Live data from Hacker News

Unsanctioned Web Tracking

w3.org

41–42 of 42 posts

Re: Unsanctioned Web Tracking

#41
post #38
post #36

Tracking started with single site tracking and worked well with a simple cookie. There was no overhead and no bloat like heatmaps and 5-level nested scripts that display an invisible pixel. It was not evil except that users did not know that they were tracked. Then the evil started with multi-site tracking. Trickery was required to implement cross-site tracking and the advertisers became too obsessed with 'knowing th…

What features would this light version of Javascript support and what features would it not support. Obviously `new Image()` is out, as is any kind of cookie support right? So that means no ability to log in? I don't think any browser vendors would bother spending developer time on a project that would severely break pretty much every site out there. Not to mention, you must realize that any and all methods that were…

I am not against legislation but also not optimistic about politicians being able to make a proper law.

You are correct, 'new Image' in javascript would be out. And the question is, if that really hurts. Do you want to dynamically create an image in javascript and let the decision-making happen inside the browser of an end user? Or can the 'new Image' functionality of javascript be considered bloat because the decision to put an image somewhere on the page can be made perfectly well on the web server?

And we can go on, should it be possible to do a POST from javascript code, or should a browser only allow/do a POST when a user presses a button?

Re: Unsanctioned Web Tracking

#42

Earlier quoted context omitted.

Do you have an example of this working? I thought that browser venders we're having the :visited selector lie to you when you call getComputedStyle on them? Also, how would you workaround the need for JS? I understand that you can do something similiar with tracking pixels, but I'm under the impression that Ghostery blocks them.

>I thought that browser venders we're having the :visited selector lie to you when you call getComputedStyle on them? It's possible to probe the users history even though getComputedStyle doesn't give it away anymore. See page 6 of this article: http://www.contextis.com/documents/2/Browser_Timing_Attacks.... Obviously turning off Javascript prevents these types of things to some extent, but even then there are ways:…

Interesting papers, thanks for calling my attention to them. They made me paranoid enough to disable the styling of visited links in Firefox to prevent the large amount of timing attacks that are possible.
Post reply on HN