9 ms·

Pornography sites found to be riddled with trackers from major tech companies

134 points by Jerry2 7y ago

makepanic 7y ago
Direct link to the underlying paper: https://arxiv.org/abs/1907.06520 https://arxiv.org/abs/1907.06520 The "even in incognito mode" part seems odd: > What Jack does not know is that incognito mode only ensures his browsing history is not stored on his computer. The sites he visits, aswell as any third-party trackers, may observe and record his online actions
- luckylion 7y ago
  Yeah, a bit misleading, given that incognito mode doesn't share cookies (but does disk cache!) with the main profile. It's correct that they "may observe" as in "the browser still sends requests", but unless they do additional fingerprinting or use other information to correlate (IP), they can't easily connect the two observed users. It may be useful to tighten up anti-tracking-tech in incognito windows. Currently, since plugins aren't enabled in incognito windows by default, it has the opposite effect: while your cookies are hidden, you're loading each and every tracker when in incognito mode.
- WA 7y ago
  I think it's not that odd. People assume that incognito means, well, "incognito" – like "anonymous browsing". But there are obviously more ways to identify a user besides cookies that are cleared/reset when incognito mode is closed and re-opened. Edit: To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques.
  - luckylion 7y ago
    > To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques. Regarding IPs: it would be legally problematic and might be exposed leading to terrible press, large fines and a strong argument for more regulation, so there's a lot of incentive not to use it, and I'm not sure they would even need it given the vast amount of information they have on users. Regarding fingerprinting: I believe somebody would have noticed. Google and FB are generally scrutinized much more than a random small ad-tech vendor.
    - WA 7y ago
      Sorry, are you serious or is this sarcasm? Facebook has shown in the recent months that they try to obtain data about users in every possible way. Collecting and comparing the IP address is the simplest exercise in the book. This, of course, is probably sold as "making your account more secure". It's incredible that on a site like HN people truly seem to believe that "incognito mode" equals some sort of anonymity and that there is such as thing like goodwill of Ad companies and that they won't take whatever data that is served on a silver plate (like the IP address). And you know what's really troublesome? One's sexual preferences are unlikely to change by a lot. Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on.
      - luckylion 7y ago
        > Collecting and comparing the IP address is the simplest exercise in the book. This, of course, is probably sold as "making your account more secure". Sure, and if you agree to it, they can. If you don't, however, and somebody blows the whistle, they'll be looking at huge fines in Europe and most of their lobbying will be void because their bought politicians will look very corrupt if they try to stop regulations. Again, I don't believe that they don't do it because "it's not ethical". Rather, it's going to cost them lots of money if they do and get caught (and lots of good will, too), and I doubt that they need it. IPs would be another data point, but they have so many already that it may not add as much value. That's for FB, Google & co, of course, for small ad-tech companies it's different. > Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on. That's true, and the reason why you'd want to disable tracking completely. As a user, you gain nothing from companies being able to track you, but you lose plenty. Again, I'm not suggesting that companies aren't tracking users, I'm saying that Google and FB are likely not operating that obviously that far outside the law. They can, sure, but they'll need to run a large conspiracy to keep it secret, and large conspiracies are hard and rare.
        WA 7y ago
        Facebook collects phone numbers of random people, if a FB user uploads their contact list. Facebook collects data in shadow profiles. Facebook collects login credentials for email accounts. Facebook asks for phone numbers for "two-factor authentication" and then uses it in different ways. Similar for Google. Most default options are enabled if you set up an Android phone (and these options and settings track you). Opt-in? Off by default? Nothing. Just to name one example. Dark patterns to give consent everywhere, like buttons suggesting that opt-in is the only way to do it and so on. All of this is kinda known, and illegal under GDPR. Consequences so far? None.
  - wongarsu 7y ago
    I just checked both Firefox and Chrome. When you open an incognito window both show a text snippet explaining what incognito mode is, and both go out of their way to explain that incognito mode does not make you anonymous to the website operator. It only claims to help against local users looking at your browsing history.
- pdkl95 7y ago
  Why is that odd? "Incognito mode" is a feature to hide your browsing history locally. Usually this meant hiding your porn browsing from your parents/roommate/etc. Hiding anything from the server was (unfortunately) never a design goal. The scope of incognito mode has recently expanded, but browsers still trust servers far too much (e.g. the Referrer header still exists, which is designed to leak private information).
  - donkeyd 7y ago
    Chrome literally says this when you open incognito mode: > Your activity might still be visible to: > - Websites you visit > - Your employer or school > - Your internet service provider
    - dhimes 7y ago
      I remember when they used to also say "secret agents." Then after Snowden that disclaimer went away.
- tlibert 7y ago
