had access to those keywords besides Chrome itself (which I assume is not the leaker since it never leaked data from Incognito on desktop and because it also happened in Firefox Private Browsing). The "Am I Unique" fingerprint for an Incognito vs a regular tab is also different, so I assume it's not a matter of fingerprinting with server-side tracking.

We are being tracked by the least suspicious pieces of software nowadays, it's becoming more and more difficult to know where the actual tracking came from as we add more and more layers of complexity into our computers. It's scary to think about.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#28

Post by jsnell » Wed, Jun 21, 2023, 2:21 PM UTC

> I could think of sophisticated methods, but maybe the simple answer is that refusing cookies doesn't actually do anything?

This is a great opportunity to conduct a double blind experiment! Set up three Chrome profiles: your current one, one that's totally fresh, and one that's connecting from a different IP over a Socks proxy. Write a script to randomly start Chrome with one of these profiles; every hour quit the browser, restart it with a random profile, and record the ads you see. Do they all get the same distribution of ads? Do they start out different, but eventually converge?

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#29

Post by IanCal » Wed, Jun 21, 2023, 2:24 PM UTC

jerf wrote: post #14

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entir…

> Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things.

GDPR absolutely does not rely on specific implementations. Even earlier things I'm pretty sure don't, but GDPR has a much more general coverage. It's extremely important people understand this when they're writing software.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#30

Post by comfypotato » Wed, Jun 21, 2023, 2:25 PM UTC

jerf wrote: post #14

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entir…

I’ve been on a team doing fingerprinting research (specifically entropy sources). It’s amusing that you’re 100% unique and browsing HN commenting about fingerprinting. (You’re exactly a demographic that would be unique.) Most people aren’t unique, far from it. Consider iPhone 14 Pro Max users browsing through a 5G connection. All the users in the same cell look exactly the same.

If I had to guess, based on what I know about you (what I mentioned in the previous paragraph), I would guess that you built your own computer. This almost guarantees a unique fingerprint.

With the deprecation of 3rd party cookies, we will definitely see an increase in fingerprint-based tracking. That being said, it’s going to look different than unique cookies (and it doesn’t explain OP’s situation.

(Or it might actually be that simple. Your fingerprint might be unique between IP re-addressing, and that’s all it is.)