7 ms·

>they link my identity to my browser They link your phone number to a session/user along with ad networks who have stored cookies on your machine and use predi

>they link my identity to my browser They link your phone number to a session/user along with ad networks who have stored cookies on your machine and use predictive modeling to guess at who you are/what you do. It doesn't work on 90% of the HN crowd, people who block ads/disable javascript, or just don't do a lot of traditional "browsing", but yeah.

da_chicken 8y ago
You know, I'm quickly reaching a point where I want the default browser to work in Incognito mode, and the browser should only switch to regular mode when I explicitly whitelist the domain.
- hetspookjee 8y ago
  On Android I browse by default with Firefox Focus and only to use sessions like posting this response I copy the URL to chrome and make the post. Than I'll go back to Focus. It's crude but Firefox Focus beats all browsers privacy and responsiveness on Android imo.
  - cpeterso 8y ago
    Once I started using Firefox Focus, I was surprised at just how much of my browsing didn't need to be logged in. I don't need to keep session state when I'm just reading Wikipedia, news sites, or blogs.
  - amorroxic 8y ago
    Same, Focus is great. Also a very warm mention for what I think became one of my favourite features while browsing - one single tab.
  - chrsstrm 8y ago
    Same. My one wish for Focus is that I could open another tab. Even just one more tab during an active session would make life easier.
    - nitemice 8y ago
      You can open more than one tab with Focus. I did it accedentally a few times. The bin action button changes to a number if you have more than one tab open. https://support.mozilla.org/en-US/kb/open-new-tab-firefox-focus-android https://support.mozilla.org/en-US/kb/open-new-tab-firefox-fo...
    - dddw 8y ago
      you can, hold the link and click open in a new tab
      - chrsstrm 8y ago
        TIL that yes, that's true, but only on Android. iOS only lets you Open, which uses the same window.
  - excalibur 8y ago
    +1 for Focus, but I don't generally interact with HN through a browser on mobile. There's an app for that.
    - ttty 8y ago
      I think apps can track your hardware I'd. I'm not saying hn does that, but other apps might track you even better with an app.
- forapurpose 8y ago
  Does Incognito mode solve this problem? I thought it mostly prevented data from being stored on your local computer; I did not think it was effective against tracking.
  - Swizec 8y ago
    It improves tracking by fisabling your ad blocker.
    - icebraining 8y ago
      Maybe in Chrom*, but not in Firefox.
    - mindslight 8y ago
      As someone who has used chromium incognito as a crutch, 100% this. Browsers need to be seriously redesigned with privacy (aka security) in mind. The javascript execution environment needs to be gutted to remove security leaks like screen/window size. And incompetently (/maliciously) designed APIs like websockets need to be thrown right out.
      - pbhjpbhj 8y ago
        The main browser makers get huge incomes from advertising. That's not going to make them want to spend a lot on protecting users from advertising.
  - nil_pointer 8y ago
    You can still track someone in incognito. Things like your system installed fonts, installed plugins, and canvas fingerprint give you away.
- this_user 8y ago
  There are extensions like "Cookie AutoDelete" where you can explicitly whitelist what coookies are not supposed to be delete. I think it does not automatically clear localstorage, though. But if you combine this with a blocker extension to remove the usual suspects when it comes to tracking, you are mostly there already.
  - maxerickson 8y ago
    Firefox supports the whitelisting natively. The only thing it doesn't have is a way to auto delete cookies without restarting (which expires session cookies, which is a native option). That's how I use it, cookies default to session only and a few sites get saved across sessions.
- koolba 8y ago
  I’ve been running my browsers like this for years. Not being logged in to Amazon et al also prevents buying cheap crap by adding one layer of friction. Another easy tip is to separate out anything that requires persistent login (ex: gmail) to a separate dedicated browser.
  - Arbalest 8y ago
    Chrome/Chromium's --user-data-dir is great for this
    - eppsilon 8y ago
      Or Firefox's containers
- myrandomcomment 8y ago
  My IOS devices are set to Incognito mode by default and I use a Fire Focus as an add on for blocking with Safari. Been that way for ever. On my laptop Safari is in Incognito mode for all but a few sites. I clear the browsing history on the one that is not after the browsing session.
- TheAdamist 8y ago
  It's getting to the point where porn goes on the regular browser, legit stuff needs incognito.
- ankit219 8y ago
  Disable cookies by default. If a website can't function without enabling cookies open it in incognito
BLP4YC 8y ago
Care to ELI5?
- jklinger410 8y ago
  Analytics javascript can assign you an Unique Identifier string that can be passed along in a form where you fill out your phone number. They then tie your "session" or "user" (depending on how they have it set up) to a cookie they have placed on your machine. They then leverage a partnership with a large ad network, to see where they found that cookie, as well as other cookies, from other sites in their network. They then correlate where they have seen essentially your user footprint (collection of cookies and other identifiers from your machine) stored throughout their network, to put you in some kind of demographic or intent-based bucket. When you include data from mobile apps that are tracking your location, this can get very scary. There is a small leap required in tying a mobile ID (your phone's unique identifier) to web traffic, but it happens. Obviously all depending on the level of data you "share." They then run every user in these buckets through a machine learning algo, that tries to predict things. Income, gender, spending habits, life events, etc. They can determine where you live easily, zip codes, compare that to census data, etc. It's all a part of predictive modeling. That is the tracking portion. The other portion is just tying a simple customer service rating to your phone number. So imagine you piss of several customer service reps, live in a low income part of town, and rarely spend money. You might be on hold for quite some time...
  - JohnHammersley 8y ago
    Thank you for this, that's a very nice summary, pitched at a very understandable level.
harryh 8y ago
It doesn't work on 90% of the HN crowd Hahahahahahahahahhahahahahahahhaha. No.
- jklinger410 8y ago
  You're right, not 90%. But predictive modeling requires a bunch of data points. This is probably one of the most privacy aware crowds on the internet. If you go to the extremes, sure, everyone is trackable. I don't work for any of these companies, so I don't know what I don't know. Feel free to elaborate.
  - vntok 8y ago
    The more you try to obfuscate your online sessions (eg: by disabling browser features, disabling JS, removing fonts, removing WebRTC, using the privacy-aware browser-of-the-day, etc. thus making your fingerprint even more unique), the more you stand out from the regular users crowd, the more automated tracking machines/algos get interested in you as an abnormal datapoint, the more you are paradoxically at risk of being tracked.
    - Karunamon 8y ago
      How exactly do they intend on fingerprinting me with no JS? They get my IP and referrer - that's it.
      - vntok 8y ago
        Just one example of CSS-only tracking. Does not require JS: https://github.com/jbtronics/CrookedStyleSheets https://github.com/jbtronics/CrookedStyleSheets Other data that leak: User-Agent, Accept or Accept-Language, Accept-Encoding headers...
      - Yizahi 8y ago
        Browser user agent. Mine is unique for example. With sufficiently vast DBs they can match you or anyone with anything. Also some 3rd party software may request to spy on you in the browser, e.g. Red Shell so called "analytics" used by many legitimate big video games on PC. It will spy on you in the browser and you agree to it in a kilometer long user agreement they shove in your face upon first launch.