  Second author here. The paper is written for a social-science audience (I'm the CS person, hence ACM template), so it is written that way to help get non-experts on board. Otherwise, there is ample research people don't understand how private browsing works, and there are plenty of ways to track people during privacy sessions. There are some very creative people working in adtech today and I don't doubt there are numerous methods that are being used to get around every single protection out there. I'd vastly prefer that creative energy be directed to socially beneficial ends, but I have respect for the technical chops of people in adtech. However, it is fundamentally depressing that so many smart people spend their lives shattering the bounds of decency to get an ad impression for some useless item that will go into a landfill in 18 months. Aside from privacy the biggest tragedy here is the waste of brainpower spent promoting mindless consumerism in a world rapidly moving towards climate catastrophe.
anon357 7y ago
>Silicon Valley’s biggest companies are always watching you — even when you’re browsing pornography websites in incognito mode. >You’re in private mode. >Log in or create a free New York Times account to continue reading in private mode. You can't possibly make this sh*t up.
user17843 7y ago
Should be easy to avoid with simply using another cookie jar or blocking third-party cookies. It seems the direct connection can only be made when a user is logged into a facebook or google profile. Otherwise the data can not be connected to a personal account without some degree of uncertainty and illegality. G and F could use other data, like the browser fingerprint, OS information and the IP address to associate the data, which may be illegal, at least in Europe. Thus they probably use some other technique, for example creating pseudonymous shadow profiles and associating them based on similarity. In their front-end the data would just show clusters of profiles, which means they can claim they do not collect personal data, but from a quick glance it would be obvious to see connections between a user and "anonymous" clusters, if the similarity borders on 100%. Thus a good practice would be to use a different Operating system and browser, together with the usual protective measures.
- tlibert 7y ago
  IP address is a very strong signal and short of Tor you cannot do much about that. I'm hesitant to recommend VPNs just due to the high level of trust you need to have in your provider. It isn't that easy to avoid tracking.
TheBobinator 7y ago
It's funny an article published behind a paywall about facebook and google partnering to track your pr0n use has a message that says, as soon as the page loads, you're in private mode". NYT has become such a tabloid. Study is here: https://arxiv.org/pdf/1907.06520.pdf https://arxiv.org/pdf/1907.06520.pdf Now we can have a REAL Discussion.
grandmczeb 7y ago
“Nearly all tracking is by default and governed by impossible-to-read privacy policies. [...] For more detail please see our privacy policy.” Ironic.
- mosselman 7y ago
  How is this ironic? Having a privacy policy is not the same as having an 'impossible-to-read' one. Also, I doubt the journalists at the New York Times are responsible for what the company's tracking policy is. Are they suddenly not allowed to write about privacy issues? By this standard nobody would be allowed to talk about climate change, seeing as probably nobody has a 0% impact on climate change.
  - Xelbair 7y ago
    That's still ironical. if their claims are valid or not is absolutely unrelated to the irony of that situation though. Did anyone imply that if the content is 'ironical' we shouldn't write it or discuss it?
    - mosselman 7y ago
      It isn't ironic just because they also have a privacy policy. It has to be unreadable to come close to irony. Lets say that I own a burger restaurant and I tell you that burgers at McDonalds are crap. Would that be ironic? Because that is what you are saying. > Did anyone imply that if the content is 'ironical' we shouldn't write it or discuss it? I interpret the original comment: > Ironic. as a means to discrediting the journalist. You are right though and instead of "Are they suddenly not allowed to write about privacy issues?" I should have written something along the lines of "Is it suddenly not credible for them to write about privacy issues?"
  - grandmczeb 7y ago
    You’re reading quite a bit into a single word comment. Can we at least agree the juxtaposition of those two sentences is funny?
lota-putty 7y ago
Tangent: How many here have verified their Phone# for recovery reasons? Or even installed some apps like true-caller? Browser finger-printing, 3rd-party tracking or the website itself. Better off with p0rn-torrents' magnet-URLs?
throwawayyy6349 7y ago
Some privacy tips: 1. Use firefox with multi-account containers, with each domain set to auto-open in a different container (google, gmail, amazon, facebook, youtube, etc.). Make sure you're logged into google only in the gmail container (and not in the google search container), etc. 2. Use uMatrix and uBlock0, and enable limited third-party access using uMatrix dashboard only when a site breaks. 3. Enable DNS over https in firefox 4. Enable privacy.resistFingerprinting in firefox's about:config to thwart fingerprinting 5. Use the tor browser for browsing porn (or any site you really do not want associated with your IP). Edit: Added resistFingerprinting to the list.
- trilila 7y ago
  One might think that since browsing privately and securely is such a pain point, there would be more than one product (firefox) to solve the issue. Any HN entrepreneur types out there reading these posts?
  - dvfjsdhgfv 7y ago
