Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone is watching what you do online. How user tracking with cookies works

blinkingcaret.com

Post reply on HN
Print view View original

31–40 of 68 posts

Re: Everyone is watching what you do online. How user tracking with cookies works

#31

Post by davidhyde »

aerotwelve wrote: post #7

What's the best way to circumvent this? Is it even possible? I'm no expert (which is why I ask), but I assume that blocking third-party cookies in your browser won't prevent situations like the tracker example the author provides. That is, since you visited tracker at least once, their cookie would have been set during that visit as a first-party cookie, and therefore the http requests to retrieve the 1x1 transparent…

> What's the best way to circumvent this? Is it even possible?

I set my browser (firefox) to clear all cookies on exit but I let my browser save passwords whenever possible. That way you have to log in every time you use a service but at least you don't need to type in the login info every time. It's quick. Of course, this does not work nicely for two factor stuff but you can use another browser for those.

Re: Everyone is watching what you do online. How user tracking with cookies works

#32

Post by eli »

bogomipz wrote: post #27
zeta0134 wrote: post #10

Earlier quoted context omitted.

The information is stored within your web browser, so the instructions to view it will depend on what OS and browser combination you use. In Google Chrome for example, you can view cookies in the Developer Tools (F12, or Menu -> More Tools -> Developer Tools), under the Applications tab. This will show you the cookies visible to the website in your current browser tab. Firefox's developer tools have similar capabilit…

>"Not all cookies are bad, mind. They're one of the earliest widely adopted implementations of "local storage" for websites, and for a time they were the only reliable way a site could remember a visitor between requests." Could you elaborate on what you mean by "for a time they were the only reliable way a site could remember a visitor between requests"? Isn't this still the dominant/primary way websites add state t…

The LocalStorage API is a more efficient way to store data client side with a a cleaner API

Re: Everyone is watching what you do online. How user tracking with cookies works

#33

Post by eli »

antsar wrote: post #30
bogomipz wrote: post #27

Earlier quoted context omitted.

>"Not all cookies are bad, mind. They're one of the earliest widely adopted implementations of "local storage" for websites, and for a time they were the only reliable way a site could remember a visitor between requests." Could you elaborate on what you mean by "for a time they were the only reliable way a site could remember a visitor between requests"? Isn't this still the dominant/primary way websites add state t…

One approach that doesn't rely on cookies is HTTP Basic Authentication. The first request to a protected page will produce an authentication prompt[0]. Subsequent requests to the same site will automatically send the same set of credentials (in every browser I'm familiar with. This part of the spec seems to be optional [1]). Using HTTP Basic Authentication, the server can track the user across different pages. All ot…

Why is this better than a session cookie? Basic auth is a pretty wonky user experience. Hard to customize the prompt and "logout" is awkward.

Re: Everyone is watching what you do online. How user tracking with cookies works

#34

Post by limonkufu »

I really don't understand why this is a bad practice. I know it is horrifying to give your web history to total stranger for god knows what purposes they will use. But going extra mile to implement privacy so that no site/some sites could talk behind your back (looking at you firefox multi account containers) seems like an equally horrific act that cripples websites not ad providers.

When I used these kind of precautions I saw that analytics got no access and I believe most of the site-owners need these information to operate/develop their sites and it seems like a lot of work to implement those in-site tracking features yourself. Or I started to see random ads all over the place like early 2000s, I do enjoy targeted ads because when I am looking for something those ads could help a lot, only if there is a way to stop them after I made a purchase though.

So, if anyone could simply explain why this is SO bad or send me to correct discussion (I do believe these matters discussed previously a lot).

Re: Everyone is watching what you do online. How user tracking with cookies works

#35

Post by edjroot »

bogomipz wrote: post #27
zeta0134 wrote: post #10

Earlier quoted context omitted.

The information is stored within your web browser, so the instructions to view it will depend on what OS and browser combination you use. In Google Chrome for example, you can view cookies in the Developer Tools (F12, or Menu -> More Tools -> Developer Tools), under the Applications tab. This will show you the cookies visible to the website in your current browser tab. Firefox's developer tools have similar capabilit…

>"Not all cookies are bad, mind. They're one of the earliest widely adopted implementations of "local storage" for websites, and for a time they were the only reliable way a site could remember a visitor between requests." Could you elaborate on what you mean by "for a time they were the only reliable way a site could remember a visitor between requests"? Isn't this still the dominant/primary way websites add state t…

Adding to the other replies, there's also IndexedDB, which can store considerably larger amounts of information cross-session.

Re: Everyone is watching what you do online. How user tracking with cookies works

#36

Post by bogomipz »

eli wrote: post #32
bogomipz wrote: post #27

Earlier quoted context omitted.

