3 ms·

I don't have a problem with either of your hypothetical users. I simply believe that it's the user's responsibility to ensure that their browser is not disclosi

I don't have a problem with either of your hypothetical users. I simply believe that it's the user's responsibility to ensure that their browser is not disclosing more information than they want. Servers are not committing any ethical violation by attempting to track unique user identities through non-disruptive utilization of normal browser features like cookies, plugins, and ETags. The unifying thing is that companies want to display ads, but users don't respect that want and employ technological solutions to block ads. That's all well and good. But by the same token, when a user wants to browse anonymously, there is no reason that servers shouldn't utilize the resources that are regularly available in a typical client-server exchange to attempt to identify the user. The only contrary argument is that companies should be forced to respect the user's wishes, just because the user wishes for it. That's not how the world works. If the user is concerned that their browser may be leaking information, they should take responsibility and ensure it isn't. It's not on the company's head to ensure that the user's wish for privacy is respected any more than it's on the user's head to ensure that the company's wish to display ads is respected.

hueving 10y ago
This logic is all based on not having any ethical concerns about doing something the user didn't intend to participate in. If you don't care about ethics, then you could just extend your argument to say that exploiting vulnerabilities in the user's browser to install tracking code directly into the binary is acceptable as well. Are you okay with that logical conclusion? >The only contrary argument is that companies should be forced to respect the user's wishes, just because the user wishes for it. That's not how the world works. It actually is how much of the world works. What ends up happening is people with no regard for ethics keep abusing this until regulations get passed to force people to stop doing things they know people don't want.
- cookiecaper 10y ago
  >you could just extend your argument to say that exploiting vulnerabilities in the user's browser to install tracking code directly into the binary is acceptable as well. Are you okay with that logical conclusion? No. That's not the logical conclusion; it's the extremist conclusion. The difference is that with things like cookies and ETags, the browser is designed to return that information back to the server. The server is not engaging in any malicious injection of foreign binaries or hijacking of program behavior. It's not doing anything to break outside of its allowed permission sandbox. It's using intentional, supported functionality in a non-disruptive manner. The only thing is that some people don't like that some of that functionality allows them to ascertain a user's identity after the user has cleared his/her cookies (ignoring here that the much larger privacy concern is the nearly-constant IP address of the user's home internet connection). If that's the complaint, and in this case, it is, then there is no fault from the server. The user should ensure that his/her browser is making those privacy controls available. Ignoring the problem and shaming companies for making the connection misplaces blame and allows the problem to remain, exploited only by those whose intent may actually be malicious. Obviously, there are many malware vendors who use their software to track users. I'm not defending them, nor am I defending those who exploit security bugs to get at data that they're not supposed to be able to access. That's not the case now; all of the fingerprinting methods discussed up to this point are fairly simple and do not involve coaxing software into any bad or illegal behavior, nor do they involve executing any spyware on the client machine. >It actually is how much of the world works. What ends up happening is people with no regard for ethics keep abusing this until regulations get passed to force people to stop doing things they know people don't want. No, it's not as simple as something "people don't want". Ethics are not about wants and conveniences, they're about behaving in a fair and honorable way. That's not the same as, and in fact it's sometimes the opposite of, what a customer may demand. Companies have obligations to non-customers as well. Today, customers are demanding that web publishers make all of their content available at no cost and with no ads. If we take the attitude that "if you don't want users to strip out your ads with client-side software, don't publish it online", it's just as fair to say "if you don't want companies to correlate your visits with server-side software, don't leak information that allows them to do so". If there's beef to be had with anyone here, it's the browser manufacturers who can't seem to figure out a way to engage in a normal conversation with a peer without leaking data that can be used to uniquely identify the user on the server-side.
  - hueving 10y ago
    >Ethics are not about wants and conveniences, they're about behaving in a fair and honorable way. It's not ethical to correlate a user's sessions using etags when they have cleared cookies and caches (or set DNT header). You are expressly behaving against the user's wishes, and there really is no difference in exploiting the browser in other ways to reveal other personal information. >Today, customers are demanding that web publishers make all of their content available at no cost and with no ads. Did you even read my original comment? Privacy sensitive people and people that don't like ads are not the same set of people. Stop using ad blockers as a justification for unethical privacy violations.
    - cookiecaper 10y ago
      >It's not ethical to correlate a user's sessions using etags when they have cleared cookies and caches (or set DNT header). You are expressly behaving against the user's wishes, and there really is no difference in exploiting the browser in other ways to reveal other personal information. You don't see a difference between analyzing the data a browser gives back during normal operation and exploiting security bugs to force browsers to give up information that is supposed to be private? They're tracking your session based on the data that your browser normally sends. They're not crossing any boundaries or stealing any secrets. The difference between using ETags and exploiting a bug to get secret information is that ETags were never meant to be secret or private. No one thinks they're "personal information". They're normal information that happens to be useful for uniquely identifying a user, as are Flash cookies. The customer can ask politely not to be identified, but there is no reason that companies have to automatically consider that an ethical obligation just because customers wish it was that way. Customers also wish everything was free. If you feel browsers should support completely untraceable sessions, that's a feature request. It's not an ethical violation on the part of others that they're not imagining this feature already exists. >Did you even read my original comment? Privacy sensitive people and people that don't like ads are not the same set of people. Stop using ad blockers as a justification for unethical privacy violations. We're not talking about specific people, we're talking about general principles. If ad blockers are not unethical in principle, then neither is server-side session tracking, because both stay 100% within the technical bounds without coercing any information from or disrupting the ordinary operation of the other party. It seems that your conception of ethics really does boil down to "the customer wants it", so it's going to be hard to continue this conversation.