    Practically speaking, you would have to use Chromium as a base, if you want the product to be successful. And if you do that, Google has a million ways to screw you up. One of the first obstacles you will find will be Widevine. Hardly anyone moves past that point.
    - ehnto 7y ago
      Not sure why you got downvoted. Practically speaking, A fully fledged and compliant modern browser would require a team to build if not built off the back of another browser. So either you're a funded non-profit or you need to make money which doesn't seem compatible with privacy on the internet.
    - S4M 7y ago
      Why not use Firefox as a base?
  - anonymou2 7y ago
blub 7y ago
Interestingly, I've noticed some adult websites (not necessarily pornography) are requiring Google captcha. That thing is spreading like weed.
- fareesh 7y ago
  Most of them already have the social sharing buttons. I suspect those are able to catch the vast majority of users who don't use an incognito mode.
H8crilA 7y ago
Is it just Google Analytics and similar things? Pretty much every website has some tracking of this sort.
- fareesh 7y ago
  I guess you can add browser fingerprinting, etc. which most folks seem to do these days, since there is a cat-and-mouse game of users slowly becoming more privacy sensitive and using basic tools like incognito mode and ad blockers.
- throw20102010 7y ago
  Yes, mostly just analytics and standard fare from all websites. For the most part, it's just the regular "Share on Facebook/Twitter/Etc." buttons that you see all over the internet. All of the social media have trackers embedded in those buttons. It's always confused my why anyone would actually share what porn video they were watching with their friends on social media. The one thing that isn't standard for porn sites is ad serving/tracking. They usually don't use ads served from Google and Facebook, probably because most people don't want their "regular" ads being served on a porn site. So most major porn sites have their own ad system.
  - H8crilA 7y ago
    Yeah, big players with brand value like Google or FB do not dabble with porn or other socially unacceptable content. At all.
- tlibert 7y ago
  Second-author here. Details are in the paper, but yes, Google Analytics is highly prevalent. Google doesn't allow porn sites to use their ad networks so we didn't find much Double-click, but it is fairly hypocritical to say "we won't show ads on porn sites" while also having no problem allowing porn sites to install your tracking software.
aviraldg 7y ago
I feel like all these articles follow a pattern: they take a common, well known aspect of technology (in this case, analytics trackers), search for any cases where a major tech company is involved, and come up with the most clickbaity headline possible ("Google and Facebook Are Quietly Tracking You on Sex Websites", when it's actually the website owners adding this tracking code in the first place, explicitly for the purpose of understanding user behaviour.) These headlines are then shared and reshared by nontechnical users, prompting outrage when there isn't a good reason for it.
- Nextgrid 7y ago
  To be fair, it’s not like Google/Facebook are a neutral party and only collect data to give it to the site owner. They are also complicit because they keep this data for their own purposes.
  - disgruntledphd2 7y ago
    From the article, I'm a little more worried about Oracle, who refused to comment on the story. That being said, this isn't really news (to us, at least), but it's good that newspapers keep banging this drum, as I doubt most other people have thought about all the tracking that happens everytime they visit a new site.
- sureaboutthis 7y ago
  Oh leave these people alone. It gives them something to talk about and keeps them off the streets.
- waveymaus 7y ago
  I appreciate trackers are "well-known", but only to a specific class of technical individuals. "Nontechnical users" is basically everyone. They have a right to be outraged, especially when a technology is understood asymmetrically well by the class of individuals who exploit this asymmetry to their advantage. Both the individuals visiting these sites, and possibly even the people making the decision to implement tracking don't know their browsing data is being used for anything other than analytics by the website provider, (if at all by the user, who likely feels safe behind a private browser).
StavrosK 7y ago
But every big site is riddled with trackers. Why single out pornography websites?
- gourou 7y ago
  In order to get people to care about their online privacy, use what they're most private about. Last Week Tonight used the same trick on their segment with Snowden. https://www.wired.com/2015/04/john-oliver-edward-snowden-dick-pics/ https://www.wired.com/2015/04/john-oliver-edward-snowden-dic...
  - StavrosK 7y ago
    Ah, that makes sense, thanks.
- tlibert 7y ago
  Second author here, see replies above. TDLR: biggest reason to single out porn is what you view may reveal your sexual orientation, depending on where you live that can get you killed.
amelius 7y ago
Somewhere at Google, someone has a Google Map showing who is consuming porn at what moment.
- AndrewOMartin 7y ago
  Everyone else can just look at this: https://commons.wikimedia.org/wiki/File:The_earth_at_night.jpg https://commons.wikimedia.org/wiki/File:The_earth_at_night.j...
- wongarsu 7y ago
  Pornhub probably has such a map, and their data analysis on Pornhub Insight is always a great read [0]. Of course google connecting porn searches with your other behavior is another level of scary. 0: https://www.pornhub.com/insights/ https://www.pornhub.com/insights/ (sfw)
  - hutzlibu 7y ago
