Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Slow Death of ‘Do Not Track’

nytimes.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: The Slow Death of ‘Do Not Track’

#21

Post by stingraycharles »

rgro wrote: post #2

The worst part about the DNT header was the requirement for the tracking companies to regulate themselves. Initially, the header was opt-in, but with the introduction of IE10, Microsoft decided that the option was going to be opt-out. Once the the DNT header was gaining traction and a not-so-small percentage of people began sending the header, the companies had no reason to comply, and the initiative sorta fell out o…

> The worst part about the DNT header was the requirement for the tracking companies to regulate themselves. Initially, the header was opt-in, but with the introduction of IE10, Microsoft decided that the option was going to be opt-out.

Call me a conspiracy theorist, but being a former CTO of an adserving company, I feel qualified to at least voice my opinion: this was a brilliant move by Microsoft. The DNT header as it were, was a perfect middle-ground for advertising companies: people that cared enough were able to opt-out, and people that did not care would still be able to be tracked.

Google had the most to lose. I feel Microsoft made this decision in order to (accelerate the) kill of the DNT header, and thus hoping on more severe legislation.

Re: The Slow Death of ‘Do Not Track’

#22

Post by stingraycharles »

oneeyedpigeon wrote: post #9
eterm wrote: post #7

Earlier quoted context omitted.

So we ought to start considering whether those things should be permissible by default in browsers. It used to be that sites could inspect the clipboard until we realised how bad for security that was. Perhaps mouse movement and/or timing information should be something that isn't allowed by default without granting the site additional permissions. Perhaps browsers could be set to stop sending many of the headers the…

Two of the worst offenders are overly-specific user agents (a setting which should definitely be configurable) and list of plugins (which I see no reason for being available).

List of plugins is useful to detect the presence of Adobe Flash.

Re: The Slow Death of ‘Do Not Track’

#23

Post by hobs »

SquareWheel wrote: post #11
cm2187 wrote: post #8

Earlier quoted context omitted.

My opinion is that javascript should be opt-in. The idea that any junk website is allowed to execute code on your machine without asking or even the user being aware is a fundamental security flaw.

Ultimately then Javascript becomes useless, because 95% of clients will not have it enabled. This is why we have sandboxing, and very high browser bounties for any exploits that allow you to leave that sandbox. Is it perfect? Nope. But it's the best option to move forward safely in the web without going back in time 20 years.

I have JS turned off by default. Why?

Most of the web works fine, it does not break most sites the internet.

JS can be used to just do annoying crap, play sounds or videos, etc. I can choose to mute my entire browser or I can choose to not run JS on new sites until I approve of them. (This used to be more important before patches for js moving browser windows and the like)

While most JS wont break out of the browser in most cases, what you can do within the browser to determine where you have been, who you are, and (if you visit samy.pl) things like enumerating your local network or running a bitcoin miner with JS are possible.

Re: The Slow Death of ‘Do Not Track’

#24

Post by rvern »

oneeyedpigeon wrote: post #9
eterm wrote: post #7

Earlier quoted context omitted.

So we ought to start considering whether those things should be permissible by default in browsers. It used to be that sites could inspect the clipboard until we realised how bad for security that was. Perhaps mouse movement and/or timing information should be something that isn't allowed by default without granting the site additional permissions. Perhaps browsers could be set to stop sending many of the headers the…

Two of the worst offenders are overly-specific user agents (a setting which should definitely be configurable) and list of plugins (which I see no reason for being available).

In Mozilla Firefox, you can create the setting general.useragent.override (it doesn’t exist by default) and set its value to “Firefox” to get a very generic user agent string that websites will still recognize as Firefox and not block as a bot.

Regarding plugins, the best solution I have found is to have none enabled. Firefox still sends them in the list when using click-to-play, so it is necessary to disable them completely.

Re: The Slow Death of ‘Do Not Track’

#25

Post by ryan-c »

oneeyedpigeon wrote: post #9
eterm wrote: post #7

Earlier quoted context omitted.

