Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone is watching what you do online. How user tracking with cookies works

blinkingcaret.com

Post reply on HN
Print view View original

21–30 of 68 posts

Re: Everyone is watching what you do online. How user tracking with cookies works

#21

Post by jedimastert »

koolba wrote: post #9
aerotwelve wrote: post #7

What's the best way to circumvent this? Is it even possible? I'm no expert (which is why I ask), but I assume that blocking third-party cookies in your browser won't prevent situations like the tracker example the author provides. That is, since you visited tracker at least once, their cookie would have been set during that visit as a first-party cookie, and therefore the http requests to retrieve the 1x1 transparent…

> What's the best way to circumvent this? Is it even possible? Set you browser to clear all cookies on close, use a separate browser for anything that requires authentication (ex: gmail), and never mix the two types of browsing. If they create a profile on you the cookies it's tied to disappear when you close your browser. It's feels like a minor pain when you first start out but you used to it quick. Plus since you'…

There's also Facebook Multi-account Containers (https://addons.mozilla.org/en-US/firefox/addon/multi-account...), which might do what you're looking for

Re: Everyone is watching what you do online. How user tracking with cookies works

#23

Post by wierd0 »

mkirklions wrote: post #2

So a cookie only knows the website that referred me? So if I copy paste the website in the address bar, they dont learn anything about my last browsing habit?

> So a cookie only knows the website that referred me?

Not really. Instead, each time you return to a site that has set a cookie on your computer, that cookie is included in the request header.

That same site will also know about your last visited page, even if it's outside of their domain, because of the "referer" frpm the request header.

> So if I copy paste the website in the address bar, they dont learn anything about my last browsing habit?

If you do that, then the referer will be empty and whatever site you visit will not know what you did last.

Cookies are just one thing. Web beacons i.e. tracking pixels, and the fact that companies utilizing those to suck up data about web users sell it feely to others for the sake of targeted marketing, is the reason you see peronalized ads all over the internet whenever you've finalized an online purchase.

Re: Everyone is watching what you do online. How user tracking with cookies works

#24

Post by swebs »

kop316 wrote: post #4

At work I am forced to use Internet Explorer, and by using it I found a surprisingly useful feature: I can not only clock all third party cookies, but it prompts me as to whether I want a first party to store any cookies. The prompt allow allows me to automatically blacklist a site from providing me any cookies. I really enjoy this, as if I know there is a site I will never log into, I can permanently blacklist it wi…

In Firefox you can just install the uMatrix extension. It not only allows you to block cookies, but also javascript, frames, and images. You can choose to block only third party elements, third party elements from known tracking/ad agencies, or even first party elements.

Re: Everyone is watching what you do online. How user tracking with cookies works

#25

Post by pdkl95 »

aerotwelve wrote: post #7

What's the best way to circumvent this? Is it even possible? I'm no expert (which is why I ask), but I assume that blocking third-party cookies in your browser won't prevent situations like the tracker example the author provides. That is, since you visited tracker at least once, their cookie would have been set during that visit as a first-party cookie, and therefore the http requests to retrieve the 1x1 transparent…

> What's the best way to circumvent this? Is it even possible?

1) Get rid of the misfeatures that allow the problem to exist. Change the browser to never send headers that leak information by design (Referer, Cookie, Etag, User-Agent, etc).

1.1) (Optional) Fix stateful sessions that previously depended on cookies with a new HTTP session+authentication feature (that doesn't have the problems that made the Authorization header mostly useless).

2) Strip most of the other HTTP headers that leak bits of entropy so the browser fingerprint is too small (~16 bits max?) to be a unique id.

2.1) (Optional) Add some of the removed functionality back as a single header that reports a single "browser class" out of a handful (=2 channel audio output. Supported codecs: audio=[MP3, AAC], video codec [...]", "mobile with multitouch screen with size ...etc...").

3) Disable Javascript. Running Turing complete code from potentially malicious remote hosts will always be dangerous, because it isn't possible to answer any question about the behavior of a program without running it (halting problem in general; Turing machines with >=7918 states cannot[1] be proven with ZF set theory). A safe web of documents is possible. Software needs to be handled separately.

