4 ms·

Is it really a privacy risk if there is no escalation? Exactly the same thing can be done, guaranteed, if JavaScript is enable. The UX is just objectively worse

by zaroth 8y ago

Is it really a privacy risk if there is no escalation? Exactly the same thing can be done, guaranteed, if JavaScript is enable. The UX is just objectively worse without this feature due to lag leaving the page. So why make the UX worse for a callback function when the site can do it no matter what? The only argument I can think of is that if the callback is slower, then sites may decide they don’t want the data because it slows down a user leaving their site by maybe a few hundred milliseconds. Is that really the mentality of a site which is going to track you without permission? And if they have your permission, we should provide the JavaScript tools to make it fast.

danShumway 8y ago
A couple of reasons, in order of what I believe to be the strongest to most controversial: First, hyperlink auditing works without Javascript enabled. Even if most users will have Javascript enabled, some won't. This moves auditing from "a thing that you could disable if you were willing to block JS" to "a thing that's always on no matter what." Secondly, to quote Chrome's dev team, you want developers to fall into a "pit of success." The ping link is so easy to use that it's something a developer can add without thinking. This encourages its inclusion in copy-paste code/tutorials. You're right that a site that wants to make use of something like this is probably not thrown off just because they need to add a click handler. But for someone who's newer to web development, it might make a difference. Developer friction can add up -- if tracking is universally more complicated than writing normal code, more developers will do the "right" thing purely by virtue of laziness. Finally, and most controversially, there is a line of thought that says that end user experience ought to be better on sites that are doing the right thing. You're right that a site that wants to track users is not going to be deterred by a hundred millisecond delay. But users might notice. If performance on "good" and "bad" sites are the same, the theory is that companies that respect users are at a strict disadvantage to companies that take advantage of them. Over time, users will migrate to the services that don't respect their privacy because of the extra resources being poured into those sites. Again, not everyone agrees with this -- but the idea is that if you're building an ethical site, you should have at least a few competitive advantages build in that might influence users to stick with you -- for instance, a snappier site.
- eridius 8y ago
  If you're willing to block JS, you can also trivially run an extension that strips all `ping` attributes from the page. And without JS you don't have to worry about the attributes being added back after the stripping. > Developer friction can add up -- if tracking is universally more complicated than writing normal code, more developers will do the "right" thing purely by virtue of laziness. Developers don't add ping attributes because it's easy. They add them because they're required to for analytics reasons. They will do this no matter what, so what we want to optimize for here is the user experience. You say that users will naturally migrate to sites that don't have the bad UX inherent in javascript-based or redirect-based link tracking, but experience shows that's not true. Some of the most popular sites on the planet do this and users haven't been driven away.
  - danShumway 8y ago
    I'm not here to argue which of these reasons are correct; I'm only here to explain some of the arguments that exist. That being said, > If you're willing to block JS, you can also trivially run an extension that strips all `ping` attributes. Sure. Ublock Origin already does this today at the request level, so you don't even need to worry about pages re-adding the attributes. But we could just as easily use this argument to get rid of every privacy-protecting decision in the browser. Why should Firefox care about Canvas fingerprinting if an extension can block it instead? For better or worse (some would argue worse) browsers have been slowly pulling privacy/tracking improvements from extensions into their core. I don't think they're close enough to a full solution that anyone should skip extensions like Ublock Origin or UMatrix, but I don't fault them for trying. > Developers don't add ping attributes because it's easy. Like you correctly mentioned above, ping attributes are trivial to block. If a developer is being forced to implement tracking, even with ping attributes available more broadly, they're still gonna use an additional method that gets through the most widely used ad blockers on the market -- and that means Javascript click events. Force-enabling the ping attribute will not change a single thing about that developer's approach. The only developers who are going to be influenced by this change are hobbyists and engineers for small-time businesses that don't already have a massive analytics concern. I think it's reasonable to focus on its impact to them. > You say that users will naturally migrate to sites that don't have the bad UX... but experience shows that's not true. Don't be too pessimistic, loading speed is one of the primary reasons why the average person installs an adblocker to begin with. It is very hard to get people to care about privacy, but lots of people are still installing ad blockers purely because they improve the UX experience. That's a success story. Of course, 100 milliseconds on its own is not going to make someone abandon a site. But when you make a lot of tiny compromises, they add up to big ones. And as of 2018, Google is still publishing statistics that say a 3 second load time will lose you 53% of your potential visitors.[0] I know it seems like users don't care about this, but there's a nontrivial amount of data that suggests they do. [0]: https://www.thinkwithgoogle.com/marketing-resources/data-measurement/mobile-page-speed-new-industry-benchmarks/ https://www.thinkwithgoogle.com/marketing-resources/data-mea...

