Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

201–210 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#201

Post by chatmasta »

crispyambulance wrote: post #156
Brakenshire wrote: post #120

Earlier quoted context omitted.

It seems strange that access to the audio stack isn't also behind the permission.

It does, and also as someone who has never heard of AudioContext before, I can't fathom why it would be necessary for a web application to generate an audio data stream that isn't output to speakers _AND_ _THEN_ analyze the result. What is the typical use case for AudioContext? The capabilities of AudioContext used in audio fingerprinting seem like they're beyond what is really necessary?

AudioContext is actually pretty cool. As far as I know, only Firefox supports it at the moment. But it allows you to work with audio streams in raw byteform, which means you can do advanced audio processing in client side javascript.

Re: Online tracking: A 1-million-site measurement and analysis

#202

Post by rdancer »

lucb1e wrote: post #193
rdancer wrote: post #136

Earlier quoted context omitted.

If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. This is the official stance of the ICO[1], the UK national authority: there was a need to educate users what cookies were when the directive was passed. No such need exists now. ICO…

> If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. Wrong. If I disable cookies in my browser, I can't log in to websites anymore, so they need to be allowed. A whitelist would be very inconvenient. On top of that, it's not explicit…

You can enable session cookies only, even in the current UIs. Ditto for third-party cookies. Duplicating UI in a website is a solution looking for a problem. The web devs can nag the 0.01% who don't have cookies enabled, and leave the 99.99% who have them enabled alone.

It has never been enforced that way to my knowledge, anywhere in the EU. Which law or court decision says that it is actually illegal?

Re: Online tracking: A 1-million-site measurement and analysis

#203

Post by rdancer »

carlesfe wrote: post #164
rdancer wrote: post #143

Earlier quoted context omitted.

The EU Commission and the regulatory agencies actually agree with you. The stupidity is 100% with the web devs and customers.

What do you mean with "The stupidity is 100% with the web devs and customers"? The law requires user consent, in form of a click on a banner or scrolling the page, before setting any cookie.

Which law? The 2002/58/EC doesn't.

Re: Online tracking: A 1-million-site measurement and analysis

#204

Post by rdancer »

shawnz wrote: post #180
rdancer wrote: post #136

Earlier quoted context omitted.

If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. This is the official stance of the ICO[1], the UK national authority: there was a need to educate users what cookies were when the directive was passed. No such need exists now. ICO…

I see a consent overlay on that very page.

Thank you for pointing that out. I'll try to find the policy release where they say this is not necessary.

Re: Online tracking: A 1-million-site measurement and analysis

#206

Post by andybak »

ysleepy wrote: post #175
oblio wrote: post #15

Earlier quoted context omitted.

And how would Silverlight or Java applets or Flash or any other client side technology be better in this regard? You have to expose capabilities and those capabilities can be used to create an unique fingerprint based on your device. How would you design the stack so that this kind of thing is impossible? Feel free to use your favorite tech stack as a base.

How about not developing applications in the browser? Its about linked documents. Not angular-17 MVVM async session persistence in indexdb with websql and asm.js rendering webgl for a spinning teapot.

OK. So you get your 'document only' internet. Where do we put all the other stuff? I have a bunch of 'non-document' websites that are essential to me now.

What happens under your new regime? Someone reimplements them all as native apps?

The point I'm making is just because your internet is document-only please don't assume mine or other people's are.

Re: Online tracking: A 1-million-site measurement and analysis

#207

Post by tomkin »

CyberDildonics wrote: post #163
tomkin wrote: post #84

Ahhh. Remember when this was just a Flash problem, and getting rid of Flash was going to rid the world of evil? Spoiler: that didn't happen.

Things like this happened with flash but you had no control over them since flash was all or nothing and closed source.

I agree with that (technical person's) perspective, but that was not the mainline argument. Steve Jobs got on stage and said it was a hunk of battery wasting crap that invaded your privacy. I'm saying you can make that case regardless of your platform de jour.

Re: Online tracking: A 1-million-site measurement and analysis

#208

Post by imtringued »

dceddia wrote: post #70
metasean wrote: post #30

Earlier quoted context omitted.

> Web apps are definitely getting better, ... but they have a long way to go before they can replace dedicated clients entirely. And yet, just yesterday there was a great discussion on Virtual Desktop Infrastructures, where entire operating systems are accessed and operated virtually through just the browser [0]. The current top comment indicates that while there are some setup hoops to jump through to use a specific…

That doesn't sound too far from Desktop Computing as a Service. It will be a sad day when I have to pay $9/month to be able to log into my desktop.

It will probably have usage based pricing.

Re: Online tracking: A 1-million-site measurement and analysis

#209

Post by cpeterso »

raarts wrote: post #107
erlichmen wrote: post #24

Earlier quoted context omitted.

Some application want access to the battery info as they might want to disable some functionality in case your battery runs low. It would be smarter if instead of giving exact battery level it will get a callback once the battery runs low.

The Great Suspender is an example of this. Auto-sleeps browser tabs when on battery. https://chrome.google.com/webstore/detail/the-great-suspende...

Sharing the battery information with a browser extension seems reasonable, but are there any websites that actually use the battery information for legitimate user benefit?
Post reply on HN