11 ms·

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore

by DenisM 7y ago

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the companies trying to bust the incognito mode are already in that crowded bed. The next loops in this spiral are: 1) an incognito mode that seeds good-looking ad cookies 2) ML models trying to distinguish synthetic/cloned/5-seconds-old cookies from genuine ones 3) matching ML models trying to out-fox the models from step 2, and so on. The last fit of madness will be a hidden session in Chrome browsing the web on your behalf, building up a bogus profile for the ad networks, and the ad networks trying to figure out if the clicks in your fake session are sufficiently human-like. And whoever wins in this war, the ad networks will end up collecting even more data than they do now.

deleted 7y ago
[deleted]
underwater 7y ago
Alternatively, Google starts crawling the web in incognito mode; punishes websites that hide content.
- adtac 7y ago
  I understand the point of using a special user-agent to crawl webpages for indexing, but search engines should use a "regular" browser UA string (full JavaScript, etc. to simulate an actual browser) occasionally. From a different IP range too, of course. If the contents of the page are wildly different, penalise the site.
  - wolco 7y ago
    They do both or at least google does.
    - alasdair_ 7y ago
      Even if they do both, if the bots always follow what is entered in robots.txt and humans do not, it won’t be long before that’s the primary factor.
      - derimagia 7y ago
        And that's totally fine - if they add their articles (for example) into their robots.txt, it would cripple their SEO. It wouldn't happen.
      - zaarn 7y ago
        The Google bot mostly ignores the paths specified in robots.txt
      - chmod775 7y ago
        I've seen stuff in the robots.txt get crawled anyways if enough people link to it. In Google's results it will still only show up without any contextual information though.
        londons_explore 7y ago
        Google won't crawl it, but they can still include the link in search results, usually with the title guessed from the way it was referred to on another page, and no description.
  - sieabahlpark 7y ago
    What about sites which display different content depending on origin?
- propogandist 7y ago
  Google is an advertising company and everything they do is to improve the core ad-business. If Google had it their way every website would be using AMP, allowing google to have more control over the web, allowing them to become the only ad-network.
djflutt3rshy 7y ago
>The last fit of madness will be a hidden session in Chrome browsing the web on your behalf, building up a bogus profile for the ad networks, and the ad networks trying to figure out if the clicks in your fake session are sufficiently human-like. The first parts of this have already been tested by Mozilla: https://trackthis.link/ https://trackthis.link/
- dorgo 7y ago
  > https://trackthis.link/ https://trackthis.link/ It opens 100 tabs? With third-party ressources and javascript blocked, it will do little in terms of shaping my ad-profile. But maybe 4GB are not enough to open 100 tabs, so I skipt this.
tfha 7y ago
Just don't use sites that dont respect your privacy. If it doesn't like you blocking cookies, walk away.
- TylerE 7y ago
  So, don't use the internet? Because that's what you're describing. Better cut the power cord, too, just to be safe.
  - toby- 7y ago
    Plenty of sites respect user privacy. I should know; I run dozens of them.
    - coldtea 7y ago
      Define plenty. Are among those "plenty" the actual important pages that people want to use? Or some irrelevant pages here and there? And how do you know there are plenty? In fact, even if it is so, how can anyone verify that, even just about your sites? We can merely just trust you.
      - liability 7y ago
        Most of the articles I click through to from HN work just fine with all JS, including first party, blocked by uMatrix.
      - hueving 7y ago
        >the actual important pages that people want to use? Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile?
        coldtea 7y ago
        >Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile? Or, as I like to call it, pragmatic. Visits are a power law distribution, 80% of people's visits go to 20% of sites, and so on, recursively. s So unless e.g. the top 1000 (which may vary depending on country) people want to use are there, e.g. the social media, news sites, booking, video, shopping sites, banking sites, you're just talking about a number of niche websites. Sites that "still work with JS disabled" are in the minority on those lists. Essentially you're saying "don't use all those sites with the content/services you want", use all those others that don't have tracking (but which you don't really care for). E.g. pointing to Diaspora vs Facebook... The best I've seen people come up with on this front is DDG vs Google.
Sir_Cmpwn 7y ago
How about passing laws which forbid tracking users like this and levying steep, business-ending fines against the companies who don't step in line?
- kspacewalk2 7y ago
  No problem. All your favourite online services are no longer free though, what a bummer. Will it be a lite, regular or premium Google maps subscription? How about Facebook Messenger?
  - eckza 7y ago
    That sounds like heaven, honestly.
  - true_religion 7y ago
    You don’t need detailed tracking to run ads. Newspapers did it in the time before the internet. What did occur, is that advertisers could not be sure of performance so placed more value on the prominence and reputation of the media source. National well reputed papers got the best deals, regardless of real world performance. It will lead to tight localization again, as advertisers can’t rely on Google just selecting the right people to display ads to, but would have to seek specific sites to advertise on. The world will be fine.
    - cameronbrown 7y ago