So we ought to start considering whether those things should be permissible by default in browsers. It used to be that sites could inspect the clipboard until we realised how bad for security that was. Perhaps mouse movement and/or timing information should be something that isn't allowed by default without granting the site additional permissions. Perhaps browsers could be set to stop sending many of the headers the…

Two of the worst offenders are overly-specific user agents (a setting which should definitely be configurable) and list of plugins (which I see no reason for being available).

Your browser (including the exact version) can be determined without looking at the user agent string (which is mostly a series of lies anyway). Changing it "for privacy" makes you easier to track.

As to the plugin list, you could make it non-enumerable, but then one could just probe for the X most common ones, like can be done for fonts.

Re: The Slow Death of ‘Do Not Track’

#27

Post by ryan-c »

rvern wrote: post #24
oneeyedpigeon wrote: post #9

Earlier quoted context omitted.

Two of the worst offenders are overly-specific user agents (a setting which should definitely be configurable) and list of plugins (which I see no reason for being available).

In Mozilla Firefox, you can create the setting general.useragent.override (it doesn’t exist by default) and set its value to “Firefox” to get a very generic user agent string that websites will still recognize as Firefox and not block as a bot. Regarding plugins, the best solution I have found is to have none enabled. Firefox still sends them in the list when using click-to-play, so it is necessary to disable them co…

As I said in my other comment, changing your user agent string affords you no privacy protection against those who care about knowing, and makes you more trackable.

Re: The Slow Death of ‘Do Not Track’

#28

Post by rvern »

ryan-c wrote: post #25
oneeyedpigeon wrote: post #9

Earlier quoted context omitted.

Two of the worst offenders are overly-specific user agents (a setting which should definitely be configurable) and list of plugins (which I see no reason for being available).

Your browser (including the exact version) can be determined without looking at the user agent string (which is mostly a series of lies anyway). Changing it "for privacy" makes you easier to track. As to the plugin list, you could make it non-enumerable, but then one could just probe for the X most common ones, like can be done for fonts.

I doubt it is possible to determine the exact version, or even the browser (though the accept headers might leak it), without JavaScript. Thus NoScript fixes that problem.

You are right that this gives more information to a determined person, but anyone who pushes fingerprinting to the point of detecting a user’s browser version and other characteristics through JavaScript will certainly be able to identify you uniquely anyway. In such a case, it doesn’t matter than this person has more or less information, since he can already identify you; and having a generic user agent makes people who only look at it know less about you.

Re: The Slow Death of ‘Do Not Track’

#29

Post by rb12345 »

tfgg wrote: post #13
thomasfoster96 wrote: post #6

DNT was essentially dead quite a while ago. If we are goign to get something like Do Not Track, then it should have been drafted out of the public eye, had a nice short period for public comment and then recieved some sort of backing in law. Speculative implementations didn't really help. I'm not too familiar with the laws surrounding things like 'do not call' lists and anti-spam measures, but some sort of system fro…

And the EU, rather than doing this, enacted their dumb 'cookie law' which, as far as I can tell, has just meant every UK website now has unnecessary cluttery popups telling you that they're using cookies.

That was around before DNT (just). Given that the popups were required in any case and are site-specific acceptance, why bother with DNT? It was more work to implement for zero benefit. Admittedly that also applies to the popups, but those were less optional.

Re: The Slow Death of ‘Do Not Track’

#30

Post by ryan-c »

rvern wrote: post #28
ryan-c wrote: post #25

Earlier quoted context omitted.

Your browser (including the exact version) can be determined without looking at the user agent string (which is mostly a series of lies anyway). Changing it "for privacy" makes you easier to track. As to the plugin list, you could make it non-enumerable, but then one could just probe for the X most common ones, like can be done for fonts.

I doubt it is possible to determine the exact version, or even the browser (though the accept headers might leak it), without JavaScript. Thus NoScript fixes that problem. You are right that this gives more information to a determined person, but anyone who pushes fingerprinting to the point of detecting a user’s browser version and other characteristics through JavaScript will certainly be able to identify you uniqu…

It's possible to differentiate the major browsers and operating systems without javascript, and even the versions can be narrowed down without javascript even with user agent spoofing.

p0f, for example, can do this.

http://lcamtuf.coredump.cx/p0f3/

Post reply on HN