Do Not Track is not respected on mozilla.org • Hacker News Board

Re: Do Not Track is not respected on mozilla.org

#101

Post by lizard » Wed, Jul 31, 2013, 7:06 PM UTC

Metatron wrote: post #79

Nursie wrote: post #10

Earlier quoted context omitted.

That's really not how I think, nor does it really reflect reality, IMHO. They are on my property, it's all rendered and running in my browser on my device. All that's happened is I've requested some data from the server and they've given it to me, from then on how I display it and what gets run is entirely up to me. If we want to attach terms and conditions to it (i.e. to use this site you must accept analytics/track…

Look, let's try an analogy. I run a shop, you want to come into my shop, you want to physically bring yourself into my shop, with your personal items, including your wallet and let's say a bag to help you purchasing items, or perhaps just to browse. I'm going to keep an eye on you as I see fit whilst you are in my shop. Surely you can see that as fair? You are an agent entering my property. This is what your computer…

>> I'm going to keep an eye on you as I see fit whilst you are in my shop. Surely you can see that as fair?

Unless something about my behavior stands out to you I can make a reasonable assumption that 1) you are not going to watch me the entire time and 2) the only record you are going to keep of my visit is the transaction receipt, and perhaps a note that one more person came into your shop today. Every web server platform I am familiar with already logs access requests, which I don't think anyone is arguing against and you are free to monitor and analyze as you wish.

If you must monitor individual visitor's behavior it seems most stores have already worked that one out too, for example membership programs. A new analogy may read

> I'm going to give you the option of signing up for a membership program. If you sign up I will offer you services tailored to your habits whilst you are in my shop.

Even if you require membership for your services the terms of the relationship (e.g. you will be tracked) are, usually, available prior to the socially-questionable activity (e.g. tracking).

But for your analytic package the analogy would be more like

> I'm going to install live cameras throughout the shop to record you whilst you are in my shop. I'm going to review the recordings, or send them to a third party, so I may identify you and analyze your behavior at my own discretion.

Even if a shop has a camera the only social contract I am aware of is that the tape may be reviewed in the event of criminal or suspicious behavior.

Re: Do Not Track is not respected on mozilla.org

#102

Post by generj » Wed, Jul 31, 2013, 7:14 PM UTC

teamjimmyy wrote: post #67

I don't get it. Why is this different from inspecting your web logs? Sure you lose the first-party cookie aspect, but I bet you can get awful close just looking at the request IPs. There's "tracking" inherent in how everything works, so why does it matter if collection is contracted to a 3rd Party? Does the poster expect the web server to not write a log line because he sent a DNT header too?

IP logs aren't sufficiently unique: my IP changes as I move my laptop around, it is shared with several other persons at work and home, and my IP at each of these locations changes.

Most DNT is concerned with Javascript, which has the ability to be very intrusive than mere web logs. Analytics services started with web logs, but quickly transitioned to Javascript, because I can track a cookie much better than an IP address, and get more information besides.

It's inherently different when contracted to a 3rd Party.

Third-party vendors are opposed because it would be the equivalent of giving all of the IP logs from a majority of the Internet to a single user (in this case, Google Analytics). The ability to discover trends on particular users than becomes massively possible in a way that simply doesn't exist with 1st Party tracking. The siren's call to monetize this data is ever present, so we seek to not allow the collection in the first place.

Re: Do Not Track is not respected on mozilla.org

#103

Post by bloopletech » Wed, Jul 31, 2013, 7:14 PM UTC

teamjimmyy wrote: post #67

I don't get it. Why is this different from inspecting your web logs? Sure you lose the first-party cookie aspect, but I bet you can get awful close just looking at the request IPs. There's "tracking" inherent in how everything works, so why does it matter if collection is contracted to a 3rd Party? Does the poster expect the web server to not write a log line because he sent a DNT header too?

One of the big differences between 1st-party and 3rd-party tracking is that Bob at Bob's Cakes can only see what you're doing on Bob's site (1st-party tracking), but if Bob uses Google Analytics, and so does Jane, and Sarah, then Google Analytics (3rd-party) knows about your activity _across_ Bob's, Jane's, and Sarah's sites, which can potentially be used in worse/more invasive ways.

Also, the javascript tracking scripts can capture a lot more information than a simple access log line - they're not directly comparable.

Re: Do Not Track is not respected on mozilla.org

#104

Post by __david__ » Wed, Jul 31, 2013, 7:21 PM UTC

Nursie wrote: post #72

jimktrains2 wrote: post #65

Earlier quoted context omitted.