      This it could have the side effect of killing independent journalism startups. Big media is already too entrenched. These big newspaper websites do already sell ads directly too - DoubleClick can serve both Adsense (usually as a backup) as well as their own inventory.
      - Tronno 7y ago
        There are drawbacks to every option. Given the choice between a surveillance state and a propaganda state, I will always choose the latter - at least you get some agency over what media you consume and which statements you believe. Surveillance is forced on you, and invisibly at that.
nashashmi 7y ago
As for cookies against ad networks, I browse with all third party cookies blocked. Some cookies from third parties are allowed. So that would not be the effective against people with high security settings. And there is also the possibility of a brand new computer with no cookies. Then that kind of detection will not necessarily work for every one.
- onion2k 7y ago
  The owners of these websites don't care about false positives (like people on new computers). Their interest is in maximising the number of ads shown and nothing else.
auslander 7y ago
> .. Chrome browsing the web on your behalf, building up a bogus profile for the ad networks Chrome is an ad network itself, well, a biggest player. I'm browsing in default Private mode on Safari for years, so yes, my fight is over, no cookies for me, lol. And on always-on VPN.
microcolonel 7y ago
Maybe they should start randomly sharing adtech cookies through the cloud.
- aeternus 7y ago
  This is similar to what I'd like to see. Sharing cookies is somewhat dangerous since they could have login/user data, but it would totally work to avoid browser fingerprinting. With all the fingerprinting methods (screen resolution, GPU, HW, font-list, etc.) it's a losing proposition to attempt to remove all traces of a unique fingerprint. Instead I'd like to see a browser that generates such a noisy fingerprint that it is useless: Each time I start an 'anonymous' session, grab a fingerprint from a pool that is sufficiently similar to mine that things render properly (matching resolution for example) but that has also been used by thousands/millions of others.
elorant 7y ago
The fight can be won if you block 3rd party JavaScript. Just install uMatrix and enjoy browsing the web in half the time it takes without it. No ads, no trackers, no Facebook widgets, just the web we learn to love. Sanity.
- rocky1138 7y ago
  Do you know of any way through the about:config editor to do this? I'd hate to have to install yet another browser plugin.
  - lstamour 7y ago
    It’s native in a number of browsers but quite hidden these days. Set your JS security settings to (ah I’m making this up as I don’t have the browser window in front of me) “Prompt” or “Allow (Per Site)” or “Blocked” - https://support.google.com/adsense/answer/12654?hl=en https://support.google.com/adsense/answer/12654?hl=en Then in browsers like Chrome, click the site icon, SSL icon, or little plugin icon in the address bar — some icon usually appears, which when clicked gives access to enable/disable blocked content for this site.
  - propogandist 7y ago
    uMatrix is a must have add-on and nothing else comes close to matching its functionality. It pairs well with uBlock Origin (same dev). Add-ons like Decentraleyes is also good as it prevents persistent tracking from shared web libraries, like Google ajax, that everyone seems to use... it's free and widely available for a reason. Google is also working to update Chrome APIs that will cripple privacy centric add-ons and those that allow ad-blocking, like uMatrix and uBlock origin soon, so enjoy it all while it lasts.
    - chii 7y ago
      which is why you should switch to firefox asap.
    - hdfbdtbcdg 7y ago
      These addons work fine in Firefox.
dheera 7y ago
What is nytimes.com using now to detect incognito? Enabling filesystem in incognito used to work until a few days ago.
- alacombe 7y ago
  IIRC, the trick is to time filesystem access and deduce you're running from RAM rather than disk, thus in incognito mode.
  - gruez 7y ago
    Sucks for you if you got ramdisk/optane, or have fsync disabled, I guess.
  - dheera 7y ago
    Interesting, if that's what they're using it should be possible to inject a JavaScript to replace the filesystem access function with a wrapper that induces delay.
- fourthark 7y ago
  The article says they are using the quota trick.
  - test344 7y ago
    Interesting on Firefox >https://www.bleepingcomputer.com/PoC/incognito-detection/incognito.html https://www.bleepingcomputer.com/PoC/incognito-detection/inc... = NO Incognito Menawhile on NYTimes = You’re in private mode.
oconnor663 7y ago
Sites don't want to bust the experience for brand new devices I think. That would include things like internet cafes where you log into a clean desktop environment, or browsers you use rarely like maybe one in your car. I think if Google can just get a real disk-backed implementation working for Incognito mode, such that there actually is no difference between Incognito and a new regular browser, this feature will be valuable.
- cortesoft 7y ago
  If they want to block incognito mode, wouldn't they also want to block someone from an Internet cafe? If the reason you block incognito mode is because you can't track the user, you don't want a user coming from an Internet cafe that you can't track.
na85 7y ago
I feel as though your argument is predicated on browsers that leak tracking data such as cookies, etc. If the browser vendors would tighten their products up and start considering things like profiling the user's installed fonts as a security vulnerability, then we might see some progress. Unfortunately Google has a financial incentive to make Chrome trackable to advertisers.
- jolux 7y ago
  Safari has already started introducing protections for attacks like font profiling and knowing the Chrome security team I would be surprised if they haven’t at least considered that as well.
- IX-103 7y ago
