Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A web page that shows you everything the browser told it without asking

sinceyouarrived.world

Post reply on HN
Print view View original

261–270 of 309 posts

Re: A web page that shows you everything the browser told it without asking

#261

Post by ryandrake »

reddalo wrote: post #255
ryandrake wrote: post #236

Earlier quoted context omitted.

I guess what I'm advocating for is that it should not be all-or-nothing, and it should not default-on: Most web sites have no business knowing my time zone. Why are browsers offering it up? That should be gated on the user's permission. Most web sites should not be able to determine what my screen resolution is, or what my operating system is. Browsers should also hold that back and only disclose it with the user's p…

> Most web sites have no business knowing my time zone. That would work if websites only displayed dates in UTC. Which is not what most people expect. Browsers need to know your timezone so timestamps can displayed with the right setting for you.

Ideally, the user would decide whether to display UTC or local time, based on their system or browser's preference, the web site would just send UTC or an opaque datetime object, and the browser would render it in the user's preferred date/time format.

Re: A web page that shows you everything the browser told it without asking

#262

Post by cortesoft »

ryandrake wrote: post #236
cortesoft wrote: post #229

Earlier quoted context omitted.

I don’t think it is as simple as saying browsers are working for the web developer and advertisers. All the features that allow web sites and ad companies to track and target ads are features that are primarily there to give functionality that makes the web a better experience for users. JavaScript allows websites that are better experiences than not having it. I know some people disagree, but I think they are either…

I guess what I'm advocating for is that it should not be all-or-nothing, and it should not default-on: Most web sites have no business knowing my time zone. Why are browsers offering it up? That should be gated on the user's permission. Most web sites should not be able to determine what my screen resolution is, or what my operating system is. Browsers should also hold that back and only disclose it with the user's p…

There are browsers that offer that level of control, but most people don't want to use them because they are confusing and don't offer the things most people actually care about.

Re: A web page that shows you everything the browser told it without asking

#263

Post by Unai »

noelsusman wrote: post #134

I am once again asking privacy advocates to try sounding normal for once. Trying to make a browser accessing your timezone sound nefarious isn't going to convince anyone of anything.

> You prefer dark interfaces — your operating system told us.

oOoOohh my settings worked as intended, spooky!

Re: A web page that shows you everything the browser told it without asking

#264

Post by cortesoft »

tardedmeme wrote: post #244
cortesoft wrote: post #231

Earlier quoted context omitted.

“Kill me and steal my shit” is a lot different. This is more like, I am not offended if my neighbor notices that I leave my house around the same time everyday and come home around the same time. I don’t expect my neighbor to look away when I step outside. If I put something in my yard visible from their house, I won’t get offended if they look at it. Killing and stealing are completely different things than “paying…

Are you offended if your neighbor publishes a register of what time everyone around him goes to work, and charges $50 for any burglar to get a copy?

What are the 'burglars' in this metaphor? Are you saying ad companies are burglars? Or hackers? Or who?

Re: A web page that shows you everything the browser told it without asking

#265

Post by cortesoft »

brudgers wrote: post #198
cortesoft wrote: post #149

Maybe it's just because I am old, or have worked on internet software for almost 30 years, but none of this seems surprising or even concerning? Someone sets up a server that accepts connections to it and then someone sends a connection request to it. There has been no agreement on anything, no expectations or rules established. No one forces the server to accept any connection request it gets, and no one forces some…

Someone sets up a server that accepts connections to it and then someone sends a connection request to it. My disappointment is not with websites. It is with browsers. They have continuously prioritized dark pattern support. They have consistently removed user control. I mean it's not the websites that default to recording every keystroke, default to tracker persistence, default to phoning home with daily telemetry,…

Why isn't there choice anymore? Aren't all the major browsers open source?