    That is indeed fascinating. "Thanks to a Facebook event called “Storm Area 51” ... Since July 12th, searches for “Area 51” have surged from zero to 160,000 in just 4 days. July 16th alone had nearly 59,000 searches. ... The most popular alien related search is “alien impregnation” followed by “alien sex”. Other interesting searches include “alien belly” (a reference to the scene from the original 1979 Alien movie?), “alien eggs”, “alien abduction” and “alien probe”. " So I always suspected, that the internet is a weird place, but good to have data to back that up. But seriously, out of porn consumption statistics, you can get a deep analytical experience of the population. So yes, it is scary, if some companies have all that knowledge.
    - wongarsu 7y ago
      > But seriously, out of porn consumption statistics, you can get a deep analytical experience of the population. So yes, it is scary, if some companies have all that knowledge. Indeed. It gives you insights that are otherwise hard to get. Like predicting the viewership of events based on traffic changes like these: https://cs.phncdn.com/insights-static/wp-content/uploads/2018/11/5-pornhub-insights-2018-year-review-tv-live-events-1.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... Or how many people care about a solar eclipse: https://cs.phncdn.com/insights-static/wp-content/uploads/2017/08/pornhub-insights-2017-eclipse.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... Or these graphs: https://cs.phncdn.com/insights-static/wp-content/uploads/2018/11/1-pornhub-insights-2018-year-review-favorite-times-to-watch.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... https://cs.phncdn.com/insights-static/wp-content/uploads/2018/11/maps-pornhub-insights-2018-year-review-most-viewed-categories.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... https://cs.phncdn.com/insights-static/wp-content/uploads/2018/11/3-pornhub-insights-2018-year-in-review-age-group-searches-categories.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... And all of those graphs are just scratching the surface. For example they seem to have good data on age, gender and sexual orientation (likely from signed up users and statistical inference), which allows them to say what percentage of lesbians aged 30-40 living in Minnesota watch solar eclipses or watch the royal wedding.
mirimir 7y ago
Why would anyone expect porno sites to track users less than The NY Times (for example) does? I mean, it's not like they're your friends.
- tlibert 7y ago
  Second author here. Many people carry over 'real world' privacy expectations to online interactions, often unwittingly. While this may be technically naive, I don't think it is wrong for people to assume established social norms around sex and privacy, which have existed for millennia, are suddenly null and void b/c they go online. Porn stores in real life often have curtains, dark windows, etc. to protect privacy, and some people likely have that mental model ingrained, even if they do have a suspicion they are being tracked.
  - mirimir 7y ago
    I suppose. But I'd think that people would know by now that online tracking is ubiquitous. Arguably there are no "established social norms" online. That's one huge advantage, when it's about accessibility of stuff that's verboten or restricted in your society. Such as, for example, porn. But it cuts both ways, of course. So established social norms about privacy are also widely ignored. The fundamental business model is based on violating users' privacy. Two of the largest online businesses, Google and Facebook, rely on monetizing the violation of users' privacy. So yeah, perhaps it's understandable, but it's gobsmacking naive to think that online porn would be an exception.
    - tlibert 7y ago
      I fully agree, but people are often capable of knowing something abstract is true in general (web is full of tracking), but often fail to make the cognitive step to apply those facts to the specific case (there is tracking on porn sites). Nearly 20 years ago I worked as a Dell phone support technician for a few months and it was the best learning experience I've ever had in terms of understanding what the "average" person can actually comprehend. I think many technical people have experience with non-technical people who are otherwise fairly educated and clever (eg parents/grandparents), but there are a lot of people who have difficulty with the concepts, let alone the details. I think those people still deserve privacy.
tlibert 7y ago
Second author here, I'm busy for the next couple hours, but happy to AMA. Put any questions here and I will reply as I'm able.
kerng 7y ago
This is a great example that should be used more often when communicating the risks and privacy violations and implications these ad trackers have. Its disturbing to know that Google and Facebook have access to all this - they indeed know more about you, then you yourself.
- m-p-3 7y ago
  To be fair, I always use incognito mode when using this kind of website, but Google can probably track me through the IP address I guess. And I also use PiHole at home.
- tlibert 7y ago
  Second-author here. Thanks! One reason I initiated this research was trying to find ways to reach people who may be jaded about privacy. Sex usually wakes people up. :-)
693471 7y ago
The industry has moved from pay sites and piracy where you wouldn't track people to free porn sites that are ad supported. Obviously it's easier to use the free sites so the data tracking is not surprising. If you don't want to be tracked, pay for your porn. Or pirate it.
- everdrive 7y ago
  I agree with you, but remember that VISA/Mastercard/etc are selling your purchases to whomever would like to buy them.
- tlibert 7y ago
  A large chunk of the traffic is Google Analytics and various APIs, so even if you pay you will almost certainly be tracked by Google. Piracy obviously has its own risks.
LinuxBender 7y ago
Have people stopped using usenet and bittorrent to get these things? I prefer SFTP. No HTML, no ads, no MITM. Mumble servers + SFTP servers are a good combo to decentralize the most important part of the web (porn).

