Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA uses Google cookies to pinpoint targets for hacking

washingtonpost.com

Post reply on HN
Print view View original

131–140 of 178 posts

Re: NSA uses Google cookies to pinpoint targets for hacking

#131

Post by gorhill »

byoogle wrote: post #61
znowi wrote: post #59

Earlier quoted context omitted.

Sadly, Disconnect detects less trackers than Ghostery (e.g. 5 vs 7 on washingtonpost.com). I also like how Ghostery provides URLs for each tracker source (actual payload) that you can easily view on their site. There's also a database with short description, affiliations and privacy terms for each tracker (e.g. https://www.ghostery.com/apps/google_analytics ). I really appreciate an ethical alternative to tainted Gho…

Not true, Disconnect detects 13 trackers on http://www.washingtonpost.com/ . If you're running multiple filtering extensions all at the same time, install order matters as far as which extension sees which HTTP requests.

What was not blocked:

== Disconnect:

* s3.amazonaws.com

* cloudfront.net

* echoenabled.com

* troveread.com

* trove.com

== Ghostery:

* s3.amazonaws.com

* echoenabled.com

* platform.twitter.com

== HTTP Switchboard

* echoenabled.com

For HTTP Switchboard, I could easily identify glancing at the matrix that what was requested was a CSS file, I then proceeded to block with one click anything coming from `echoenabled.com`. The page still displayed properly for all three blockers.

Also of note, with Disconnect and Ghostery, there were some scripts running requesting data from api.echoenabled.com and echoapi.wpdigital.net every few seconds. These requests were blocked by HTTP Switchboard without my intervention to prevent this.

Re: NSA uses Google cookies to pinpoint targets for hacking

#133

Post by JohnTHaller »

chavesn wrote: post #116
JohnTHaller wrote: post #101

Earlier quoted context omitted.

For lots of us using basic CDN services, we enable referrer checks to ensure that folks aren't hotlinking images or direct linking downloads from other sites. These CDNs allow basic blocking based on referrers. You usually set it to only permit when there is a referrer from your own domain as well as blank referrers (if the CDN supports it) since most privacy conscious folks will disable referrer rather than fake it.…

I can think of one more; some sites use referrer to allow you to bypass a paywall if (and only if) you came from search results. The problem is, all of these "features" allowed by referrers are user-hostile actions. If referrers went away tomorrow, users wouldn't notice the difference or care. Publishers would get angry and think "we can't milk our content/visitors for as much money anymore!" But that doesn't really…

It's only hostile to sites that try and steal bandwidth resources by hotlinking/leeching images or direct linking downloads. It's not about milking visitors. It's about preventing unethical behavior by other sites.

I've spent 10s of thousands of dollars hosting free and open source software for millions of people over the years and I make sure to prevent bandwidth theft from other sites that cut into my ability to provide that service. Ad revenue (all responsible ads... no popups, no sound, etc) doesn't cover the cost of hosting and bandwidth even when sites are prevented from being unethical.

Take away referrers and it will be replaced by more complicated technology that serves the same purpose. CDN providers have secure links, for instance, that use an API to allow sites to generate a one-time use or limited time window link for a download from the CDN of a given file. It's more complex, but it's what I'd switch to tomorrow for downloads if referrers went away.

Re: NSA uses Google cookies to pinpoint targets for hacking

#134

Post by tunap »

quesera wrote: post #24
Smerity wrote: post #7

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far…

Please do post your research when it's cooked. It sounds like useful stuff. Firefox, ABE, NoScript, Request Policy, Ghostery, HTTPS-everywhere, hygiene. The irony of my militant approach toward privacy is that I probably make myself more interesting to would-be eavesdroppers by my carefulness than I would if they could see it all -- I'm just not that interesting. On the plus side, the LCD of legitimate-threat hostile…

ABE, NoScript, HTTPS Everywhere, Blender. Run em all in Sandboxie for pr0n and spelunking.

Like to point out what may be obvious to some but not others, when using NoScript you may want to remove Goog, Yahoo, etc from the default whitelist.

Before Blender I used various iterations of FF for testing & different surfing types(Waterfox/PaleMoon/ESR), but it appears I'll only be doing that for testing purposes anymore. https://addons.mozilla.org/en-US/firefox/addon/blender-1/?sr...

Re: NSA uses Google cookies to pinpoint targets for hacking

#135

Post by aroch »

byoogle wrote: post #122
byoogle wrote: post #113

Earlier quoted context omitted.

quesera described what's sneaky about Ghostery - their users think they're protected but aren't and don't know they're sending data to Evidon that the company sells but are: > So you offer a very useful product, for free, and make money off of the people who fail to configure it so that it performs the only service they would ever purposely download it for. I gave some numbers above that show, in practice, just how m…

[Replying to aroch, who's too nested.] > And how exactly is it trickery if users have to opt-in to the program and they're told what the program does? Ghostery seems to rely on vague messaging (last I looked, they don't actually say anywhere in their extension that they sell the data you share to ad co's and data brokers) and UX "optimization" (what quesera dubbed the "reconfigure-on-update dance", for example) to ge…

In the second paragraph (though really, its just a statement...) on the preferences page -- no need to navigate to another page, and they tell it to you in plain english. Once again, you have to opt-in, so if you opt-in without knowing what it does it's your own fault and you're being a dumb user:

When you enable GhostRank, Ghostery collects anonymous data about the trackers you've encountered and the sites on which they were placed. This data is about tracking elements and the webpages on which they are found, not you or your browsing habits.

