Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA uses Google cookies to pinpoint targets for hacking

washingtonpost.com

Post reply on HN
Print view View original

91–100 of 178 posts

Re: NSA uses Google cookies to pinpoint targets for hacking

#91

Post by mike-cardwell »

Smerity wrote: post #7

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far…

Why do we still have referrers? They don't allow us to do anything that we wouldn't be able to do without them. If Mozilla and Google made a statement today saying, "We'll be removing referrers from cross site requests in 6 months time for Chrome and Firefox.", the tiny tiny proportion of sites that are using them for real functionality will have plenty of time to update.

Of course, as a web developer, it's useful to be able to see where people came from. But we don't have any right to that information. As an end-user, why the hell is my browser giving you this information for no reason when it doesn't have to?

I've been using RefControl for Firefox for years now. It fakes the referrer, setting it to the root of the domain being requested. This hasn't ever caused me any problems, so there can't be that many sites that rely on it.

I don't give a shit about your analytics or how much money you think you'll lose from referrers disappearing. Privacy is more important.

Re: NSA uses Google cookies to pinpoint targets for hacking

#92

Post by quesera »

fixanoid wrote: post #76
byoogle wrote: post #47

Earlier quoted context omitted.

This. I work on Disconnect. I don't understand why any hacker would still put Ghostery on their machine: * Ghostery is run by former ad execs (7/9ths of their executive team): http://www.evidon.com/our-team * They make their money (I've heard tens of millions of dollars per year) selling user data to ad co's and data brokers: http://www.evidon.com/#block-views-from_our_partners-block

Oh, hai Brian! Aren't you a former doubleclick-turn-righteous? And don't you also employ an ex-NSA dude? And no, we do not sell user data, just tracker data. Cheers!

I get that you two are rivals, but he does have a point that you haven't addressed.

Ghostery seems to be in the business of selling the data that I forget to tell them they may not collect. This is intrinsically a sneaky thing to do.

Yes I know about and use the "default to blocking" setting, but I don't think there is much argument that Ghostery users download your software with the expectation that the default would be anything else. But it is. And that's sneaky.

So you offer a very useful product, for free, and make money off of the people who fail to configure it so that it performs the only service they would ever purposely download it for.

Again, I have sniffed Ghostery looking for violations of my configuration settings, and never found any. I believe that it follows its configuration settings, and I am thankful for its existence. And I recognize that development and maintenance of it is not free. Presumably you are not a volunteer.

I have gotten value out of Ghostery, but apparently that has been on the backs of other users who want the same thing, but are less-careful than me about reading configuration options, and that doesn't sit well.

Re: NSA uses Google cookies to pinpoint targets for hacking

#93

Post by quesera »

andrewcooke wrote: post #85
fixanoid wrote: post #75

Earlier quoted context omitted.

Hi sboering, how are you? Ghostery does what the user tells it to do. If you are seeing unblocked trackers, most likely, its because we've added new trackers and you didn't select "block" by default for the new trackers when the list gets updated. You can change this preference by going into Ghostery options, Advanced, and review the "auto-update" section. And heres a full explanation as to what Evidon gets and what…

folks please don't downvote people when they're giving useful info. there is a button in the advanced section that makes blocking work by default on new data. that's useful to know - i've just enabled it, and you should too. just because you don't like someone (likely based on one comment on a web site...) doesn't mean that they should be downvoted...

I didn't downvote him, but I can understand why others might.

His comment seems willfully ignorant of the problem, which is that Ghostery calls itself a tracker-blocker, but squirrels that obviously-desirable config option away under "advanced" settings.

If Ghostery was on our side, really and truly, that would be the default. Indeed, it probably wouldn't even be an option.

Of course when the tracker list is updated, I want to block the new ones!

No post on HN, no matter how helpful, correct, and civil, changes that this operating model is essentially a trick.

I just spent 45 seconds explaining it, but it would have been faster, and pretty defensible, to just downvote.

On the other hand, nuking his comment into gray-land would obscure useful instructions for making Ghostery do what it is assumed to do in the first place. So I agree, downvoting here is destructive.

Re: NSA uses Google cookies to pinpoint targets for hacking

#94

Post by usrnam »

Last weak i create extension for Firefox:

Disable Google tracking, log off user FROM Google search engine: * keep login into Gmail * also remove ads * remove Cookie,Sess~/localstorage __ First run, need refresh Google page to log off ~~

-- Also remove Google anal-itics Cookie :)

https://addons.mozilla.org/pl/firefox/addon/googleantyspam/?...