  Don't forget that the advertisers don't get income directly from tracking you. They get income based on how good they have a profile of your interests (and things that you would buy). If they can get a good enough profile without tracking then maybe they'll stop tracking. Or maybe it would be easier to block the few that continue taking than wave war on an entire industry.... There's already been some talk about changing things so that tracking is less necessary (https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/ https://webkit.org/blog/8943/privacy-preserving-ad-click-att...) and I wouldn't be surprised if a lot more comes out by the end of the year. Anyway, anyone that knows the details of the web could have seen this coming. [Private mode is not private](https://brave.com/private-mode-is-not-really-private/ https://brave.com/private-mode-is-not-really-private/). Websites can calculate fingerprints from users just by running JavaScript (they can easily get the processor speed, GPU version, local IP, and other details) so they can identify you even if you clear cookies. And the funny thing is that all of these APIs have reasonable intended uses and getting rid of them would large portions of content on the web.
  - nyuszika7h 7y ago
    I think you accidentally a word
  - na85 7y ago
0xADEADBEE 7y ago
In the same way that ublock is a must-have extension for many people, I won't browse without cookieAutoDelete [0]. Mostly I don't bother authenticating with websites anymore, and (I think about 3 maybe? And I just reauthenticate when I want to use those) and for mobile browsing I mostly use Firefox Focus [1]. The ad networks are down to browser fingerprinting now, which will be devastatingly accurate but realistically be the next frontier in the privacy war. I habitually roll IP addresses from different VPS service providers but I'm not sure there's much more an end user can do currently. Fascinated to see how this front will develop - if things like GDPR are coming into effect, then it's only a matter of time before a gratuitous misuse of data is closed in on, though I suspect it's too late for the current generation. [0] - https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... [1] - https://support.mozilla.org/en-US/kb/focus https://support.mozilla.org/en-US/kb/focus
- kevin_thibedeau 7y ago
  Random user agent to throw off the fingerprinting. Decentraleyes to defeat CDN tracking.
  - artificial 7y ago
    Another fun one is viewport tracking.
- JMTQp8lwXL 7y ago
  The browser shouldn't be providing a User Agent anyways. No matter what device I use, my user agent should have no bearing on the HTML or JS I receive.
obese_by_nature 7y ago
> Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. Or Brave.
millstone 7y ago
The big idea here is that the web advertising economy is user-hostile, and has to go. Someone - Apple, Chrome extension, whatever - will go nuclear, and craft the AI ad blocker that will do to ads what Gmail did to spam. God willing.
- gfosco 7y ago
  I think the solution lies in a system that doesn't use HTTP. Been thinking about it for years.
  - mesid 7y ago
    meaning?
  - xyzal 7y ago
    Why? Would you please be more specific?
B-Con 7y ago
> All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. What's funny is that this is pretty much what ReCaptcha v3 is. Asking how "authentic" the Google cookie looks.
sgjohnson 7y ago
>If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. I don't, as I block all third party cookies. No exceptions.
- m12k 7y ago
  Interesting. Are there any legitimate uses for third party cookies (i.e. functionality that you as the user actually care about) or are they only ever used for tracking?
  - 9HZZRfNlpR 7y ago
    For me fair amount of sites break where they have login authentication scattered around different domains.
  - SmellyGeekBoy 7y ago
    As someone who also blocks third party cookies - Captchas. But nothing else important IME.
swebs 7y ago
I remember around 10 years ago people were calling Stallman paranoid for this. Now he seems more like a prophet: >I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it (using konqueror, which won't fetch from other sites in such a situation). https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html
- shultays 7y ago
  Well, that is a bit paranoid.
  - mort96 7y ago
    It's not though? If your goal is to avoid having your every move online tracked by companies hoping to earn money from spying on you, what Stallman does is one of the few strategies which work.
    - shultays 7y ago
      You can take various actions to improve your privacy. At some point it becomes a paranoia. If you are fetching web pages on a remote server and email stuff to yourself then I would say it is becoming paranoia. And I would say what Stallman does probably gives him a very unique fingerprint (wget ting web pages from a unique server). I doubt he is doing that for privacy.
    - ludjer 7y ago
      Well the fact that he uses WGET on a remote server means that its a static ip in a DC most probably. Which means its allot easier to track him. Also considering the amount of pages i go through i would rather have no internet then have to wait for a email for ever page i want to use. Then also half the pages wont work because of no JS.
yummypaint 7y ago
That arms race is winnable because its a question of economics, not capability. As long as the cost of unmasking people remains higher than the expected profit from doing so, the fight is won.
imgabe 7y ago
Ultimately, if you block ads isn't the tracking useless? Sure, you can figure out the perfect ad to show me, but if I'm never going to see it, you're wasting your time.
NullPrefix 7y ago
>If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks This does not really work without 3rd party cookies, does it?
tinus_hn 7y ago
Yes, Google is committed to patching out anything used to detect incognito mode. If they make good on that promise detection will become harder and harder until it becomes practically impossible. Incognito mode can be made to look exactly as if you opened your browser after creating a new profile and immediately opening the site. As long as they can’t afford to block these users it can be made to work.
- anticensor 7y ago
  You can remove the as long out of the last sentence and it still makes sense.

