Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IE10's 'Do-Not-Track' Default Dies Quick Death

wired.com

Post reply on HN
Print view View original

61–67 of 67 posts

Re: IE10's 'Do-Not-Track' Default Dies Quick Death

#61

Post by BitMastro »

mike-cardwell wrote: post #60
BitMastro wrote: post #59

Earlier quoted context omitted.

Thanks. So a better implementation should perhaps instantiate a different session for each browser window (sharing the same session for the tabs in the same window). The user should also avoid logging in to any service linked to a known profile.

A better implementation would be one which instantiates a different session not on a per window basis, or even a per tab basis, but on a per "domain in address bar" basis. And by session, this wouldn't just be the cookie store, it would also be the cache store and everything else which can be manipulated for tracking purposes. EDIT: I'd also want it clearing between browser restarts too. If this became (over night) t…

Well, I was thinking that cross site authentication would be impossible in case of per domain session, but yes, a completely new anonymous user profile directory should be created.

Re: IE10's 'Do-Not-Track' Default Dies Quick Death

#62

Post by mike-cardwell »

BitMastro wrote: post #61
mike-cardwell wrote: post #60

Earlier quoted context omitted.

A better implementation would be one which instantiates a different session not on a per window basis, or even a per tab basis, but on a per "domain in address bar" basis. And by session, this wouldn't just be the cookie store, it would also be the cache store and everything else which can be manipulated for tracking purposes. EDIT: I'd also want it clearing between browser restarts too. If this became (over night) t…

Well, I was thinking that cross site authentication would be impossible in case of per domain session, but yes, a completely new anonymous user profile directory should be created.

Why would it be impossible? If you need to completely pass the user off to a different website temporarily, you should add the challenge/response data to the query string or post parameters. Cookies not required.

Re: IE10's 'Do-Not-Track' Default Dies Quick Death

#63

Post by ZoFreX »

Animus7 wrote: post #7
pippy wrote: post #3

The whole concept of DNT is just stupid. It's misleading users and won't work. By telling users you have better privacy simply because your browser adds a random header tag onto requests you're misleading them. Sites have no obligation to obey it and it will give users a false sense of security. We already have proven, well defined method of DNT already: private browsing. This works by simply removing resources after…

> Sites have no obligation to obey it and it will give users a false sense of security. Until appropriate legislation comes into play. It worked reasonably well with the Do Not Call lists.

Ha! People have been getting around the do not call lists in the UK for years now by dialling in from other countries where our regulatory bodies are powerless. Trying to regulate it on the world wide web would be even harder.

Re: IE10's 'Do-Not-Track' Default Dies Quick Death

#64

Post by naner »

pippy wrote: post #3

The whole concept of DNT is just stupid. It's misleading users and won't work. By telling users you have better privacy simply because your browser adds a random header tag onto requests you're misleading them. Sites have no obligation to obey it and it will give users a false sense of security. We already have proven, well defined method of DNT already: private browsing. This works by simply removing resources after…

We already have proven, well defined method of DNT already: private browsing.

You are still being tracked with private browsing. You IP, user agent, OS, screen resolution, etc. are enough to connect the dots in most situations.

This is a decent idea that will need to be implemented to some degree if sites are eventually going to support under-13s, since it is illegal to track their behavior under current law. But you are right, I don't see a lot of places voluntarily signing up to make less money.

Re: IE10's 'Do-Not-Track' Default Dies Quick Death

#65

Post by lla0ajj »

Wilya wrote: post #51
ericflo wrote: post #49

Earlier quoted context omitted.

What browser forces you to opt-in to cookies?

Try to turn cookies off and see what still works. Some people still build sites that have basic functionality with JS off. Nobody bothers to do the same for cookies.

Exactly. There was a time when the idea of users accepting/rejecting cookies on a per-site basis seemed plausible (though it might be annoying for the user), but those days seem long gone. Cookies are on by default and my guess is few users change those settings. DNT might be viewed as another attempt, however futile it may seem, at giving users some choice.

It's true a good portion of the web still works well without Javascript. This seems like a good thing as Javascript can be a mixed blessing. Enabling it comes with both benefits and risks. Like cookies, a user could selectively choose which scripts to allow, one at a time (remember the embedded Java applet days?), but this can quickly become more trouble than it's worth.

Perhaps a difference of JS from cookies is that with Javascript the user might sometimes see what the actual benefits are and they might be more enticing than those of cookies, e.g., "To see this cool doodad, you need to enable Javascript." It is very clear what the benefit will be: the doodad.

Contrast this with "To use this site you must have cookies enabled." Terms like "provide a better user experience" might be used to describe the need to enable cookies. But the specifics are usually absent.

If all websites were reasonable, and no one abused their ability to manipulate and track end users, things like DNT would probably not be necessary. But we know that's not the case.

Re: IE10's 'Do-Not-Track' Default Dies Quick Death

#66

Post by ZeroGravitas »

BitMastro wrote: post #50
ZeroGravitas wrote: post #46

Earlier quoted context omitted.

I agree with your critique of DNT, but private browsing isn't magic, there's plenty a bad actor could do to track you regardless of what you throw away at the end of the session, which means the same critique applies (unless you're using it for it's intended purpose, privacy from other users of your computer, and even then it's got holes).

How?

The fact that Flash had it's own cookies that weren't cleared by private browsing modes was a big story (don't know if they've fixed that yet) but there's a general problem of Zombie Cookies (as long as one ID method works the others can be recreated) and Panopticlick (ID you uniquely based solely on the random info, like installed fonts, sent to the server by your browser).

http://en.wikipedia.org/wiki/Zombie_cookie

https://panopticlick.eff.org/

Re: IE10's 'Do-Not-Track' Default Dies Quick Death

#67

Post by TomGullen »

JoeAltmaier wrote: post #53
BitMastro wrote: post #52

Earlier quoted context omitted.

The same for me. Why should I care if I'm tracked? And if I don't want to be tracked I'll use private browsing (it's not just for porn, you know?). If I want even more privacy I'll use a clean vm, or if I'm going paranoid I could use an anonymous proxy or similar.

Consider bubbling, e.g. Google returns search results consistent with your previous clickthroughs. You end up seeing only results you agree with; it insulates your searching experience from disturbing foreign ideas like evolution or liberalism. Tracking can be done by servers, using a workstation signature (ip/port, installed software versions etc, been discussed in other posts), it doesn't require your client statio…

A fair point, but the sentiment I get from the most vocal people is that it's to do with their privacy.
Post reply on HN