134 points by Jerry2 7y ago

Direct link to the underlying paper: https://arxiv.org/abs/1907.06520 https://arxiv.org/abs/1907.06520 The "even in incognito mode" part seems odd: > What Jack does not know is that incognito mode only ensures his browsing history is not stored on his computer. The sites he visits, aswell as any third-party trackers, may observe and record his online actions

luckylion 7y ago
Yeah, a bit misleading, given that incognito mode doesn't share cookies (but does disk cache!) with the main profile. It's correct that they "may observe" as in "the browser still sends requests", but unless they do additional fingerprinting or use other information to correlate (IP), they can't easily connect the two observed users. It may be useful to tighten up anti-tracking-tech in incognito windows. Currently, since plugins aren't enabled in incognito windows by default, it has the opposite effect: while your cookies are hidden, you're loading each and every tracker when in incognito mode.
WA 7y ago
I think it's not that odd. People assume that incognito means, well, "incognito" – like "anonymous browsing". But there are obviously more ways to identify a user besides cookies that are cleared/reset when incognito mode is closed and re-opened. Edit: To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques.
- luckylion 7y ago
  > To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques. Regarding IPs: it would be legally problematic and might be exposed leading to terrible press, large fines and a strong argument for more regulation, so there's a lot of incentive not to use it, and I'm not sure they would even need it given the vast amount of information they have on users. Regarding fingerprinting: I believe somebody would have noticed. Google and FB are generally scrutinized much more than a random small ad-tech vendor.
  - WA 7y ago
    Sorry, are you serious or is this sarcasm? Facebook has shown in the recent months that they try to obtain data about users in every possible way. Collecting and comparing the IP address is the simplest exercise in the book. This, of course, is probably sold as "making your account more secure". It's incredible that on a site like HN people truly seem to believe that "incognito mode" equals some sort of anonymity and that there is such as thing like goodwill of Ad companies and that they won't take whatever data that is served on a silver plate (like the IP address). And you know what's really troublesome? One's sexual preferences are unlikely to change by a lot. Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on.
    - luckylion 7y ago
      > Collecting and comparing the IP address is the simplest exercise in the book. This, of course, is probably sold as "making your account more secure". Sure, and if you agree to it, they can. If you don't, however, and somebody blows the whistle, they'll be looking at huge fines in Europe and most of their lobbying will be void because their bought politicians will look very corrupt if they try to stop regulations. Again, I don't believe that they don't do it because "it's not ethical". Rather, it's going to cost them lots of money if they do and get caught (and lots of good will, too), and I doubt that they need it. IPs would be another data point, but they have so many already that it may not add as much value. That's for FB, Google & co, of course, for small ad-tech companies it's different. > Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on. That's true, and the reason why you'd want to disable tracking completely. As a user, you gain nothing from companies being able to track you, but you lose plenty. Again, I'm not suggesting that companies aren't tracking users, I'm saying that Google and FB are likely not operating that obviously that far outside the law. They can, sure, but they'll need to run a large conspiracy to keep it secret, and large conspiracies are hard and rare.
      - WA 7y ago
        Facebook collects phone numbers of random people, if a FB user uploads their contact list. Facebook collects data in shadow profiles. Facebook collects login credentials for email accounts. Facebook asks for phone numbers for "two-factor authentication" and then uses it in different ways. Similar for Google. Most default options are enabled if you set up an Android phone (and these options and settings track you). Opt-in? Off by default? Nothing. Just to name one example. Dark patterns to give consent everywhere, like buttons suggesting that opt-in is the only way to do it and so on. All of this is kinda known, and illegal under GDPR. Consequences so far? None.
- wongarsu 7y ago
  I just checked both Firefox and Chrome. When you open an incognito window both show a text snippet explaining what incognito mode is, and both go out of their way to explain that incognito mode does not make you anonymous to the website operator. It only claims to help against local users looking at your browsing history.
pdkl95 7y ago
Why is that odd? "Incognito mode" is a feature to hide your browsing history locally. Usually this meant hiding your porn browsing from your parents/roommate/etc. Hiding anything from the server was (unfortunately) never a design goal. The scope of incognito mode has recently expanded, but browsers still trust servers far too much (e.g. the Referrer header still exists, which is designed to leak private information).
- donkeyd 7y ago
  Chrome literally says this when you open incognito mode: > Your activity might still be visible to: > - Websites you visit > - Your employer or school > - Your internet service provider
  - dhimes 7y ago
    I remember when they used to also say "secret agents." Then after Snowden that disclaimer went away.
tlibert 7y ago
Second author here. The paper is written for a social-science audience (I'm the CS person, hence ACM template), so it is written that way to help get non-experts on board. Otherwise, there is ample research people don't understand how private browsing works, and there are plenty of ways to track people during privacy sessions. There are some very creative people working in adtech today and I don't doubt there are numerous methods that are being used to get around every single protection out there. I'd vastly prefer that creative energy be directed to socially beneficial ends, but I have respect for the technical chops of people in adtech. However, it is fundamentally depressing that so many smart people spend their lives shattering the bounds of decency to get an ad impression for some useless item that will go into a landfill in 18 months. Aside from privacy the biggest tragedy here is the waste of brainpower spent promoting mindless consumerism in a world rapidly moving towards climate catastrophe.

