Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Slow Death of ‘Do Not Track’

nytimes.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: The Slow Death of ‘Do Not Track’

#41

Post by rvern »

ryan-c wrote: post #30
rvern wrote: post #28

Earlier quoted context omitted.

I doubt it is possible to determine the exact version, or even the browser (though the accept headers might leak it), without JavaScript. Thus NoScript fixes that problem. You are right that this gives more information to a determined person, but anyone who pushes fingerprinting to the point of detecting a user’s browser version and other characteristics through JavaScript will certainly be able to identify you uniqu…

It's possible to differentiate the major browsers and operating systems without javascript, and even the versions can be narrowed down without javascript even with user agent spoofing. p0f, for example, can do this. http://lcamtuf.coredump.cx/p0f3/

I didn’t know packets leaked this much information… Thank you for mentioning this.

Re: The Slow Death of ‘Do Not Track’

#42

Post by thomasfoster96 »

eli wrote: post #32
thomasfoster96 wrote: post #6

DNT was essentially dead quite a while ago. If we are goign to get something like Do Not Track, then it should have been drafted out of the public eye, had a nice short period for public comment and then recieved some sort of backing in law. Speculative implementations didn't really help. I'm not too familiar with the laws surrounding things like 'do not call' lists and anti-spam measures, but some sort of system fro…

At the risk of stating the obvious, Do Not Call has not stopped phone scams and telemarketing and CAN-SPAM has not stopped actual spam. It's hard for me to get too excited about a Do Not Track solution that only really applies to the sort of companies that follow the rules in the first place.

Well, I'd say Do Not Call and CAN-SPAM are somewhat different in that it's not a user initiating the communication - for Do Not Track it's the user (via the browser) initiating communication.

Re: The Slow Death of ‘Do Not Track’

#43

Post by ryan-c »

rvern wrote: post #41
ryan-c wrote: post #30

Earlier quoted context omitted.

It's possible to differentiate the major browsers and operating systems without javascript, and even the versions can be narrowed down without javascript even with user agent spoofing. p0f, for example, can do this. http://lcamtuf.coredump.cx/p0f3/

I didn’t know packets leaked this much information… Thank you for mentioning this.

One of the less obvious things is that the fact you're using a VPN may be leaked on a TCP session by the MTU/MSS values.

Re: The Slow Death of ‘Do Not Track’

#44

Post by JadeNB »

hobs wrote: post #23
SquareWheel wrote: post #11

Earlier quoted context omitted.

Ultimately then Javascript becomes useless, because 95% of clients will not have it enabled. This is why we have sandboxing, and very high browser bounties for any exploits that allow you to leave that sandbox. Is it perfect? Nope. But it's the best option to move forward safely in the web without going back in time 20 years.

I have JS turned off by default. Why? Most of the web works fine, it does not break most sites the internet. JS can be used to just do annoying crap, play sounds or videos, etc. I can choose to mute my entire browser or I can choose to not run JS on new sites until I approve of them. (This used to be more important before patches for js moving browser windows and the like) While most JS wont break out of the browser…

> Most of the web works fine, it does not break most sites the internet.

While I agree with you in spirit, this doesn't seem to be true in practice. I also browse with JS turned off by default, and, in general, whenever I visit a new site, I often find it blank, or completely illegible. After allowing JavaScript for that site, I then often have to play a guessing game of what CDNs or other external resources I have to allow before anything will display. (For example, I was able to see weather on weather.com—hardly anyone's idea of a good Internet citizen, but the first one that springs to mind—simply by allowing JavaScript from their domain; but had to guess around quite a bit before I could get the settings icon to display.)

Re: The Slow Death of ‘Do Not Track’

#45

Post by JadeNB »

tomjen3 wrote: post #12
cm2187 wrote: post #8

Earlier quoted context omitted.

My opinion is that javascript should be opt-in. The idea that any junk website is allowed to execute code on your machine without asking or even the user being aware is a fundamental security flaw.

That is a really common idea here and a really arrogant one given how many SASS businesses wouldn't be possible without JS. There were a time when the internet was about reading text, but that has long since passed. Without javascript you can't have a presentation overlayed with video (say of the presenter), you can't have real time anything, you can't comment without having to reload the page, etc. Look at how horri…

> That is a really common idea here and a really arrogant one given how many SASS businesses wouldn't be possible without JS.