>"Not all cookies are bad, mind. They're one of the earliest widely adopted implementations of "local storage" for websites, and for a time they were the only reliable way a site could remember a visitor between requests." Could you elaborate on what you mean by "for a time they were the only reliable way a site could remember a visitor between requests"? Isn't this still the dominant/primary way websites add state t…

The LocalStorage API is a more efficient way to store data client side with a a cleaner API

But this is where cookies in modern browsers are stored - in the LocalStorage API no?

Aren't they complimentary instead of mutual exclusive?

Re: Everyone is watching what you do online. How user tracking with cookies works

#37

Post by kop316 »

m52go wrote: post #28
kop316 wrote: post #4

At work I am forced to use Internet Explorer, and by using it I found a surprisingly useful feature: I can not only clock all third party cookies, but it prompts me as to whether I want a first party to store any cookies. The prompt allow allows me to automatically blacklist a site from providing me any cookies. I really enjoy this, as if I know there is a site I will never log into, I can permanently blacklist it wi…

> Reddit will load the site and actually overlay a white screen to make it appear like it never loads if you block its cookies. That's CRAZY. Couldn't reproduce in Edge though.

Did you already have cookies installed? I found that if I let it load a cookie then block it, it would load (but it already had a cookie on there, defeating the point). Try clearing out everything (or try on IE)

Re: Everyone is watching what you do online. How user tracking with cookies works

#38

Post by antsar »

eli wrote: post #33
antsar wrote: post #30

Earlier quoted context omitted.

One approach that doesn't rely on cookies is HTTP Basic Authentication. The first request to a protected page will produce an authentication prompt[0]. Subsequent requests to the same site will automatically send the same set of credentials (in every browser I'm familiar with. This part of the spec seems to be optional [1]). Using HTTP Basic Authentication, the server can track the user across different pages. All ot…

Why is this better than a session cookie? Basic auth is a pretty wonky user experience. Hard to customize the prompt and "logout" is awkward.

I didn't say it's better :) Just an alternative.

One way to handle logout (without closing the browser) is to have a logout link with a destination of "https://bad_username:bad_password@example.com". I believe this causes the browser to forget the original (valid) credentials and attempt authentication with the invalid credentials. This will fail, and produce a new login prompt. Then you have to close the prompt, and close the subsequent "401" page.

So yeah, it is awkward.

Re: Everyone is watching what you do online. How user tracking with cookies works

#39

Post by bogomipz »

antsar wrote: post #30
bogomipz wrote: post #27

Earlier quoted context omitted.

>"Not all cookies are bad, mind. They're one of the earliest widely adopted implementations of "local storage" for websites, and for a time they were the only reliable way a site could remember a visitor between requests." Could you elaborate on what you mean by "for a time they were the only reliable way a site could remember a visitor between requests"? Isn't this still the dominant/primary way websites add state t…

One approach that doesn't rely on cookies is HTTP Basic Authentication. The first request to a protected page will produce an authentication prompt[0]. Subsequent requests to the same site will automatically send the same set of credentials (in every browser I'm familiar with. This part of the spec seems to be optional [1]). Using HTTP Basic Authentication, the server can track the user across different pages. All ot…

Sure the base64 encoded authorization credentials in the header are the unique identifier in this case. I guess I don't view this so much as an alternative to cookies for general internet browsing much as I do adding a thin layer of security for resources on things like corporate LANs.

Re: Everyone is watching what you do online. How user tracking with cookies works

#40

Post by throwawayjava »

limonkufu wrote: post #34

I really don't understand why this is a bad practice. I know it is horrifying to give your web history to total stranger for god knows what purposes they will use. But going extra mile to implement privacy so that no site/some sites could talk behind your back (looking at you firefox multi account containers) seems like an equally horrific act that cripples websites not ad providers. When I used these kind of precaut…

> it seems like a lot of work to implement those in-site tracking features yourself

Aren't there libraries/frameworks/products for exactly this? E.g., when I google "website tracking framework" amplitude.com is top ad result, and it seems to cover the business uses. And http://google.github.io/tracing-framework/ is the first non-ad result, which seems to cover the legitimate technical uses.

> I believe most of the site-owners need these information to operate/develop their sites

Can you give an example of a piece of user-relevant functionality that cannot be implemented without Google Analytics?

IME especially Google Analytics is mostly useful for business reasons, not technical reasons.

It's certainly fair to say that it's difficult to operate a profitable web business without Google Analytics. But that's a very different claim. And the difference is important because...

> So, if anyone could simply explain why this is SO bad or send me to correct discussion

Legitimate customer-business relationships should always involve informed consent. Cookie blockers and Firefox containers provide the technical tools that enable me to make an informed decision about whether to use your site. Without those technical mechanisms, it's very difficult for me to constantly monitor whether you are tracking me.

You/Google are free to deny me access to your products/content if I choose not to be tracked. But I should be allowed to make an informed decision about whether to use your site. The tools you're complaining about enable that informed decision.

Post reply on HN