Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone is watching what you do online. How user tracking with cookies works

blinkingcaret.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: Everyone is watching what you do online. How user tracking with cookies works

#41

Post by zAy0LfpBZLC8mAC »

limonkufu wrote: post #34

I really don't understand why this is a bad practice. I know it is horrifying to give your web history to total stranger for god knows what purposes they will use. But going extra mile to implement privacy so that no site/some sites could talk behind your back (looking at you firefox multi account containers) seems like an equally horrific act that cripples websites not ad providers. When I used these kind of precaut…

Because there is no consent.

If I were to start following you whenever you are going anywhere, sit next to you whereever I can, and write down as much about your life as I can, without asking you for permission first, would you also agree that that would be acceptable if I claimed that I need that information to operate or develop my business?

Also, obviously, noone "needs" that information, that's just bullshit. It may sometimes be helpful, but that doesn't mean you need it--just as any other business might be able to learn something from surveilling my non-online life, but that doesn't make it a need for them to spy on me, especially without my consent.

Whether you like targeted advertising is completely irrelevant, as noone is telling you that you may not agree to being spied on. That's like saying that there is nothing wrong with forcing everyone to walk around naked because some people enjoy appearing in porn.

Re: Everyone is watching what you do online. How user tracking with cookies works

#42

Post by throwawayjava »

bogomipz wrote: post #27
zeta0134 wrote: post #10

Earlier quoted context omitted.

The information is stored within your web browser, so the instructions to view it will depend on what OS and browser combination you use. In Google Chrome for example, you can view cookies in the Developer Tools (F12, or Menu -> More Tools -> Developer Tools), under the Applications tab. This will show you the cookies visible to the website in your current browser tab. Firefox's developer tools have similar capabilit…

>"Not all cookies are bad, mind. They're one of the earliest widely adopted implementations of "local storage" for websites, and for a time they were the only reliable way a site could remember a visitor between requests." Could you elaborate on what you mean by "for a time they were the only reliable way a site could remember a visitor between requests"? Isn't this still the dominant/primary way websites add state t…

> What other way is there for managing se?

In the 90's and early 00's I used to see the session token in the URL of every request.

For example, instead of:

        Comments
you write:

        /threads?id=throwawayjava">Comments
or more commonly:

        ">Comments
And when making a JSON request, instead of:

        post_with_session_cookie("/auth/api/", ...)
you write:

        $.post("/auth//api/", ...)
This has other major problems; the most obvious is that it's extremely easy to accidentally session hijack ("oh here's the link to the completed order form: www.yoursite.com/orderForm?token="). Also, the attack surface for session-hijacking XSS is a lot larger. There are other security problems.

You can mitigate some of these problems by changing the token on every request, but now your security problem is only a (massive) usability problem.

None of this is the default for any major web framework, which is probably why this style of authentication completely disappeared in the mid 2000's when people stopped rolling their own backends from stratch.

Re: Everyone is watching what you do online. How user tracking with cookies works

#43

Post by plurgid »

aerotwelve wrote: post #7

What's the best way to circumvent this? Is it even possible? I'm no expert (which is why I ask), but I assume that blocking third-party cookies in your browser won't prevent situations like the tracker example the author provides. That is, since you visited tracker at least once, their cookie would have been set during that visit as a first-party cookie, and therefore the http requests to retrieve the 1x1 transparent…

One of the reasons I love HN is that the commenters here usually have a much deeper understanding of this sort of thing than I do.

Which is why I'm left wondering why nobody has mentioned Firefox Incognito mode (chrome too I think).

At least on firefox, incognito mode does not store cookies on disk. They persist for the duration of the tab/window you logged into.

this would circumvent cookie tracking, I think. I mean I guess not if you opened one icognito window and did all of your browsing inside of it, and never closed it?

am I missing something?

Re: Everyone is watching what you do online. How user tracking with cookies works

#44

Post by JackCh »

daphneokeefe wrote: post #29
swebs wrote: post #24

Earlier quoted context omitted.

In Firefox you can just install the uMatrix extension. It not only allows you to block cookies, but also javascript, frames, and images. You can choose to block only third party elements, third party elements from known tracking/ad agencies, or even first party elements.

In Chrome, you can also use uBlock Origin, which is potentially a little easier to use if you're not an advanced user. https://chrome.google.com/webstore/detail/ublock-origin/cjpa...

For what it's worth I found uMatrix easier to use than uBlock Origin's "Advanced user" mode. Both took a few minutes to get a hang of since neither have particularly discoverable interfaces, but I find the uMatrix interface just a lot faster to use once I knew both.