hueving 10y ago

This logic is all based on not having any ethical concerns about doing something the user didn't intend to participate in. If you don't care about ethics, then you could just extend your argument to say that exploiting vulnerabilities in the user's browser to install tracking code directly into the binary is acceptable as well. Are you okay with that logical conclusion? >The only contrary argument is that companies should be forced to respect the user's wishes, just because the user wishes for it. That's not how the world works. It actually is how much of the world works. What ends up happening is people with no regard for ethics keep abusing this until regulations get passed to force people to stop doing things they know people don't want.

cookiecaper 10y ago
>you could just extend your argument to say that exploiting vulnerabilities in the user's browser to install tracking code directly into the binary is acceptable as well. Are you okay with that logical conclusion? No. That's not the logical conclusion; it's the extremist conclusion. The difference is that with things like cookies and ETags, the browser is designed to return that information back to the server. The server is not engaging in any malicious injection of foreign binaries or hijacking of program behavior. It's not doing anything to break outside of its allowed permission sandbox. It's using intentional, supported functionality in a non-disruptive manner. The only thing is that some people don't like that some of that functionality allows them to ascertain a user's identity after the user has cleared his/her cookies (ignoring here that the much larger privacy concern is the nearly-constant IP address of the user's home internet connection). If that's the complaint, and in this case, it is, then there is no fault from the server. The user should ensure that his/her browser is making those privacy controls available. Ignoring the problem and shaming companies for making the connection misplaces blame and allows the problem to remain, exploited only by those whose intent may actually be malicious. Obviously, there are many malware vendors who use their software to track users. I'm not defending them, nor am I defending those who exploit security bugs to get at data that they're not supposed to be able to access. That's not the case now; all of the fingerprinting methods discussed up to this point are fairly simple and do not involve coaxing software into any bad or illegal behavior, nor do they involve executing any spyware on the client machine. >It actually is how much of the world works. What ends up happening is people with no regard for ethics keep abusing this until regulations get passed to force people to stop doing things they know people don't want. No, it's not as simple as something "people don't want". Ethics are not about wants and conveniences, they're about behaving in a fair and honorable way. That's not the same as, and in fact it's sometimes the opposite of, what a customer may demand. Companies have obligations to non-customers as well. Today, customers are demanding that web publishers make all of their content available at no cost and with no ads. If we take the attitude that "if you don't want users to strip out your ads with client-side software, don't publish it online", it's just as fair to say "if you don't want companies to correlate your visits with server-side software, don't leak information that allows them to do so". If there's beef to be had with anyone here, it's the browser manufacturers who can't seem to figure out a way to engage in a normal conversation with a peer without leaking data that can be used to uniquely identify the user on the server-side.
- hueving 10y ago
  >Ethics are not about wants and conveniences, they're about behaving in a fair and honorable way. It's not ethical to correlate a user's sessions using etags when they have cleared cookies and caches (or set DNT header). You are expressly behaving against the user's wishes, and there really is no difference in exploiting the browser in other ways to reveal other personal information. >Today, customers are demanding that web publishers make all of their content available at no cost and with no ads. Did you even read my original comment? Privacy sensitive people and people that don't like ads are not the same set of people. Stop using ad blockers as a justification for unethical privacy violations.
  - cookiecaper 10y ago
    >It's not ethical to correlate a user's sessions using etags when they have cleared cookies and caches (or set DNT header). You are expressly behaving against the user's wishes, and there really is no difference in exploiting the browser in other ways to reveal other personal information. You don't see a difference between analyzing the data a browser gives back during normal operation and exploiting security bugs to force browsers to give up information that is supposed to be private? They're tracking your session based on the data that your browser normally sends. They're not crossing any boundaries or stealing any secrets. The difference between using ETags and exploiting a bug to get secret information is that ETags were never meant to be secret or private. No one thinks they're "personal information". They're normal information that happens to be useful for uniquely identifying a user, as are Flash cookies. The customer can ask politely not to be identified, but there is no reason that companies have to automatically consider that an ethical obligation just because customers wish it was that way. Customers also wish everything was free. If you feel browsers should support completely untraceable sessions, that's a feature request. It's not an ethical violation on the part of others that they're not imagining this feature already exists. >Did you even read my original comment? Privacy sensitive people and people that don't like ads are not the same set of people. Stop using ad blockers as a justification for unethical privacy violations. We're not talking about specific people, we're talking about general principles. If ad blockers are not unethical in principle, then neither is server-side session tracking, because both stay 100% within the technical bounds without coercing any information from or disrupting the ordinary operation of the other party. It seems that your conception of ethics really does boil down to "the customer wants it", so it's going to be hard to continue this conversation.