>> I have a right to track how people use my site. > But you don't have a right to say what runs on my computer, or make it tell you what I'm doing. This is where our perceived rights collide. Exactly! But you also don't have the right to tell him not to send tracking info either. You do, however, have the right not to execute it. For instance NoScript, Ghostery,and AdBlock+ will prevent the requests for this content…

>> I think OP meant that once you make a request to his server, his server is free to do what it wants with that request. I don't think they did mean that - "But you've politely requested that I don't track you. For starters this should only ever be a polite request, not a forced rejection of any tracking scripts. I have a right to track how people use my site." "People get way too offended by analytics tracking when…

I generally agree with you but I didn't read what he said that way. Just in the same sense that the browser has the right to avoid running javascript (or loading ads) that a server sends it, the server has a right to log requests the the client gives it (and certainly every server by default logs the IP, timestamp and request URL). I see it as 2 sides of the same coin.

And though there are many analytics products that rely on running javascript on the client, almost all have fallbacks to 0px images--all that is needed is to comb through the logs occasionally.

Re: Do Not Track is not respected on mozilla.org

#105

Post by teamjimmyy » Wed, Jul 31, 2013, 7:31 PM UTC

bloopletech wrote: post #103

teamjimmyy wrote: post #67

I don't get it. Why is this different from inspecting your web logs? Sure you lose the first-party cookie aspect, but I bet you can get awful close just looking at the request IPs. There's "tracking" inherent in how everything works, so why does it matter if collection is contracted to a 3rd Party? Does the poster expect the web server to not write a log line because he sent a DNT header too?

One of the big differences between 1st-party and 3rd-party tracking is that Bob at Bob's Cakes can only see what you're doing on Bob's site (1st-party tracking), but if Bob uses Google Analytics, and so does Jane, and Sarah, then Google Analytics (3rd-party) knows about your activity _across_ Bob's, Jane's, and Sarah's sites, which can potentially be used in worse/more invasive ways. Also, the javascript tracking scr…

This isn't strictly true, which is why I made the differentiation above between 1st and 3rd party cookies. With the 1st party cookie you'd get a new GA cookie on each site (e.g. mozilla-GA, ycombinator-GA, etc), making those correlations impossible. In the case of 3rd party cookies, yeah, I totally get that they can be used for some seriously evil things.

It's possible GA could try to correlate IPs or browser fingerprints between 1st party cookies over multiple sites, but proxies and mobile devices would make that difficult. The fact that all the data is together in GA's warehouse doesn't change the fact that the data isn't there to be correlated.

As for JS being able to be more intrusive, sure, I get that. At that point, I suppose you have to trust the site you're on that they wouldn't use a service that was intrusive. Perhaps this is a bridge too far for some, which is reasonable.

I guess I just don't get wanting to ban the tool entirely when it could but is not currently be used nefariously. (working on the assumption that if GA started fingerprinting browsers someone would've seen the traffic by now. it's not easy to hide.)

Re: Do Not Track is not respected on mozilla.org

#106

Post by teamjimmyy » Wed, Jul 31, 2013, 7:37 PM UTC

generj wrote: post #102

teamjimmyy wrote: post #67

I don't get it. Why is this different from inspecting your web logs? Sure you lose the first-party cookie aspect, but I bet you can get awful close just looking at the request IPs. There's "tracking" inherent in how everything works, so why does it matter if collection is contracted to a 3rd Party? Does the poster expect the web server to not write a log line because he sent a DNT header too?

IP logs aren't sufficiently unique: my IP changes as I move my laptop around, it is shared with several other persons at work and home, and my IP at each of these locations changes. Most DNT is concerned with Javascript, which has the ability to be very intrusive than mere web logs. Analytics services started with web logs, but quickly transitioned to Javascript, because I can track a cookie much better than an IP ad…

I'll say here what I said in the other reply, but briefly.

There's a difference between a 3rd party doing the analytics and a 3rd party cookie. GA can (and should) use a 1st party cookie for this, which would make it impossible for them to correlate between sites. As a bonus, turning off 3rd party cookies also breaks ad retargeting, which makes everything better.

At that point, it's the same as Mozilla doing it themselves, but your concerns about JS being more potentially intrusive is valid.

note: i may be wrong about GA using 1st party cookies. if so, that's really not cool.

Re: Do Not Track is not respected on mozilla.org

#107

Post by thezilch » Wed, Jul 31, 2013, 7:53 PM UTC

bloopletech wrote: post #99

thezilch wrote: post #90

Earlier quoted context omitted.

You do know that sites will track you without javascript or ads? As well, do you browse without cookies and images, as those extensions will not help you there? And without session IDs in URIs, since you seem to want the web to return to byzantine times? > I believe the outcome will be a better business model for sites to make money Sites will make less money without use of cookies, images, and support of encoding se…

I think a number of different issues are being conflated here. Secondly, in my ordinary web browsing, I'm not trying to avoid all tracking whatsoever - I'm much more interested in blocking the 99.9% low-hanging fruit of commercial 3rd-party tracking. If I really was paranoid / needed to prevent tracking completely, I'd use a much more sophisticated setup. Given that context, the fact that some people may be trying to…

But the post I responded to is wrong. Blocking third party trackers does not block my hosting of the JS file; this is only discouraged for most trackers. Most trackers also have a gif-pixel option and by default (eg. quantcast) or a server-to-server option (eg. kissmetrics). I was merely pointing out your conclusions are wrong about Firefox, extensions, or HTTP headers preventing the capabilities of trackers. And again, you are very welcome to not be tracked online; that is very much within your right; you are just spreading falsehoods. Have a look at evercookie, for example.