da_chicken 8y ago

You know, I'm quickly reaching a point where I want the default browser to work in Incognito mode, and the browser should only switch to regular mode when I explicitly whitelist the domain.

hetspookjee 8y ago
On Android I browse by default with Firefox Focus and only to use sessions like posting this response I copy the URL to chrome and make the post. Than I'll go back to Focus. It's crude but Firefox Focus beats all browsers privacy and responsiveness on Android imo.
- cpeterso 8y ago
  Once I started using Firefox Focus, I was surprised at just how much of my browsing didn't need to be logged in. I don't need to keep session state when I'm just reading Wikipedia, news sites, or blogs.
- amorroxic 8y ago
  Same, Focus is great. Also a very warm mention for what I think became one of my favourite features while browsing - one single tab.
- chrsstrm 8y ago
  Same. My one wish for Focus is that I could open another tab. Even just one more tab during an active session would make life easier.
  - nitemice 8y ago
    You can open more than one tab with Focus. I did it accedentally a few times. The bin action button changes to a number if you have more than one tab open. https://support.mozilla.org/en-US/kb/open-new-tab-firefox-focus-android https://support.mozilla.org/en-US/kb/open-new-tab-firefox-fo...
  - dddw 8y ago
    you can, hold the link and click open in a new tab
    - chrsstrm 8y ago
      TIL that yes, that's true, but only on Android. iOS only lets you Open, which uses the same window.
- excalibur 8y ago
  +1 for Focus, but I don't generally interact with HN through a browser on mobile. There's an app for that.
  - ttty 8y ago
    I think apps can track your hardware I'd. I'm not saying hn does that, but other apps might track you even better with an app.
forapurpose 8y ago
Does Incognito mode solve this problem? I thought it mostly prevented data from being stored on your local computer; I did not think it was effective against tracking.
- Swizec 8y ago
  It improves tracking by fisabling your ad blocker.
  - icebraining 8y ago
    Maybe in Chrom*, but not in Firefox.
  - mindslight 8y ago
    As someone who has used chromium incognito as a crutch, 100% this. Browsers need to be seriously redesigned with privacy (aka security) in mind. The javascript execution environment needs to be gutted to remove security leaks like screen/window size. And incompetently (/maliciously) designed APIs like websockets need to be thrown right out.
    - pbhjpbhj 8y ago
      The main browser makers get huge incomes from advertising. That's not going to make them want to spend a lot on protecting users from advertising.
- nil_pointer 8y ago
  You can still track someone in incognito. Things like your system installed fonts, installed plugins, and canvas fingerprint give you away.
this_user 8y ago
There are extensions like "Cookie AutoDelete" where you can explicitly whitelist what coookies are not supposed to be delete. I think it does not automatically clear localstorage, though. But if you combine this with a blocker extension to remove the usual suspects when it comes to tracking, you are mostly there already.
- maxerickson 8y ago
  Firefox supports the whitelisting natively. The only thing it doesn't have is a way to auto delete cookies without restarting (which expires session cookies, which is a native option). That's how I use it, cookies default to session only and a few sites get saved across sessions.
koolba 8y ago
I’ve been running my browsers like this for years. Not being logged in to Amazon et al also prevents buying cheap crap by adding one layer of friction. Another easy tip is to separate out anything that requires persistent login (ex: gmail) to a separate dedicated browser.
- Arbalest 8y ago
  Chrome/Chromium's --user-data-dir is great for this
  - eppsilon 8y ago
    Or Firefox's containers
myrandomcomment 8y ago
My IOS devices are set to Incognito mode by default and I use a Fire Focus as an add on for blocking with Safari. Been that way for ever. On my laptop Safari is in Incognito mode for all but a few sites. I clear the browsing history on the one that is not after the browsing session.
TheAdamist 8y ago
It's getting to the point where porn goes on the regular browser, legit stuff needs incognito.
ankit219 8y ago
Disable cookies by default. If a website can't function without enabling cookies open it in incognito