by DenisM 7y ago

deleted 7y ago

[deleted]

underwater 7y ago

Alternatively, Google starts crawling the web in incognito mode; punishes websites that hide content.

adtac 7y ago
I understand the point of using a special user-agent to crawl webpages for indexing, but search engines should use a "regular" browser UA string (full JavaScript, etc. to simulate an actual browser) occasionally. From a different IP range too, of course. If the contents of the page are wildly different, penalise the site.
- wolco 7y ago
  They do both or at least google does.
  - alasdair_ 7y ago
    Even if they do both, if the bots always follow what is entered in robots.txt and humans do not, it won’t be long before that’s the primary factor.
    - derimagia 7y ago
      And that's totally fine - if they add their articles (for example) into their robots.txt, it would cripple their SEO. It wouldn't happen.
    - zaarn 7y ago
      The Google bot mostly ignores the paths specified in robots.txt
    - chmod775 7y ago
      I've seen stuff in the robots.txt get crawled anyways if enough people link to it. In Google's results it will still only show up without any contextual information though.
      - londons_explore 7y ago
        Google won't crawl it, but they can still include the link in search results, usually with the title guessed from the way it was referred to on another page, and no description.
- sieabahlpark 7y ago
  What about sites which display different content depending on origin?
propogandist 7y ago
Google is an advertising company and everything they do is to improve the core ad-business. If Google had it their way every website would be using AMP, allowing google to have more control over the web, allowing them to become the only ad-network.

djflutt3rshy 7y ago

>The last fit of madness will be a hidden session in Chrome browsing the web on your behalf, building up a bogus profile for the ad networks, and the ad networks trying to figure out if the clicks in your fake session are sufficiently human-like. The first parts of this have already been tested by Mozilla: https://trackthis.link/ https://trackthis.link/

dorgo 7y ago
> https://trackthis.link/ https://trackthis.link/ It opens 100 tabs? With third-party ressources and javascript blocked, it will do little in terms of shaping my ad-profile. But maybe 4GB are not enough to open 100 tabs, so I skipt this.

tfha 7y ago

Just don't use sites that dont respect your privacy. If it doesn't like you blocking cookies, walk away.