by zaroth 8y ago

danShumway 8y ago

A couple of reasons, in order of what I believe to be the strongest to most controversial: First, hyperlink auditing works without Javascript enabled. Even if most users will have Javascript enabled, some won't. This moves auditing from "a thing that you could disable if you were willing to block JS" to "a thing that's always on no matter what." Secondly, to quote Chrome's dev team, you want developers to fall into a "pit of success." The ping link is so easy to use that it's something a developer can add without thinking. This encourages its inclusion in copy-paste code/tutorials. You're right that a site that wants to make use of something like this is probably not thrown off just because they need to add a click handler. But for someone who's newer to web development, it might make a difference. Developer friction can add up -- if tracking is universally more complicated than writing normal code, more developers will do the "right" thing purely by virtue of laziness. Finally, and most controversially, there is a line of thought that says that end user experience ought to be better on sites that are doing the right thing. You're right that a site that wants to track users is not going to be deterred by a hundred millisecond delay. But users might notice. If performance on "good" and "bad" sites are the same, the theory is that companies that respect users are at a strict disadvantage to companies that take advantage of them. Over time, users will migrate to the services that don't respect their privacy because of the extra resources being poured into those sites. Again, not everyone agrees with this -- but the idea is that if you're building an ethical site, you should have at least a few competitive advantages build in that might influence users to stick with you -- for instance, a snappier site.

eridius 8y ago
If you're willing to block JS, you can also trivially run an extension that strips all `ping` attributes from the page. And without JS you don't have to worry about the attributes being added back after the stripping. > Developer friction can add up -- if tracking is universally more complicated than writing normal code, more developers will do the "right" thing purely by virtue of laziness. Developers don't add ping attributes because it's easy. They add them because they're required to for analytics reasons. They will do this no matter what, so what we want to optimize for here is the user experience. You say that users will naturally migrate to sites that don't have the bad UX inherent in javascript-based or redirect-based link tracking, but experience shows that's not true. Some of the most popular sites on the planet do this and users haven't been driven away.
- danShumway 8y ago
  I'm not here to argue which of these reasons are correct; I'm only here to explain some of the arguments that exist. That being said, > If you're willing to block JS, you can also trivially run an extension that strips all `ping` attributes. Sure. Ublock Origin already does this today at the request level, so you don't even need to worry about pages re-adding the attributes. But we could just as easily use this argument to get rid of every privacy-protecting decision in the browser. Why should Firefox care about Canvas fingerprinting if an extension can block it instead? For better or worse (some would argue worse) browsers have been slowly pulling privacy/tracking improvements from extensions into their core. I don't think they're close enough to a full solution that anyone should skip extensions like Ublock Origin or UMatrix, but I don't fault them for trying. > Developers don't add ping attributes because it's easy. Like you correctly mentioned above, ping attributes are trivial to block. If a developer is being forced to implement tracking, even with ping attributes available more broadly, they're still gonna use an additional method that gets through the most widely used ad blockers on the market -- and that means Javascript click events. Force-enabling the ping attribute will not change a single thing about that developer's approach. The only developers who are going to be influenced by this change are hobbyists and engineers for small-time businesses that don't already have a massive analytics concern. I think it's reasonable to focus on its impact to them. > You say that users will naturally migrate to sites that don't have the bad UX... but experience shows that's not true. Don't be too pessimistic, loading speed is one of the primary reasons why the average person installs an adblocker to begin with. It is very hard to get people to care about privacy, but lots of people are still installing ad blockers purely because they improve the UX experience. That's a success story. Of course, 100 milliseconds on its own is not going to make someone abandon a site. But when you make a lot of tiny compromises, they add up to big ones. And as of 2018, Google is still publishing statistics that say a 3 second load time will lose you 53% of your potential visitors.[0] I know it seems like users don't care about this, but there's a nontrivial amount of data that suggests they do. [0]: https://www.thinkwithgoogle.com/marketing-resources/data-measurement/mobile-page-speed-new-industry-benchmarks/ https://www.thinkwithgoogle.com/marketing-resources/data-mea...