Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Slow Death of ‘Do Not Track’

nytimes.com

Post reply on HN
Print view View original

11–20 of 51 posts

Re: The Slow Death of ‘Do Not Track’

#11

Post by SquareWheel »

cm2187 wrote: post #8
eterm wrote: post #7

Earlier quoted context omitted.

So we ought to start considering whether those things should be permissible by default in browsers. It used to be that sites could inspect the clipboard until we realised how bad for security that was. Perhaps mouse movement and/or timing information should be something that isn't allowed by default without granting the site additional permissions. Perhaps browsers could be set to stop sending many of the headers the…

My opinion is that javascript should be opt-in. The idea that any junk website is allowed to execute code on your machine without asking or even the user being aware is a fundamental security flaw.

Ultimately then Javascript becomes useless, because 95% of clients will not have it enabled. This is why we have sandboxing, and very high browser bounties for any exploits that allow you to leave that sandbox. Is it perfect? Nope. But it's the best option to move forward safely in the web without going back in time 20 years.

Re: The Slow Death of ‘Do Not Track’

#12

Post by tomjen3 »

cm2187 wrote: post #8
eterm wrote: post #7

Earlier quoted context omitted.

So we ought to start considering whether those things should be permissible by default in browsers. It used to be that sites could inspect the clipboard until we realised how bad for security that was. Perhaps mouse movement and/or timing information should be something that isn't allowed by default without granting the site additional permissions. Perhaps browsers could be set to stop sending many of the headers the…

My opinion is that javascript should be opt-in. The idea that any junk website is allowed to execute code on your machine without asking or even the user being aware is a fundamental security flaw.

That is a really common idea here and a really arrogant one given how many SASS businesses wouldn't be possible without JS.

There were a time when the internet was about reading text, but that has long since passed. Without javascript you can't have a presentation overlayed with video (say of the presenter), you can't have real time anything, you can't comment without having to reload the page, etc. Look at how horrible the UX of HN is compared to reddit.

Re: The Slow Death of ‘Do Not Track’

#13

Post by tfgg »

thomasfoster96 wrote: post #6

DNT was essentially dead quite a while ago. If we are goign to get something like Do Not Track, then it should have been drafted out of the public eye, had a nice short period for public comment and then recieved some sort of backing in law. Speculative implementations didn't really help. I'm not too familiar with the laws surrounding things like 'do not call' lists and anti-spam measures, but some sort of system fro…

And the EU, rather than doing this, enacted their dumb 'cookie law' which, as far as I can tell, has just meant every UK website now has unnecessary cluttery popups telling you that they're using cookies.

Re: The Slow Death of ‘Do Not Track’

#14

Post by berkes »

NeutronBoy wrote: post #4
IdeaSunday wrote: post #3

Earlier quoted context omitted.

Wont you always be trackable by an heuristic approach? I would expect that a fuzzy hash of your ip,location,language settings,resolution, browsertype, average mousespeed, your computers speed to draw a circle, calc a prime etc etc etc will always identify you.

This site is good for some analysis of exactly that type of fingerprinting https://amiunique.org/

The EFF has something similar, panopticlick: https://panopticlick.eff.org/

Re: The Slow Death of ‘Do Not Track’

#15

Post by krapp »

cm2187 wrote: post #8
eterm wrote: post #7

Earlier quoted context omitted.

So we ought to start considering whether those things should be permissible by default in browsers. It used to be that sites could inspect the clipboard until we realised how bad for security that was. Perhaps mouse movement and/or timing information should be something that isn't allowed by default without granting the site additional permissions. Perhaps browsers could be set to stop sending many of the headers the…

My opinion is that javascript should be opt-in. The idea that any junk website is allowed to execute code on your machine without asking or even the user being aware is a fundamental security flaw.

Opting in to javascript wouldn't make anyone any safer. You would literally have to manually inspect every line and re opt-in with every single request (since javascript can be dynamically generated per request) to even attempt to verify the safety of the code. Most people would simply be annoyed, and browser vendors would add opt-in by default as soon as possible, just to survive.

If you trust javascript that little, just turn it off entirely in your browser and let the rest of the web be. You're far, far more at risk from the browser itself, plugins and apps than from javascript.

>The idea that any junk website is allowed to execute code on your machine without asking or even the user being aware is a fundamental security flaw.

That's not a bug, it's a feature.

Re: The Slow Death of ‘Do Not Track’

#16

Post by cm2187 »

tomjen3 wrote: post #12
cm2187 wrote: post #8

Earlier quoted context omitted.

My opinion is that javascript should be opt-in. The idea that any junk website is allowed to execute code on your machine without asking or even the user being aware is a fundamental security flaw.

That is a really common idea here and a really arrogant one given how many SASS businesses wouldn't be possible without JS. There were a time when the internet was about reading text, but that has long since passed. Without javascript you can't have a presentation overlayed with video (say of the presenter), you can't have real time anything, you can't comment without having to reload the page, etc. Look at how horri…

You would still be able to enable it if you think it's relevant and trust the website. But when I end up on a news website reading an article, I see no justification for having all these scripts from all these different untrusted sources executing in the background.

If plain HTML isn't good enough, it just means we need a better HTML.

Re: The Slow Death of ‘Do Not Track’

#17

Post by oneeyedpigeon »

tomjen3 wrote: post #12
cm2187 wrote: post #8

Earlier quoted context omitted.

My opinion is that javascript should be opt-in. The idea that any junk website is allowed to execute code on your machine without asking or even the user being aware is a fundamental security flaw.

That is a really common idea here and a really arrogant one given how many SASS businesses wouldn't be possible without JS. There were a time when the internet was about reading text, but that has long since passed. Without javascript you can't have a presentation overlayed with video (say of the presenter), you can't have real time anything, you can't comment without having to reload the page, etc. Look at how horri…

I was with you until you said "Look at how horrible the UX of HN is compared to reddit." Admittedly, I rarely use reddit, but ... are you serious?

Re: The Slow Death of ‘Do Not Track’

#18

Post by thomasfoster96 »

tfgg wrote: post #13
thomasfoster96 wrote: post #6

DNT was essentially dead quite a while ago. If we are goign to get something like Do Not Track, then it should have been drafted out of the public eye, had a nice short period for public comment and then recieved some sort of backing in law. Speculative implementations didn't really help. I'm not too familiar with the laws surrounding things like 'do not call' lists and anti-spam measures, but some sort of system fro…

And the EU, rather than doing this, enacted their dumb 'cookie law' which, as far as I can tell, has just meant every UK website now has unnecessary cluttery popups telling you that they're using cookies.

I'm pretty sure a sizeable number of non-EU based sites added cookie popups as well.

Cookie popups were stupid - cookies aren't really an opt-in system. DNT should have been an opt-out system for off-site tracking. If Facebook tracks you through a like button or Google tracks you through an ad/analytics after you sent then a DNT header, they get into trouble.

Maybe the header size effect DNT could have been mitigated by not sending it to sites with the same origin as the current page (or another origin policy that the website specifies).

Re: The Slow Death of ‘Do Not Track’

#20

Post by zobzu »

rgro wrote: post #2

The worst part about the DNT header was the requirement for the tracking companies to regulate themselves. Initially, the header was opt-in, but with the introduction of IE10, Microsoft decided that the option was going to be opt-out. Once the the DNT header was gaining traction and a not-so-small percentage of people began sending the header, the companies had no reason to comply, and the initiative sorta fell out o…

Actually the way DNT works is also its best attribute. I see more as an attempt that almost worked. It did sensibilize people and companies. Theres a want to not be tracked thats greater than it used to be. Its not just a technical issue.
Post reply on HN