4 ms·

Online Privacy Is Poised for Regulatory Showdown

23 points by robg 16y ago

randomwalker 16y ago
I'm one of the main people involved in hammering out the tech issues in Do Not Track, along with my colleague Jonathan Mayer at Stanford. We work closely with the EFF's Lee Tien quoted in the article. See my post http://33bits.org/2010/09/20/do-not-track-explained/ http://33bits.org/2010/09/20/do-not-track-explained/ for some background; we've also set up http://donottrack.us/ http://donottrack.us/ as a sort of clearinghouse. I'd be happy to answer any questions.
robwgibbons 16y ago
I understand how this might be a threat to some online networks and advertising services, but I for one am happy there will be an official Do Not Track list.
- randomwalker 16y ago
  Do Not Track is great, but a Do Not Track "list" would be rather self-defeating. Please see my post http://33bits.org/2010/09/20/do-not-track-explained/ http://33bits.org/2010/09/20/do-not-track-explained/ for how DNT will work.
- pyre 16y ago
  Only if I can anonymously add my name to it.
ramanujan 16y ago
A decentralized, opt-in version of randomwalker's donottrack proposal (http://donottrack.us/ http://donottrack.us/) would allow users to balance privacy vs. benefits. Opt-out sites would be more private, but would offer less in the way of features, functionality, and personalization (both directly and indirectly because of the massive hit to monetization). In particular, I don't think many people realize just how many features on the modern web are enabled by anonymized analysis of large scale logs. A short list: 1. UI optimization via event logging 2. Features like priority inbox in Gmail 3. Bubble up in search rankings 4. A/B testing 5. Google Analytics (determining backlinks to your site) 6. Disqus login for blog commenting 7. While the proposal is about opting out of "third party web tracking", it is not obvious what a third party is. Is a YUI, Google Analytics, or Facebook Connect plugin which I chose to integrate into my site "third party code"? What if I have a business account with something like Crazyegg.com -- can I put their JS heatmap tracking in my webpage to figure out what buttons my users are getting confused by? If this is complex for hackers, do you trust the government that thinks the internet is a series of tubes to get this right? Finally, there is one throwaway sentence in the article which deserves underlining: It also wants to ensure that any restrictions do not impede law enforcement and national security efforts. Translation: the government will want Google and others to track you anyway, so that they can find you. So this is sort of reversed: true privacy legislation would mean the guys with guns wouldn't be able to track you. I'm a lot more scared of them than the guys trying to sell you "one weird old belly trick".
- ramanujan2 16y ago
  Darned noprocrast meant I can't edit this comment from my normal account. So here is a better formatted version: ------------ A decentralized, opt-in version of randomwalker's well thought out donottrack proposal (http://donottrack.us/ http://donottrack.us/) would allow users to balance privacy vs. benefits. Including "X-Do-Not-Track" in an HTTP header is an excellent idea; including it in a piece of legislation is much less so. Opt-out sites would be more private, but would offer less in the way of features, functionality, and personalization (both directly and indirectly because of the massive hit to monetization). Specifically, I don't think many people realize just how many features on the modern web are enabled by tracking of some kind or the other. A short list: 1. UI optimization via event logging 2. Features like priority inbox in Gmail 3. Bubble up in search rankings 4. A/B testing 5. Google Analytics (determining backlinks to your site) 6. Disqus login for blog commenting 7. Google Maps or location based service integration While the proposal is about opting out of "third party web tracking", it is not obvious what a third party is. Is a Google Analytics or Facebook Connect plugin which I chose to integrate into my site "third party code"? What if I have a business account with something like Crazyegg.com -- can I put their JS heatmap tracking in my webpage to figure out what buttons my users are getting confused by? And if this is complex for hackers, do you trust the government that thinks the internet is a series of tubes to get this right? Moreover, there is one throwaway sentence in the article which deserves underlining: It also wants to ensure that any restrictions do not impede law enforcement and national security efforts. Translation: the government will want Google and others to track you anyway, so that they can find you when they want. So this is sort of reversed: true privacy legislation would mean the guys with guns wouldn't be able to track you. I'm a lot more scared of them than the guys trying to sell you "one weird old belly trick". Remember that the government which is now talking about protecting your privacy is the same one which is making the very pilots themselves go through backscatter stations on the way to their planes, the same government that forced phone companies to tap your phones and forced Google to give them your email 9000 times per year. In my humble opinion, the solution to this kind of thing is not to throw up our hands and pray for this latest batch of Congresscritters to deliver us from evil, but for someone to build a private browser, with something like a built-in accessible Tor, which provides a better experience for those people who value privacy over functionality.

