Live data from Hacker News

Unsanctioned Web Tracking

w3.org

21–30 of 42 posts

Re: Unsanctioned Web Tracking

#21
post #5
post #3

Earlier quoted context omitted.

It's extremely difficult to determine good vs bad analytics companies. Every analytics company is tracking data for multiple websites and therefore can track people across the web. How is the user suppose to know what you are doing with their data? Even if you aren't doing anything now, how can they be sure that won't change, especially if the company is sold.

This is sort of true but it depends. We set a first party domain specific cookie. We can't track a user across different domains, or customers. Technically we could correlate based on IP and activity times, but it's not the same as setting a super cookie that is shared between sites. You are still right, how is there user supposed to know if one tool is reputable and another isn't. Worse than that, one may be fine to…

    We can't track a user across different domains, or customers.
To be super clear- yes you can. You don't. That's very different. With full JS access on a site you have the ability to collect a lot of information. As another poster mentioned, it only takes 30 bits of entropy to identify all 3 billion internet users.

Re: Unsanctioned Web Tracking

#23

Earlier quoted context omitted.

Make it unlawful for javascript source to contain nothing but whitespace.

How is that helpful?

That's the kind of thing that legislators actually do; consider that the digital signature act didnt mention cryptography.

While I readily agree that web and mobile analytics should be unlawful it is unclear how to define what should be illegal.

I feel it is more effective to follow my example of pointing out the problem then explaining technical measures that may be used to defeat it.

However while my mother is diligent about shredding paper documents she ran out of filesystem space because she never empties her iMac's Trash.

Re: Unsanctioned Web Tracking

#24

The easiest way to spot web bugs is to use a very old build of Safari. There are many other ways but if you have an old Safari select Window -> Activity then leave it open as you browse a few different domains. You will see some 43 byte documents with huge long URLs full of query parameters, also one byte javascript sources. I block the ones I find in my hosts file: 127.0.0.1 www.hosted-pixel.com On some operating sy…

Just last night it occurred to me to write browser add-ons that would scramble those query parameters, also send bogus user-agent headers but only for the web bugs. That is, the add-on would discover one-pixel transparent gifs, take note of what query parameters they used, then every time it found that same gif in the future it would issue a GET with randomly selected parameters drawn from the instances of that same…

Why bother randomizing the query parameters, when you could just permanently cache the image?

Re: Unsanctioned Web Tracking

#25
Returning bogus information to trackers is one way to fight back. If the tracking data quality can be destroyed, it will become useless to advertisers and tracking companies will go broke.

Meanwhile, use Ghostery and block everything. A few sites won't work, but there are better alternatives for most of them. With all tracking blocked, you can't watch ABC-TV, but in exchange, commercials are skipped on CBS-TV shows.

Re: Unsanctioned Web Tracking

#26
post #24

Earlier quoted context omitted.

Just last night it occurred to me to write browser add-ons that would scramble those query parameters, also send bogus user-agent headers but only for the web bugs. That is, the add-on would discover one-pixel transparent gifs, take note of what query parameters they used, then every time it found that same gif in the future it would issue a GET with randomly selected parameters drawn from the instances of that same…

Why bother randomizing the query parameters, when you could just permanently cache the image?

If I permanently cache the image or block the server with my hosts file then the web analytics services will not track me.

If I randomize the query parameters then they will not track anyone because they won't provide useful information to those who presently purchase it. Of course that will require far more people then me to also randomize their query parameters.

Re: Unsanctioned Web Tracking

#27

The easiest way to spot web bugs is to use a very old build of Safari. There are many other ways but if you have an old Safari select Window -> Activity then leave it open as you browse a few different domains. You will see some 43 byte documents with huge long URLs full of query parameters, also one byte javascript sources. I block the ones I find in my hosts file: 127.0.0.1 www.hosted-pixel.com On some operating sy…

Tool to maintain /etc/hosts: https://github.com/jakeogh/dnsmasq-blacklist

Re: Unsanctioned Web Tracking

#28
post #20

I agree that supercookies and header enrichment should be prevented whenever and however possible (e.g. header enrichment will be solved by requiring encryption à la Let's Encrypt), but fingerprinting is a lost battle that we should all give up on. We will never be able to solve fingerprinting without upheaving the entire web platform as we know it. So many web APIs are simply not possible without exposing some UA ca…

This defeatist attitude is dangerous, especially when the solution is simple: just stop browsers from leaking >= ~30 bits of entropy.

Deprecate HTTP headers that leak entropy (like the user agent). Rewrite fields like If-Modified-Since so they can only express a value quantized into values no smaller than days. Remove JS APIs that leak information (like the ability to read CSS attributes). Impose stricter same-origin policies to eliminate 3rd-party cookies and javascript. Some people will complain that this breaks some use cases. Just as Dan Geer put it when discussing software liability, "Yes, please! That was exactly the idea."

Unless a platform puts user safety first - without exception - then it inevitably creates moral hazard. If for some reason this does not entirely fix the problem, then we apply the force of law - just like we do in every other area of society. If this concerns you, you should encourage self policing and removal of the business models based on any kind of fingerprinting, so no legal remedy is necessary.

People may indeed deserve jail time (or other legal remedy) for stalking. Technical literacy does not except you from social responsibility. As for your concerns about a jury: the problems with our legal system are far broader than your concerns over "technical literacy. A lot of work is needed in that area, with great urgency. That aside, a jury is also not expected to be an expert in advanced kinematics when they hear a case involving cars that crashed into each other at an intersection. It is the responsibility of the lawyers involved to explain such technical details to the jury. My grandfather - a physicist who reconstructed accidents and a frequent expert witness - has given quite a few remedial lessons in physics from the witness box.

I understand the concern about having to worry about this kind of legal threat. It is scary, but you will learn to live with it, just like surgeons learn to live with the possibility of malpractice charges or civil engineers that could be liable if the building they design falls down. Really, the concerns of a developer shouldn't be that bad compared to the doctor or civil engineer who have to worry about people dying if they make some kinds of mistakes.

What I find a far scarier future would be the future where people are not only afraid to speak their mind out of fear of being recorded, but where they are afraid to even seek out knowledge because of the trail it leaves. Our judicial system certainly has problems, but I'll take it over de facto feudalism, where the only people that can freely speak their mind are the lords that control the aggregate databases of everything their peasants do.

By the way - while it certainly isn't perfect, the EFF's Panopticlick tool reports my browser as only leaking 14.03 bits of entropy. The user agent accounts for ~9 of those bits, and ~4 more bits from the HTTP accept headers. Both of those are trivially removable, and the remaining entropy would not be easily to fingerprint. I'm sure this analysis misses some entropy sources, but this should be sufficient to show that it is possible to fix this problem.

Re: Unsanctioned Web Tracking

#29
Can someone tell me how these super cookies work? Cookies can only be read in the domain/origin they were set, so how is a cookie passing data off to other domains?

Or is it just as simple as two companies working together and fingerinting and matching thereby making that called a super cookie?

Re: Unsanctioned Web Tracking

#30
post #29

Can someone tell me how these super cookies work? Cookies can only be read in the domain/origin they were set, so how is a cookie passing data off to other domains? Or is it just as simple as two companies working together and fingerinting and matching thereby making that called a super cookie?

SuperCookies are generally considered to be cookies that recreate themselves after deletion. A variety of techniques are used for this, ranging from cooperating domain to flash cookies to local storage.

Information us passed between sites using JavaScript and backend cooperation on ID matching.

Post reply on HN