anon357 7y ago

>Silicon Valley’s biggest companies are always watching you — even when you’re browsing pornography websites in incognito mode. >You’re in private mode. >Log in or create a free New York Times account to continue reading in private mode. You can't possibly make this sh*t up.

user17843 7y ago

Should be easy to avoid with simply using another cookie jar or blocking third-party cookies. It seems the direct connection can only be made when a user is logged into a facebook or google profile. Otherwise the data can not be connected to a personal account without some degree of uncertainty and illegality. G and F could use other data, like the browser fingerprint, OS information and the IP address to associate the data, which may be illegal, at least in Europe. Thus they probably use some other technique, for example creating pseudonymous shadow profiles and associating them based on similarity. In their front-end the data would just show clusters of profiles, which means they can claim they do not collect personal data, but from a quick glance it would be obvious to see connections between a user and "anonymous" clusters, if the similarity borders on 100%. Thus a good practice would be to use a different Operating system and browser, together with the usual protective measures.

tlibert 7y ago
IP address is a very strong signal and short of Tor you cannot do much about that. I'm hesitant to recommend VPNs just due to the high level of trust you need to have in your provider. It isn't that easy to avoid tracking.

TheBobinator 7y ago

It's funny an article published behind a paywall about facebook and google partnering to track your pr0n use has a message that says, as soon as the page loads, you're in private mode". NYT has become such a tabloid. Study is here: https://arxiv.org/pdf/1907.06520.pdf https://arxiv.org/pdf/1907.06520.pdf Now we can have a REAL Discussion.

grandmczeb 7y ago

“Nearly all tracking is by default and governed by impossible-to-read privacy policies. [...] For more detail please see our privacy policy.” Ironic.

mosselman 7y ago
How is this ironic? Having a privacy policy is not the same as having an 'impossible-to-read' one. Also, I doubt the journalists at the New York Times are responsible for what the company's tracking policy is. Are they suddenly not allowed to write about privacy issues? By this standard nobody would be allowed to talk about climate change, seeing as probably nobody has a 0% impact on climate change.
- Xelbair 7y ago
  That's still ironical. if their claims are valid or not is absolutely unrelated to the irony of that situation though. Did anyone imply that if the content is 'ironical' we shouldn't write it or discuss it?
  - mosselman 7y ago
    It isn't ironic just because they also have a privacy policy. It has to be unreadable to come close to irony. Lets say that I own a burger restaurant and I tell you that burgers at McDonalds are crap. Would that be ironic? Because that is what you are saying. > Did anyone imply that if the content is 'ironical' we shouldn't write it or discuss it? I interpret the original comment: > Ironic. as a means to discrediting the journalist. You are right though and instead of "Are they suddenly not allowed to write about privacy issues?" I should have written something along the lines of "Is it suddenly not credible for them to write about privacy issues?"
- grandmczeb 7y ago
  You’re reading quite a bit into a single word comment. Can we at least agree the juxtaposition of those two sentences is funny?

lota-putty 7y ago

Tangent: How many here have verified their Phone# for recovery reasons? Or even installed some apps like true-caller? Browser finger-printing, 3rd-party tracking or the website itself. Better off with p0rn-torrents' magnet-URLs?

throwawayyy6349 7y ago

Some privacy tips: 1. Use firefox with multi-account containers, with each domain set to auto-open in a different container (google, gmail, amazon, facebook, youtube, etc.). Make sure you're logged into google only in the gmail container (and not in the google search container), etc. 2. Use uMatrix and uBlock0, and enable limited third-party access using uMatrix dashboard only when a site breaks. 3. Enable DNS over https in firefox 4. Enable privacy.resistFingerprinting in firefox's about:config to thwart fingerprinting 5. Use the tor browser for browsing porn (or any site you really do not want associated with your IP). Edit: Added resistFingerprinting to the list.

trilila 7y ago
One might think that since browsing privately and securely is such a pain point, there would be more than one product (firefox) to solve the issue. Any HN entrepreneur types out there reading these posts?
- dvfjsdhgfv 7y ago
  Practically speaking, you would have to use Chromium as a base, if you want the product to be successful. And if you do that, Google has a million ways to screw you up. One of the first obstacles you will find will be Widevine. Hardly anyone moves past that point.
  - ehnto 7y ago
    Not sure why you got downvoted. Practically speaking, A fully fledged and compliant modern browser would require a team to build if not built off the back of another browser. So either you're a funded non-profit or you need to make money which doesn't seem compatible with privacy on the internet.
  - S4M 7y ago
    Why not use Firefox as a base?
- anonymou2 7y ago

blub 7y ago

Interestingly, I've noticed some adult websites (not necessarily pornography) are requiring Google captcha. That thing is spreading like weed.

fareesh 7y ago
Most of them already have the social sharing buttons. I suspect those are able to catch the vast majority of users who don't use an incognito mode.