Why is it arrogant? Surely "my site won't work with your browser settings" is not inherently an argument that I have to change my browser settings!

I mean, you can say "by browsing with JavaScript off, you kill the rich web", but I can also say "by refusing to make available a plain-text version of your site, you kill the information web" (with whatever appropriate buzzwords substituted for my ungainly ones). Many of the same arguments here could, I think, have explained why Flash is absolutely necessary for the modern web—until Apple's weight showed that it isn't.

Re: The Slow Death of ‘Do Not Track’

#46

Post by JadeNB »

thomasfoster96 wrote: post #6

DNT was essentially dead quite a while ago. If we are goign to get something like Do Not Track, then it should have been drafted out of the public eye, had a nice short period for public comment and then recieved some sort of backing in law. Speculative implementations didn't really help. I'm not too familiar with the laws surrounding things like 'do not call' lists and anti-spam measures, but some sort of system fro…

> If we are goign to get something like Do Not Track, then it should have been drafted out of the public eye, had a nice short period for public comment and then recieved some sort of backing in law.

I'm confused by this—how would drafting the law / specification / whatever out of the public eye have helped the process?

Re: The Slow Death of ‘Do Not Track’

#47

Post by MichaelCrawford »

I don't trust anyone to respect my Do Not Track settings.

Rather what I do is to blackhole the analytics servers with my /etc/hosts:

   127.0.0.1 www.googleanalytics.com
   127.0.0.1 www.heapanalytics.com
Unfortunately one must jailbreak mobile devices to get at their hosts files. I understand that Windows no longer uses it at all.

Better would be to block the analytics services at the router, or preload a caching DNS server with them.

I also avoid "Log In With Facebook" &c. I don't register at a site unless it offers its own login facility.

Re: The Slow Death of ‘Do Not Track’

#48

Post by thomasfoster96 »

JadeNB wrote: post #46
thomasfoster96 wrote: post #6

DNT was essentially dead quite a while ago. If we are goign to get something like Do Not Track, then it should have been drafted out of the public eye, had a nice short period for public comment and then recieved some sort of backing in law. Speculative implementations didn't really help. I'm not too familiar with the laws surrounding things like 'do not call' lists and anti-spam measures, but some sort of system fro…

> If we are goign to get something like Do Not Track, then it should have been drafted out of the public eye, had a nice short period for public comment and then recieved some sort of backing in law. I'm confused by this—how would drafting the law / specification / whatever out of the public eye have helped the process?

I think doing it out of the public eye might have stopped premature use and implementations. Inconsistencies really had to be avoided, but without much of a concrete draft, implementations like Microsoft's sort of derailed the effort.

Re: The Slow Death of ‘Do Not Track’

#49

Post by Methusalah »

MichaelCrawford wrote: post #47

I don't trust anyone to respect my Do Not Track settings. Rather what I do is to blackhole the analytics servers with my /etc/hosts: 127.0.0.1 www.googleanalytics.com 127.0.0.1 www.heapanalytics.com Unfortunately one must jailbreak mobile devices to get at their hosts files. I understand that Windows no longer uses it at all. Better would be to block the analytics services at the router, or preload a caching DNS serv…

Windows still uses the hosts file in windows 8. I did a little looking around and it looks like Windows Defender automatically removes some hosts from the file.

Re: The Slow Death of ‘Do Not Track’

#50

Post by MichaelCrawford »

Methusalah wrote: post #49
MichaelCrawford wrote: post #47

I don't trust anyone to respect my Do Not Track settings. Rather what I do is to blackhole the analytics servers with my /etc/hosts: 127.0.0.1 www.googleanalytics.com 127.0.0.1 www.heapanalytics.com Unfortunately one must jailbreak mobile devices to get at their hosts files. I understand that Windows no longer uses it at all. Better would be to block the analytics services at the router, or preload a caching DNS serv…

Windows still uses the hosts file in windows 8. I did a little looking around and it looks like Windows Defender automatically removes some hosts from the file.

Thanks for looking into it. I have Windows but don't use it a whole lot.

Strictly speaking DNS is a protocol and not an API. Applications aren't required to perform name lookups by using any particular software, it's just common to use what the OS supplies.

Post reply on HN