Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone is watching what you do online. How user tracking with cookies works

blinkingcaret.com

Post reply on HN
Print view View original

61–68 of 68 posts

Re: Everyone is watching what you do online. How user tracking with cookies works

#61

Post by eli »

antsar wrote: post #38
eli wrote: post #33

Earlier quoted context omitted.

Why is this better than a session cookie? Basic auth is a pretty wonky user experience. Hard to customize the prompt and "logout" is awkward.

I didn't say it's better :) Just an alternative. One way to handle logout (without closing the browser) is to have a logout link with a destination of " https://bad_username:bad_password@example.com" . I believe this causes the browser to forget the original (valid) credentials and attempt authentication with the invalid credentials. This will fail, and produce a new login prompt. Then you have to close the prompt, a…

Fair enough. I think modern browsers warn on links with username/password. The UX for basic auth is so bad it is not really a usable feature

Re: Everyone is watching what you do online. How user tracking with cookies works

#62

Post by propogandist »

m52go wrote: post #28
kop316 wrote: post #4

At work I am forced to use Internet Explorer, and by using it I found a surprisingly useful feature: I can not only clock all third party cookies, but it prompts me as to whether I want a first party to store any cookies. The prompt allow allows me to automatically blacklist a site from providing me any cookies. I really enjoy this, as if I know there is a site I will never log into, I can permanently blacklist it wi…

> Reddit will load the site and actually overlay a white screen to make it appear like it never loads if you block its cookies. That's CRAZY. Couldn't reproduce in Edge though.

replicated and confirmed on Chromium

preventing the Reddit script from executing (uMatrix) will prevent the white screen overlay, also.

Re: Everyone is watching what you do online. How user tracking with cookies works

#63

Post by propogandist »

dahart wrote: post #60
plurgid wrote: post #43

Earlier quoted context omitted.

One of the reasons I love HN is that the commenters here usually have a much deeper understanding of this sort of thing than I do. Which is why I'm left wondering why nobody has mentioned Firefox Incognito mode (chrome too I think). At least on firefox, incognito mode does not store cookies on disk. They persist for the duration of the tab/window you logged into. this would circumvent cookie tracking, I think. I mean…

Incognito, aka private browsing, aka guest profile, is a great way to avoid permanent cookies (and local storage too!). This feature exists on all major browsers. This doesn't solve all tracking, but it will stop some cookie abuse. Choosing to use it also comes with the downside that you can't stay logged in to sites, and you may lose context & history you wanted to keep. Incognito is super useful for web development…

private browsing won't stop browser fingerprinting, which is an increasingly common tactic. Your browser fingerprint then is linked to other attributes (including other devices you may own, where say an IP may be shared) allowing firms to build profiles that are not-linked to cookies, which is harder to block.

Blocking the canvas fingerprint also enables easy identification, so you'll need a free add-on that generates noise.

Re: Everyone is watching what you do online. How user tracking with cookies works

#64

Post by dahart »

propogandist wrote: post #63
dahart wrote: post #60

Earlier quoted context omitted.

Incognito, aka private browsing, aka guest profile, is a great way to avoid permanent cookies (and local storage too!). This feature exists on all major browsers. This doesn't solve all tracking, but it will stop some cookie abuse. Choosing to use it also comes with the downside that you can't stay logged in to sites, and you may lose context & history you wanted to keep. Incognito is super useful for web development…

private browsing won't stop browser fingerprinting, which is an increasingly common tactic. Your browser fingerprint then is linked to other attributes (including other devices you may own, where say an IP may be shared) allowing firms to build profiles that are not-linked to cookies, which is harder to block. Blocking the canvas fingerprint also enables easy identification, so you'll need a free add-on that generate…

Yep, all true. Incognito doesn’t protect you from tracking. The sooner cookies become useless to sites & advertisers, the sooner they come up with something else we can’t block. We might be mostly past that point already.

Re: Everyone is watching what you do online. How user tracking with cookies works

#65

Post by lucb1e »

ealhad wrote: post #16
lucb1e wrote: post #15

Earlier quoted context omitted.

Called self-destructing cookies. It broke with web extensions and cannot be replaced (like many other add-ons I use) because the web extension APIs to provide the functionality do not exist. I'm still on Firefox 55 though, so I can still use it (like firegestures, quickjava, no close buttons, vertical tabs, and others that are labeled as legacy). I always find it very creepy when I looked something up on someone else…

> cannot be replaced Or can it? https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Ah, they did finally implement an API for localStorage then. Good to see!

That just leaves hiding the tab bar, gestures that work in all windows (e.g. also in the view-source URL windows) and that work before the target page has loaded, etc.

Re: Everyone is watching what you do online. How user tracking with cookies works

#66

Post by ealhad »

lucb1e wrote: post #65
ealhad wrote: post #16

Earlier quoted context omitted.

> cannot be replaced Or can it? https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Ah, they did finally implement an API for localStorage then. Good to see! That just leaves hiding the tab bar, gestures that work in all windows (e.g. also in the view-source URL windows) and that work before the target page has loaded, etc.

Right. And maybe it should be done before supporting VR.

Re: Everyone is watching what you do online. How user tracking with cookies works

#67

Post by limonkufu »

JackCh wrote: post #46
limonkufu wrote: post #34

I really don't understand why this is a bad practice. I know it is horrifying to give your web history to total stranger for god knows what purposes they will use. But going extra mile to implement privacy so that no site/some sites could talk behind your back (looking at you firefox multi account containers) seems like an equally horrific act that cripples websites not ad providers. When I used these kind of precaut…

> "I do enjoy targeted ads because when I am looking for something those ads could help a lot" You said could instead of do . Have they ever actually? Do you really click on ads? I don't think I've ever encountered somebody who admits to willingly clicking on ads. The only ad clickers I've seen are people who do it by accident or people who don't realize they're clicking on an ad (usually older folk with poor compute…

I occasionally click the ads when I am shopping online, by 'could' I meant just seeing (not clicking) another options/alternatives of the same type of product helps.

Re: Everyone is watching what you do online. How user tracking with cookies works

#68

Post by limonkufu »

throwawayjava wrote: post #40
limonkufu wrote: post #34

I really don't understand why this is a bad practice. I know it is horrifying to give your web history to total stranger for god knows what purposes they will use. But going extra mile to implement privacy so that no site/some sites could talk behind your back (looking at you firefox multi account containers) seems like an equally horrific act that cripples websites not ad providers. When I used these kind of precaut…

> it seems like a lot of work to implement those in-site tracking features yourself Aren't there libraries/frameworks/products for exactly this? E.g., when I google "website tracking framework" amplitude.com is top ad result, and it seems to cover the business uses. And http://google.github.io/tracing-framework/ is the first non-ad result, which seems to cover the legitimate technical uses. > I believe most of the si…

As you've said in today's world it is difficult to operate a 'free' web-service without ads and ad-tracking, and I always thought since I am using their service I could give my data for ads since their business depends on it. But after thorough research about tracking I agree with you that these decisions must be informed and if this is not acceptable, either I should be denied service or the business model should be changed (after enough users like you and now I chose not to be tracked, I believe it will change)
Post reply on HN