Of course, none of this will happen because the people with the power to make most of these changes derive a lot of their income from surveillance.

[1] https://www.scottaaronson.com/blog/?p=2725

Re: Everyone is watching what you do online. How user tracking with cookies works

#27

Post by bogomipz »

zeta0134 wrote: post #10
die_fault_user wrote: post #5

Where is this information stored on my computer? Is there a central location for the information that I can look at or software to read the cookies?

The information is stored within your web browser, so the instructions to view it will depend on what OS and browser combination you use. In Google Chrome for example, you can view cookies in the Developer Tools (F12, or Menu -> More Tools -> Developer Tools), under the Applications tab. This will show you the cookies visible to the website in your current browser tab. Firefox's developer tools have similar capabilit…

>"Not all cookies are bad, mind. They're one of the earliest widely adopted implementations of "local storage" for websites, and for a time they were the only reliable way a site could remember a visitor between requests."

Could you elaborate on what you mean by "for a time they were the only reliable way a site could remember a visitor between requests"?

Isn't this still the dominant/primary way websites add state to a stateless protocol? What other way is there for managing se? Is there something that has supplanted cookies for "remembering" or managing sessions?

Re: Everyone is watching what you do online. How user tracking with cookies works

#28

Post by m52go »

kop316 wrote: post #4

At work I am forced to use Internet Explorer, and by using it I found a surprisingly useful feature: I can not only clock all third party cookies, but it prompts me as to whether I want a first party to store any cookies. The prompt allow allows me to automatically blacklist a site from providing me any cookies. I really enjoy this, as if I know there is a site I will never log into, I can permanently blacklist it wi…

> Reddit will load the site and actually overlay a white screen to make it appear like it never loads if you block its cookies.

That's CRAZY. Couldn't reproduce in Edge though.

Re: Everyone is watching what you do online. How user tracking with cookies works

#29

Post by daphneokeefe »

swebs wrote: post #24
kop316 wrote: post #4

At work I am forced to use Internet Explorer, and by using it I found a surprisingly useful feature: I can not only clock all third party cookies, but it prompts me as to whether I want a first party to store any cookies. The prompt allow allows me to automatically blacklist a site from providing me any cookies. I really enjoy this, as if I know there is a site I will never log into, I can permanently blacklist it wi…

In Firefox you can just install the uMatrix extension. It not only allows you to block cookies, but also javascript, frames, and images. You can choose to block only third party elements, third party elements from known tracking/ad agencies, or even first party elements.

In Chrome, you can also use uBlock Origin, which is potentially a little easier to use if you're not an advanced user.

https://chrome.google.com/webstore/detail/ublock-origin/cjpa...

Re: Everyone is watching what you do online. How user tracking with cookies works

#30

Post by antsar »

bogomipz wrote: post #27
zeta0134 wrote: post #10

Earlier quoted context omitted.

The information is stored within your web browser, so the instructions to view it will depend on what OS and browser combination you use. In Google Chrome for example, you can view cookies in the Developer Tools (F12, or Menu -> More Tools -> Developer Tools), under the Applications tab. This will show you the cookies visible to the website in your current browser tab. Firefox's developer tools have similar capabilit…

>"Not all cookies are bad, mind. They're one of the earliest widely adopted implementations of "local storage" for websites, and for a time they were the only reliable way a site could remember a visitor between requests." Could you elaborate on what you mean by "for a time they were the only reliable way a site could remember a visitor between requests"? Isn't this still the dominant/primary way websites add state t…

One approach that doesn't rely on cookies is HTTP Basic Authentication.

The first request to a protected page will produce an authentication prompt[0]. Subsequent requests to the same site will automatically send the same set of credentials (in every browser I'm familiar with. This part of the spec seems to be optional [1]).

Using HTTP Basic Authentication, the server can track the user across different pages. All other state can be maintained on the server side, keyed to the user.

[0] https://i.stack.imgur.com/QnUZW.png

[1] https://tools.ietf.org/html/rfc7617#section-2.2

Post reply on HN