23 points by robg 16y ago

I'm one of the main people involved in hammering out the tech issues in Do Not Track, along with my colleague Jonathan Mayer at Stanford. We work closely with the EFF's Lee Tien quoted in the article. See my post http://33bits.org/2010/09/20/do-not-track-explained/ http://33bits.org/2010/09/20/do-not-track-explained/ for some background; we've also set up http://donottrack.us/ http://donottrack.us/ as a sort of clearinghouse. I'd be happy to answer any questions.

robwgibbons 16y ago

I understand how this might be a threat to some online networks and advertising services, but I for one am happy there will be an official Do Not Track list.

randomwalker 16y ago
Do Not Track is great, but a Do Not Track "list" would be rather self-defeating. Please see my post http://33bits.org/2010/09/20/do-not-track-explained/ http://33bits.org/2010/09/20/do-not-track-explained/ for how DNT will work.
pyre 16y ago
Only if I can anonymously add my name to it.

ramanujan 16y ago

A decentralized, opt-in version of randomwalker's donottrack proposal (http://donottrack.us/ http://donottrack.us/) would allow users to balance privacy vs. benefits. Opt-out sites would be more private, but would offer less in the way of features, functionality, and personalization (both directly and indirectly because of the massive hit to monetization). In particular, I don't think many people realize just how many features on the modern web are enabled by anonymized analysis of large scale logs. A short list: 1. UI optimization via event logging 2. Features like priority inbox in Gmail 3. Bubble up in search rankings 4. A/B testing 5. Google Analytics (determining backlinks to your site) 6. Disqus login for blog commenting 7. While the proposal is about opting out of "third party web tracking", it is not obvious what a third party is. Is a YUI, Google Analytics, or Facebook Connect plugin which I chose to integrate into my site "third party code"? What if I have a business account with something like Crazyegg.com -- can I put their JS heatmap tracking in my webpage to figure out what buttons my users are getting confused by? If this is complex for hackers, do you trust the government that thinks the internet is a series of tubes to get this right? Finally, there is one throwaway sentence in the article which deserves underlining: It also wants to ensure that any restrictions do not impede law enforcement and national security efforts. Translation: the government will want Google and others to track you anyway, so that they can find you. So this is sort of reversed: true privacy legislation would mean the guys with guns wouldn't be able to track you. I'm a lot more scared of them than the guys trying to sell you "one weird old belly trick".

ramanujan2 16y ago
Darned noprocrast meant I can't edit this comment from my normal account. So here is a better formatted version: ------------ A decentralized, opt-in version of randomwalker's well thought out donottrack proposal (http://donottrack.us/ http://donottrack.us/) would allow users to balance privacy vs. benefits. Including "X-Do-Not-Track" in an HTTP header is an excellent idea; including it in a piece of legislation is much less so. Opt-out sites would be more private, but would offer less in the way of features, functionality, and personalization (both directly and indirectly because of the massive hit to monetization). Specifically, I don't think many people realize just how many features on the modern web are enabled by tracking of some kind or the other. A short list: 1. UI optimization via event logging 2. Features like priority inbox in Gmail 3. Bubble up in search rankings 4. A/B testing 5. Google Analytics (determining backlinks to your site) 6. Disqus login for blog commenting 7. Google Maps or location based service integration While the proposal is about opting out of "third party web tracking", it is not obvious what a third party is. Is a Google Analytics or Facebook Connect plugin which I chose to integrate into my site "third party code"? What if I have a business account with something like Crazyegg.com -- can I put their JS heatmap tracking in my webpage to figure out what buttons my users are getting confused by? And if this is complex for hackers, do you trust the government that thinks the internet is a series of tubes to get this right? Moreover, there is one throwaway sentence in the article which deserves underlining: It also wants to ensure that any restrictions do not impede law enforcement and national security efforts. Translation: the government will want Google and others to track you anyway, so that they can find you when they want. So this is sort of reversed: true privacy legislation would mean the guys with guns wouldn't be able to track you. I'm a lot more scared of them than the guys trying to sell you "one weird old belly trick". Remember that the government which is now talking about protecting your privacy is the same one which is making the very pilots themselves go through backscatter stations on the way to their planes, the same government that forced phone companies to tap your phones and forced Google to give them your email 9000 times per year. In my humble opinion, the solution to this kind of thing is not to throw up our hands and pray for this latest batch of Congresscritters to deliver us from evil, but for someone to build a private browser, with something like a built-in accessible Tor, which provides a better experience for those people who value privacy over functionality.