Re: NSA uses Google cookies to pinpoint targets for hacking

#95

Post by leephillips »

mike-cardwell wrote: post #91
Smerity wrote: post #7

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far…

Why do we still have referrers? They don't allow us to do anything that we wouldn't be able to do without them. If Mozilla and Google made a statement today saying, "We'll be removing referrers from cross site requests in 6 months time for Chrome and Firefox.", the tiny tiny proportion of sites that are using them for real functionality will have plenty of time to update. Of course, as a web developer, it's useful to…

You ask, "Why do we still have referrers?", but then you answer your question: "as a web developer, it's useful to be able to see where people came from."

You are of course correct that we don't have a "right" to this information. But I've discovered, many times, through the referrers in my logs, links to my pages from some very interesting places that I might not have discovered otherwise (because the link information that Google discloses is woefully incomplete).

Any user who wants to hide referrer information can easily to do in a variety of ways. For example, I wrote a bookmarklet that does this for you: http://lee-phillips.org/norefBookmarklet/

Re: NSA uses Google cookies to pinpoint targets for hacking

#96

Post by noinsight »

pktgen wrote: post #23
bottled_poe wrote: post #10

In my opinion, browsers should block all third party website content by default. Yeah, I know, the interwebs will break if they actually did this. Well perhaps someone should come up with some kind of website quality rating which indicates that a site can be viewed withing worrying about the prying eyes of FaceBook, Google, Twitter, LinkedIn, etc.

Here's my ideal security policy: - Cross-site requests not allowed without whitelisting. This means some setup will be required at first (for example, for separate image domains used by Amazon, Google, Yahoo, etc.), but after a bit it shouldn't be a problem. This also serves as a "better adblock" in some ways, as it blocks ad networks without relying on a database that needs to be updated. - All cookies blocked by de…

Since browsers have varying support for even creating plugins for this, maybe it would be possible to create a proxy server that could handle this stuff?

Re: NSA uses Google cookies to pinpoint targets for hacking

#97

Post by dobbsbob »

Anonymous823 wrote: post #13
bottled_poe wrote: post #10

In my opinion, browsers should block all third party website content by default. Yeah, I know, the interwebs will break if they actually did this. Well perhaps someone should come up with some kind of website quality rating which indicates that a site can be viewed withing worrying about the prying eyes of FaceBook, Google, Twitter, LinkedIn, etc.

I made a post the other day, but it got pushed off 'new' in a few seconds. Anyway, I thought someone should setup a simple one or two page site that summarizes the importance of not tracking visitors. Then, it has a few 'this site respects your privacy' images in a variety of sizes that you can copy and paste into your own site, if you agree to respect those rules. It would need to be a recognizable image and symbol.…

German Privacy Foundation does this

Re: NSA uses Google cookies to pinpoint targets for hacking

#98

Post by kzrdude »

chroem wrote: post #6
misiti3780 wrote: post #4

Earlier quoted context omitted.

if you browse with cookies disabled, that means you cannot successful browse arounds sites logged in - correct ? you basically do a ctrl+shift+N in chrome every time you open a new window ?

I have a select few sites whitelisted, but they're disabled by default. Also, I'm on Iceweasel/ Firefox instead of Chrome. It's probably nothing to worry about, but you can never be too careful these days.

It's interesting but also annoying how my browsing is now diverged from the web as others see it. I mean, with increased amounts of blocking addons, the difference between an adblocked, ghostery'd, etc browsing experience to the vanilla experience is growing bigger.

Re: NSA uses Google cookies to pinpoint targets for hacking

#99

Post by anonymous123941 »

gorhill wrote: post #50
r0h1n wrote: post #45

Earlier quoted context omitted.

I would replace Ghostery in your list with Disconnect. I would also add the 'Self-destructing Cookies' browser plugin. In its settings, whitelist a very limited set of sites you want to allow persistent (or session) cookies.

I don't know about either... https://github.com/gorhill/httpswitchboard/wiki/How-does-HTT...

Could you include RequestPolicy in your comparison please?

https://addons.mozilla.org/en-US/firefox/addon/requestpolicy...

Re: NSA uses Google cookies to pinpoint targets for hacking

#100

Post by cataflam »

Smerity wrote: post #7

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far…

> That JS request to GA also has your referrer in it, in the clear. (...) If the link ends with Google Analytics, but doesn't start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from.

I'm curious. In that case, the GA JS is requested from what you call the "end page", so the referrer it has should be the "end page", not the one before it.

Post reply on HN