BLP4YC 8y ago

Care to ELI5?

jklinger410 8y ago
Analytics javascript can assign you an Unique Identifier string that can be passed along in a form where you fill out your phone number. They then tie your "session" or "user" (depending on how they have it set up) to a cookie they have placed on your machine. They then leverage a partnership with a large ad network, to see where they found that cookie, as well as other cookies, from other sites in their network. They then correlate where they have seen essentially your user footprint (collection of cookies and other identifiers from your machine) stored throughout their network, to put you in some kind of demographic or intent-based bucket. When you include data from mobile apps that are tracking your location, this can get very scary. There is a small leap required in tying a mobile ID (your phone's unique identifier) to web traffic, but it happens. Obviously all depending on the level of data you "share." They then run every user in these buckets through a machine learning algo, that tries to predict things. Income, gender, spending habits, life events, etc. They can determine where you live easily, zip codes, compare that to census data, etc. It's all a part of predictive modeling. That is the tracking portion. The other portion is just tying a simple customer service rating to your phone number. So imagine you piss of several customer service reps, live in a low income part of town, and rarely spend money. You might be on hold for quite some time...
- JohnHammersley 8y ago
  Thank you for this, that's a very nice summary, pitched at a very understandable level.

harryh 8y ago

It doesn't work on 90% of the HN crowd Hahahahahahahahahhahahahahahahhaha. No.

jklinger410 8y ago
You're right, not 90%. But predictive modeling requires a bunch of data points. This is probably one of the most privacy aware crowds on the internet. If you go to the extremes, sure, everyone is trackable. I don't work for any of these companies, so I don't know what I don't know. Feel free to elaborate.
- vntok 8y ago
  The more you try to obfuscate your online sessions (eg: by disabling browser features, disabling JS, removing fonts, removing WebRTC, using the privacy-aware browser-of-the-day, etc. thus making your fingerprint even more unique), the more you stand out from the regular users crowd, the more automated tracking machines/algos get interested in you as an abnormal datapoint, the more you are paradoxically at risk of being tracked.
  - Karunamon 8y ago
    How exactly do they intend on fingerprinting me with no JS? They get my IP and referrer - that's it.
    - vntok 8y ago
      Just one example of CSS-only tracking. Does not require JS: https://github.com/jbtronics/CrookedStyleSheets https://github.com/jbtronics/CrookedStyleSheets Other data that leak: User-Agent, Accept or Accept-Language, Accept-Encoding headers...
    - Yizahi 8y ago
      Browser user agent. Mine is unique for example. With sufficiently vast DBs they can match you or anyone with anything. Also some 3rd party software may request to spy on you in the browser, e.g. Red Shell so called "analytics" used by many legitimate big video games on PC. It will spy on you in the browser and you agree to it in a kilometer long user agreement they shove in your face upon first launch.