Re: A web page that shows you everything the browser told it without asking

#266

Post by cortesoft »

gonzalohm wrote: post #232
cortesoft wrote: post #149

Maybe it's just because I am old, or have worked on internet software for almost 30 years, but none of this seems surprising or even concerning? Someone sets up a server that accepts connections to it and then someone sends a connection request to it. There has been no agreement on anything, no expectations or rules established. No one forces the server to accept any connection request it gets, and no one forces some…

One thing is using information about my connection like my IP and a different one is my browser exposing the angle that I'm holding my phone. I should be able to expect some privacy from my device. What if my browser starts sending a picture of my front camera with every request, is that okay?

No, that wouldn't be ok, but if my browser did that, I wouldn't be mad at the website for doing something with the data I sent them. I would be mad at my browser, not the web site.

Re: A web page that shows you everything the browser told it without asking

#268

Post by applfanboysbgon »

cortesoft wrote: post #264
tardedmeme wrote: post #244

Earlier quoted context omitted.

Are you offended if your neighbor publishes a register of what time everyone around him goes to work, and charges $50 for any burglar to get a copy?

What are the 'burglars' in this metaphor? Are you saying ad companies are burglars? Or hackers? Or who?

If we want to make the metaphor a little more faithful: the neighbor tracking what time everyone is home is selling it to door-to-door salesmen who use that information to harass you. Meanwhile, both the guy tracking it and the door-to-door salesmen are leaving copies of the information in the open. They aren't directly selling it to burglars[1], but they are making it extremely accessible to burglars, who then use that information to rob you. There is a data breach every other day, with companies and people routinely getting extorted and in some cases victims have killed themselves. This is a direct result of the unethical behaviour of hoovering up a permanent record of everyone's every last little action, far beyond what is necessary to provide any service.

[1] Although some data brokers do sell it directly to burglars too. All the burglar has to do is say "I'm a door-to-door salesman, will you sell me the information?". Your neighbor can't be bothered to do any kind of real verification of whether they're a salesman or a burglar.

Re: A web page that shows you everything the browser told it without asking

#269

Post by EchoReflection »

card_zero wrote: post #22

* I'm not in that city. * It's running a kind of Chrome on a kind of Linux, at a stretch. * Nobody can infer when I work and when I sleep. That includes me. * The recent, high-end display is the screen of a low-end tablet I bought in a supermarket five years ago. * But yes, browser fingerprinting is annoying. * Since you can detect light mode, would it kill you to honor it?

yeah it told me I'm "in Los Angeles" but that's just the time zone I'm in. It also "thinks" that because I have two different languages as inputs that it has scored some kind of "gotcha", but I just happen to also frequently use a second language .

"English · Chinese Your browser’s primary language is English. It also carries Chinese. This tells us not just what language you speak, but often where you were raised, where you have lived, or who you live with. This is transmitted in the header of every HTTP request. It has been doing this for as long as you have used this browser."

No, the fact that I have English and Chinese as input languages does not tell it "where I was raised, where I have lived, or who I have lived with.". Might as well say "the fact that you're using a phone to look at the Internet tells reveals that you are someone who can access a phone to look at the Internet!". Yes, technologies interact with other technologies. That's how "technologies" work. Is it Orwellian? Yes. But is it more Orwellian than the surveillance states of Russia/China/North Korea. etc? We also can now find our phones/cars/devices that can share location, locate criminals by way of their online activity, record incidents that"need" to be recorded (like when ppl are committing crimes or when police officers need to be held accountable for their behavior). Catastrophizing about the "overreach" of tech is a cognitive choice. That all being said, it is good to be aware of what info our technologies "know" about us.

Re: A web page that shows you everything the browser told it without asking

#270

Post by nozzlegear »

ygjb wrote: post #248
nozzlegear wrote: post #227

Earlier quoted context omitted.

> Nah. The browser has a mechanism to request geolocation. This is the ask that was not performed. The user was not asked, which is the important piece. The geolocation API requires prompting the user for permission before it can be used: https://developer.mozilla.org/en-US/docs/Web/API/Geolocation...

Yes, that would have tripped the prompt asking the user, which would have had explicit user acceptance or refusal. The point is you don't need consent to do a fuzzy match usibg other data in most jurisdictions.

Ah I see what you're saying. I think the website's wording is just confusing, which made me think you, in turn, were saying something you weren't.
Post reply on HN