H8crilA 7y ago

Is it just Google Analytics and similar things? Pretty much every website has some tracking of this sort.

fareesh 7y ago
I guess you can add browser fingerprinting, etc. which most folks seem to do these days, since there is a cat-and-mouse game of users slowly becoming more privacy sensitive and using basic tools like incognito mode and ad blockers.
throw20102010 7y ago
Yes, mostly just analytics and standard fare from all websites. For the most part, it's just the regular "Share on Facebook/Twitter/Etc." buttons that you see all over the internet. All of the social media have trackers embedded in those buttons. It's always confused my why anyone would actually share what porn video they were watching with their friends on social media. The one thing that isn't standard for porn sites is ad serving/tracking. They usually don't use ads served from Google and Facebook, probably because most people don't want their "regular" ads being served on a porn site. So most major porn sites have their own ad system.
- H8crilA 7y ago
  Yeah, big players with brand value like Google or FB do not dabble with porn or other socially unacceptable content. At all.
tlibert 7y ago
Second-author here. Details are in the paper, but yes, Google Analytics is highly prevalent. Google doesn't allow porn sites to use their ad networks so we didn't find much Double-click, but it is fairly hypocritical to say "we won't show ads on porn sites" while also having no problem allowing porn sites to install your tracking software.

aviraldg 7y ago

I feel like all these articles follow a pattern: they take a common, well known aspect of technology (in this case, analytics trackers), search for any cases where a major tech company is involved, and come up with the most clickbaity headline possible ("Google and Facebook Are Quietly Tracking You on Sex Websites", when it's actually the website owners adding this tracking code in the first place, explicitly for the purpose of understanding user behaviour.) These headlines are then shared and reshared by nontechnical users, prompting outrage when there isn't a good reason for it.

Nextgrid 7y ago
To be fair, it’s not like Google/Facebook are a neutral party and only collect data to give it to the site owner. They are also complicit because they keep this data for their own purposes.
- disgruntledphd2 7y ago
  From the article, I'm a little more worried about Oracle, who refused to comment on the story. That being said, this isn't really news (to us, at least), but it's good that newspapers keep banging this drum, as I doubt most other people have thought about all the tracking that happens everytime they visit a new site.
sureaboutthis 7y ago
Oh leave these people alone. It gives them something to talk about and keeps them off the streets.
waveymaus 7y ago
I appreciate trackers are "well-known", but only to a specific class of technical individuals. "Nontechnical users" is basically everyone. They have a right to be outraged, especially when a technology is understood asymmetrically well by the class of individuals who exploit this asymmetry to their advantage. Both the individuals visiting these sites, and possibly even the people making the decision to implement tracking don't know their browsing data is being used for anything other than analytics by the website provider, (if at all by the user, who likely feels safe behind a private browser).

StavrosK 7y ago

But every big site is riddled with trackers. Why single out pornography websites?

gourou 7y ago
In order to get people to care about their online privacy, use what they're most private about. Last Week Tonight used the same trick on their segment with Snowden. https://www.wired.com/2015/04/john-oliver-edward-snowden-dick-pics/ https://www.wired.com/2015/04/john-oliver-edward-snowden-dic...
- StavrosK 7y ago
  Ah, that makes sense, thanks.
tlibert 7y ago
Second author here, see replies above. TDLR: biggest reason to single out porn is what you view may reveal your sexual orientation, depending on where you live that can get you killed.

amelius 7y ago

Somewhere at Google, someone has a Google Map showing who is consuming porn at what moment.