Online marketing companies need better visibility into real-world applications of their technologies and those owned by their competitors. GhostRank data is sold as reports to businesses to help them market to consumers more transparently, better manage their web properties, and comply with privacy standards.

Re: NSA uses Google cookies to pinpoint targets for hacking

#136

Post by reginaldjcooper »

quesera wrote: post #24
Smerity wrote: post #7

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far…

Please do post your research when it's cooked. It sounds like useful stuff. Firefox, ABE, NoScript, Request Policy, Ghostery, HTTPS-everywhere, hygiene. The irony of my militant approach toward privacy is that I probably make myself more interesting to would-be eavesdroppers by my carefulness than I would if they could see it all -- I'm just not that interesting. On the plus side, the LCD of legitimate-threat hostile…

What is this hygiene add-on?

Re: NSA uses Google cookies to pinpoint targets for hacking

#137

Post by byoogle »

gorhill wrote: post #131
byoogle wrote: post #61

Earlier quoted context omitted.

Not true, Disconnect detects 13 trackers on http://www.washingtonpost.com/ . If you're running multiple filtering extensions all at the same time, install order matters as far as which extension sees which HTTP requests.

What was not blocked: == Disconnect: * s3.amazonaws.com * cloudfront.net * echoenabled.com * troveread.com * trove.com == Ghostery: * s3.amazonaws.com * echoenabled.com * platform.twitter.com == HTTP Switchboard * echoenabled.com For HTTP Switchboard, I could easily identify glancing at the matrix that what was requested was a CSS file, I then proceeded to block with one click anything coming from `echoenabled.com`.…

[You think maybe you should start identifying that you're promoting your own product with these comments?]

The first thing I tried when I wrote Disconnect was to block every third-party domain. Within an hour, I realized that I broke the whole web. So I built a crawler to identify and categorize the most prevalent third-party services instead. The domains you list under Disconnect would all be categorized as content by our crawler - resources that most people would consider pages broken without and that Disconnect doesn't block by default.

Re: NSA uses Google cookies to pinpoint targets for hacking

#138

Post by bdt101 »

Smerity wrote: post #7

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far…

Google Analytics uses only a first party cookie to identify visitors. That means your id is different on each site you visit. You therefore cannot track a unique visitor across the web using GA cookies.

Google Analytics requests are also only unencrypted if the site itself is unencrypted, so the fact that the GA request includes the referrer doesn't seem relevant (since the referrer would have already been transferred in the clear in the Referer header on the initial HTTP request.)

Re: NSA uses Google cookies to pinpoint targets for hacking

#139

Post by gavinpc »

r0h1n wrote: post #45
quesera wrote: post #24

Earlier quoted context omitted.

Please do post your research when it's cooked. It sounds like useful stuff. Firefox, ABE, NoScript, Request Policy, Ghostery, HTTPS-everywhere, hygiene. The irony of my militant approach toward privacy is that I probably make myself more interesting to would-be eavesdroppers by my carefulness than I would if they could see it all -- I'm just not that interesting. On the plus side, the LCD of legitimate-threat hostile…

I would replace Ghostery in your list with Disconnect. I would also add the 'Self-destructing Cookies' browser plugin. In its settings, whitelist a very limited set of sites you want to allow persistent (or session) cookies.

> I would also add the 'Self-destructing Cookies' browser plugin. In its settings, whitelist a very limited set of sites you want to allow persistent (or session) cookies.

Curious, how would this differ from whitelisting cookies in the browser's own settings?

Re: NSA uses Google cookies to pinpoint targets for hacking

#140

Post by DerpDerpDerp »

JohnTHaller wrote: post #133
chavesn wrote: post #116

Earlier quoted context omitted.

I can think of one more; some sites use referrer to allow you to bypass a paywall if (and only if) you came from search results. The problem is, all of these "features" allowed by referrers are user-hostile actions. If referrers went away tomorrow, users wouldn't notice the difference or care. Publishers would get angry and think "we can't milk our content/visitors for as much money anymore!" But that doesn't really…

It's only hostile to sites that try and steal bandwidth resources by hotlinking/leeching images or direct linking downloads. It's not about milking visitors. It's about preventing unethical behavior by other sites. I've spent 10s of thousands of dollars hosting free and open source software for millions of people over the years and I make sure to prevent bandwidth theft from other sites that cut into my ability to pr…

So it sounds like there's already a solution to your problem that doesn't require leaking privacy all over the internet, since presumably the one-time links are on request from a page on your website, and tells you nothing but someone on your website wanted something from your website.

How is this a bad thing? How would removing referrals harm you in any way?

Post reply on HN