Re: Everyone is watching what you do online. How user tracking with cookies works

#45

Post by derf_ »

kop316 wrote: post #4

At work I am forced to use Internet Explorer, and by using it I found a surprisingly useful feature: I can not only clock all third party cookies, but it prompts me as to whether I want a first party to store any cookies. The prompt allow allows me to automatically blacklist a site from providing me any cookies. I really enjoy this, as if I know there is a site I will never log into, I can permanently blacklist it wi…

There used to be an option in Firefox: network.cookie.lifetimePolicy=1

It has been broken for a long time and was eventually removed: https://bugzilla.mozilla.org/show_bug.cgi?id=606655

Re: Everyone is watching what you do online. How user tracking with cookies works

#46

Post by JackCh »

limonkufu wrote: post #34

I really don't understand why this is a bad practice. I know it is horrifying to give your web history to total stranger for god knows what purposes they will use. But going extra mile to implement privacy so that no site/some sites could talk behind your back (looking at you firefox multi account containers) seems like an equally horrific act that cripples websites not ad providers. When I used these kind of precaut…

> "I do enjoy targeted ads because when I am looking for something those ads could help a lot"

You said could instead of do. Have they ever actually? Do you really click on ads? I don't think I've ever encountered somebody who admits to willingly clicking on ads. The only ad clickers I've seen are people who do it by accident or people who don't realize they're clicking on an ad (usually older folk with poor computer skills.)

Re: Everyone is watching what you do online. How user tracking with cookies works

#47

Post by severine »

ealhad wrote: post #16
lucb1e wrote: post #15

Earlier quoted context omitted.

Called self-destructing cookies. It broke with web extensions and cannot be replaced (like many other add-ons I use) because the web extension APIs to provide the functionality do not exist. I'm still on Firefox 55 though, so I can still use it (like firegestures, quickjava, no close buttons, vertical tabs, and others that are labeled as legacy). I always find it very creepy when I looked something up on someone else…

> cannot be replaced Or can it? https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Happy user of Cookie Autodelete here, I agree it is a good replacement.

Re: Everyone is watching what you do online. How user tracking with cookies works

#48

Post by blacksmith_tb »

m52go wrote: post #28
kop316 wrote: post #4

At work I am forced to use Internet Explorer, and by using it I found a surprisingly useful feature: I can not only clock all third party cookies, but it prompts me as to whether I want a first party to store any cookies. The prompt allow allows me to automatically blacklist a site from providing me any cookies. I really enjoy this, as if I know there is a site I will never log into, I can permanently blacklist it wi…

> Reddit will load the site and actually overlay a white screen to make it appear like it never loads if you block its cookies. That's CRAZY. Couldn't reproduce in Edge though.

This isn't uncommon for sites that sniff adblockers too, though it varies how much of an obstacle it is. Often you can Inspect the div they are covering things up with and just delete it (or block it for good with uBlock etc.) - clever implementations won't fetch the actual content you wanted to read, so you'll only uncover an empty page, though.

Re: Everyone is watching what you do online. How user tracking with cookies works

#49

Post by gaius »

koolba wrote: post #9
aerotwelve wrote: post #7

What's the best way to circumvent this? Is it even possible? I'm no expert (which is why I ask), but I assume that blocking third-party cookies in your browser won't prevent situations like the tracker example the author provides. That is, since you visited tracker at least once, their cookie would have been set during that visit as a first-party cookie, and therefore the http requests to retrieve the 1x1 transparent…

> What's the best way to circumvent this? Is it even possible? Set you browser to clear all cookies on close, use a separate browser for anything that requires authentication (ex: gmail), and never mix the two types of browsing. If they create a profile on you the cookies it's tied to disappear when you close your browser. It's feels like a minor pain when you first start out but you used to it quick. Plus since you'…

If they create a profile on you the cookies it's tied to disappear when you close your browser.

If they see you with an IP address and a cookie and a moment later see that same IP with the same browser etc does something else they will correlate them. There is a whole industry around tracking people who explicitly do not consent or have withdrawn their consent to be tracked. That’s why we need GDPR.

Re: Everyone is watching what you do online. How user tracking with cookies works

#50

Post by gaius »

bcoates wrote: post #17
sandworm101 wrote: post #8

This revelation should be front page on every newspaper. That IT companies have been hiding these things inside our computers is a violation of our privacy, even our property rights. How muck electricity has been used by these things, electricity I pay for. Either Google needs to reimburse me for hosting their "cookies" or we need to ban cookies altogether. https://torproject.org/

How do you think HN logins work? Cookies are the basis of session management. If you don't want to store cookies for Google, don't. It's a feature right there in your browser. There are lots of shady tracking systems in the world and cookies aren't one of them: they are clear, user-visible, and in the user's direct control both in theory and in practice. Tor isn't relevant to this. If you're using Tor to block cookie…

Cookies are the basis of session management.

They are one technique. In, oh, 1996, we did this by simply generating a unique URL for each user. If you wanted to stay logged in you bookmarked it, and if you didn’t you... didn’t. It was right there to see in the address bar as well, no sly hiding it in HTTP headers.

Post reply on HN