AndrewOMartin 7y ago
Everyone else can just look at this: https://commons.wikimedia.org/wiki/File:The_earth_at_night.jpg https://commons.wikimedia.org/wiki/File:The_earth_at_night.j...
wongarsu 7y ago
Pornhub probably has such a map, and their data analysis on Pornhub Insight is always a great read [0]. Of course google connecting porn searches with your other behavior is another level of scary. 0: https://www.pornhub.com/insights/ https://www.pornhub.com/insights/ (sfw)
- hutzlibu 7y ago
  That is indeed fascinating. "Thanks to a Facebook event called “Storm Area 51” ... Since July 12th, searches for “Area 51” have surged from zero to 160,000 in just 4 days. July 16th alone had nearly 59,000 searches. ... The most popular alien related search is “alien impregnation” followed by “alien sex”. Other interesting searches include “alien belly” (a reference to the scene from the original 1979 Alien movie?), “alien eggs”, “alien abduction” and “alien probe”. " So I always suspected, that the internet is a weird place, but good to have data to back that up. But seriously, out of porn consumption statistics, you can get a deep analytical experience of the population. So yes, it is scary, if some companies have all that knowledge.
  - wongarsu 7y ago
    > But seriously, out of porn consumption statistics, you can get a deep analytical experience of the population. So yes, it is scary, if some companies have all that knowledge. Indeed. It gives you insights that are otherwise hard to get. Like predicting the viewership of events based on traffic changes like these: https://cs.phncdn.com/insights-static/wp-content/uploads/2018/11/5-pornhub-insights-2018-year-review-tv-live-events-1.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... Or how many people care about a solar eclipse: https://cs.phncdn.com/insights-static/wp-content/uploads/2017/08/pornhub-insights-2017-eclipse.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... Or these graphs: https://cs.phncdn.com/insights-static/wp-content/uploads/2018/11/1-pornhub-insights-2018-year-review-favorite-times-to-watch.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... https://cs.phncdn.com/insights-static/wp-content/uploads/2018/11/maps-pornhub-insights-2018-year-review-most-viewed-categories.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... https://cs.phncdn.com/insights-static/wp-content/uploads/2018/11/3-pornhub-insights-2018-year-in-review-age-group-searches-categories.png https://cs.phncdn.com/insights-static/wp-content/uploads/201... And all of those graphs are just scratching the surface. For example they seem to have good data on age, gender and sexual orientation (likely from signed up users and statistical inference), which allows them to say what percentage of lesbians aged 30-40 living in Minnesota watch solar eclipses or watch the royal wedding.

mirimir 7y ago

Why would anyone expect porno sites to track users less than The NY Times (for example) does? I mean, it's not like they're your friends.

tlibert 7y ago
Second author here. Many people carry over 'real world' privacy expectations to online interactions, often unwittingly. While this may be technically naive, I don't think it is wrong for people to assume established social norms around sex and privacy, which have existed for millennia, are suddenly null and void b/c they go online. Porn stores in real life often have curtains, dark windows, etc. to protect privacy, and some people likely have that mental model ingrained, even if they do have a suspicion they are being tracked.
- mirimir 7y ago
  I suppose. But I'd think that people would know by now that online tracking is ubiquitous. Arguably there are no "established social norms" online. That's one huge advantage, when it's about accessibility of stuff that's verboten or restricted in your society. Such as, for example, porn. But it cuts both ways, of course. So established social norms about privacy are also widely ignored. The fundamental business model is based on violating users' privacy. Two of the largest online businesses, Google and Facebook, rely on monetizing the violation of users' privacy. So yeah, perhaps it's understandable, but it's gobsmacking naive to think that online porn would be an exception.
  - tlibert 7y ago
    I fully agree, but people are often capable of knowing something abstract is true in general (web is full of tracking), but often fail to make the cognitive step to apply those facts to the specific case (there is tracking on porn sites). Nearly 20 years ago I worked as a Dell phone support technician for a few months and it was the best learning experience I've ever had in terms of understanding what the "average" person can actually comprehend. I think many technical people have experience with non-technical people who are otherwise fairly educated and clever (eg parents/grandparents), but there are a lot of people who have difficulty with the concepts, let alone the details. I think those people still deserve privacy.

tlibert 7y ago

Second author here, I'm busy for the next couple hours, but happy to AMA. Put any questions here and I will reply as I'm able.

kerng 7y ago

This is a great example that should be used more often when communicating the risks and privacy violations and implications these ad trackers have. Its disturbing to know that Google and Facebook have access to all this - they indeed know more about you, then you yourself.

m-p-3 7y ago
To be fair, I always use incognito mode when using this kind of website, but Google can probably track me through the IP address I guess. And I also use PiHole at home.
tlibert 7y ago
Second-author here. Thanks! One reason I initiated this research was trying to find ways to reach people who may be jaded about privacy. Sex usually wakes people up. :-)

693471 7y ago

The industry has moved from pay sites and piracy where you wouldn't track people to free porn sites that are ad supported. Obviously it's easier to use the free sites so the data tracking is not surprising. If you don't want to be tracked, pay for your porn. Or pirate it.

everdrive 7y ago
I agree with you, but remember that VISA/Mastercard/etc are selling your purchases to whomever would like to buy them.
tlibert 7y ago
A large chunk of the traffic is Google Analytics and various APIs, so even if you pay you will almost certainly be tracked by Google. Piracy obviously has its own risks.

LinuxBender 7y ago

Have people stopped using usenet and bittorrent to get these things? I prefer SFTP. No HTML, no ads, no MITM. Mumble servers + SFTP servers are a good combo to decentralize the most important part of the web (porn).