Re: Do Not Track is not respected on mozilla.org

#108

Post by generj » Wed, Jul 31, 2013, 7:53 PM UTC

teamjimmyy wrote: post #106

generj wrote: post #102

Earlier quoted context omitted.

IP logs aren't sufficiently unique: my IP changes as I move my laptop around, it is shared with several other persons at work and home, and my IP at each of these locations changes. Most DNT is concerned with Javascript, which has the ability to be very intrusive than mere web logs. Analytics services started with web logs, but quickly transitioned to Javascript, because I can track a cookie much better than an IP ad…

I'll say here what I said in the other reply, but briefly. There's a difference between a 3rd party doing the analytics and a 3rd party cookie. GA can (and should) use a 1st party cookie for this, which would make it impossible for them to correlate between sites. As a bonus, turning off 3rd party cookies also breaks ad retargeting, which makes everything better. At that point, it's the same as Mozilla doing it thems…

GA does use 1st party cookies. There is still concern that with sufficient statistical analysis, Google can still track users across multiple sites. "Anonymous" data frequently turns out to be very personally identifying.

In particular, comparing behaviors and IP addresses used in Google products and captured in Google Analytics would be very easy.

Likewise, Google knows a super-majority of site entrances from their search engine, and a correlation is trivial given that most users are logged in for search. To wit: if I perform a search with a unique referrer, and that unique referrer is then captured with my Google Analytics user cookie, then I can be readily identified as a person. Doubleclick and other Google services share this issue.

Others do use Third Party Cookies. Mozilla is threatening to turn off 3rd Party cookies entirely, which has caused no small amount of concern from ad companies. See this post, one in a series of hilariously over the top diatribes from the Interactive Advertising Bureau: http://www.iab.net/iablog/2013/06/mozilla-kangaroo-cookie-co...

Re: Do Not Track is not respected on mozilla.org

#109

Post by mindslight » Wed, Jul 31, 2013, 7:59 PM UTC

Nursie wrote: post #10

toble wrote: post #8

Earlier quoted context omitted.

> No, my computer, my browser, my roof, my rules. I think of websites like private properties. You are given conditional access on the assumption that you can behave (T&C / AUP), otherwise it's like trespassing. So, I don't think that people should expect excessive rights of freedom that they might have on their own property or even in public. It's a balancing act.

That's really not how I think, nor does it really reflect reality, IMHO. They are on my property, it's all rendered and running in my browser on my device. All that's happened is I've requested some data from the server and they've given it to me, from then on how I display it and what gets run is entirely up to me. If we want to attach terms and conditions to it (i.e. to use this site you must accept analytics/track…

> If we want to attach terms and conditions to it then lets make a framework to automate this stuff

This is a terrible idea, as it will just devolve into the same type of faux-consent as click-through agreements and whatnot. Then there will be some legal concept that you've agreed to render web pages a certain way, and you'll have created the world you don't want.

If computers are to empower individuals, they must be owned by individuals and function as individuals' agents - not simply as local terminals running opaque code dictated by someone else (either through the technical means of DRM, or in this example legal means). Machine boundaries are trust boundaries, and network protocols mediate between them. Protocols enforce how processes communicate, but only make recommendations for how they should act. Relying on anything else is madness and should be considered a bug.

Re: Do Not Track is not respected on mozilla.org

#110

Post by teamjimmyy » Wed, Jul 31, 2013, 8:02 PM UTC

generj wrote: post #108

teamjimmyy wrote: post #106

Earlier quoted context omitted.

I'll say here what I said in the other reply, but briefly. There's a difference between a 3rd party doing the analytics and a 3rd party cookie. GA can (and should) use a 1st party cookie for this, which would make it impossible for them to correlate between sites. As a bonus, turning off 3rd party cookies also breaks ad retargeting, which makes everything better. At that point, it's the same as Mozilla doing it thems…

GA does use 1st party cookies. There is still concern that with sufficient statistical analysis, Google can still track users across multiple sites. "Anonymous" data frequently turns out to be very personally identifying. In particular, comparing behaviors and IP addresses used in Google products and captured in Google Analytics would be very easy. Likewise, Google knows a super-majority of site entrances from their…

Yeah, I saw the bit about turning off all 3rd party cookies, which made me happy as I already do that myself.

As for the ubiquity and potential for data sharing among Google services, I suppose I hadn't though that entirely through. I know there was one analytics company claiming it could track individuals between devices using some fancy statistics, but I assumed it was snake oil (it was not GA claiming that).

Anyway, I hear ya, and thanks. I can see a case against GA specifically, though I have a hard time swallowing it against all analytics. I suppose it's a question of trade-offs that people are willing to make.