TylerE 7y ago
So, don't use the internet? Because that's what you're describing. Better cut the power cord, too, just to be safe.
- toby- 7y ago
  Plenty of sites respect user privacy. I should know; I run dozens of them.
  - coldtea 7y ago
    Define plenty. Are among those "plenty" the actual important pages that people want to use? Or some irrelevant pages here and there? And how do you know there are plenty? In fact, even if it is so, how can anyone verify that, even just about your sites? We can merely just trust you.
    - liability 7y ago
      Most of the articles I click through to from HN work just fine with all JS, including first party, blocked by uMatrix.
    - hueving 7y ago
      >the actual important pages that people want to use? Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile?
      - coldtea 7y ago
        >Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile? Or, as I like to call it, pragmatic. Visits are a power law distribution, 80% of people's visits go to 20% of sites, and so on, recursively. s So unless e.g. the top 1000 (which may vary depending on country) people want to use are there, e.g. the social media, news sites, booking, video, shopping sites, banking sites, you're just talking about a number of niche websites. Sites that "still work with JS disabled" are in the minority on those lists. Essentially you're saying "don't use all those sites with the content/services you want", use all those others that don't have tracking (but which you don't really care for). E.g. pointing to Diaspora vs Facebook... The best I've seen people come up with on this front is DDG vs Google.

Sir_Cmpwn 7y ago

How about passing laws which forbid tracking users like this and levying steep, business-ending fines against the companies who don't step in line?

kspacewalk2 7y ago
No problem. All your favourite online services are no longer free though, what a bummer. Will it be a lite, regular or premium Google maps subscription? How about Facebook Messenger?
- eckza 7y ago
  That sounds like heaven, honestly.
- true_religion 7y ago
  You don’t need detailed tracking to run ads. Newspapers did it in the time before the internet. What did occur, is that advertisers could not be sure of performance so placed more value on the prominence and reputation of the media source. National well reputed papers got the best deals, regardless of real world performance. It will lead to tight localization again, as advertisers can’t rely on Google just selecting the right people to display ads to, but would have to seek specific sites to advertise on. The world will be fine.
  - cameronbrown 7y ago
    This it could have the side effect of killing independent journalism startups. Big media is already too entrenched. These big newspaper websites do already sell ads directly too - DoubleClick can serve both Adsense (usually as a backup) as well as their own inventory.
    - Tronno 7y ago
      There are drawbacks to every option. Given the choice between a surveillance state and a propaganda state, I will always choose the latter - at least you get some agency over what media you consume and which statements you believe. Surveillance is forced on you, and invisibly at that.

nashashmi 7y ago

As for cookies against ad networks, I browse with all third party cookies blocked. Some cookies from third parties are allowed. So that would not be the effective against people with high security settings. And there is also the possibility of a brand new computer with no cookies. Then that kind of detection will not necessarily work for every one.

onion2k 7y ago
The owners of these websites don't care about false positives (like people on new computers). Their interest is in maximising the number of ads shown and nothing else.

auslander 7y ago

> .. Chrome browsing the web on your behalf, building up a bogus profile for the ad networks Chrome is an ad network itself, well, a biggest player. I'm browsing in default Private mode on Safari for years, so yes, my fight is over, no cookies for me, lol. And on always-on VPN.

microcolonel 7y ago

Maybe they should start randomly sharing adtech cookies through the cloud.

aeternus 7y ago
This is similar to what I'd like to see. Sharing cookies is somewhat dangerous since they could have login/user data, but it would totally work to avoid browser fingerprinting. With all the fingerprinting methods (screen resolution, GPU, HW, font-list, etc.) it's a losing proposition to attempt to remove all traces of a unique fingerprint. Instead I'd like to see a browser that generates such a noisy fingerprint that it is useless: Each time I start an 'anonymous' session, grab a fingerprint from a pool that is sufficiently similar to mine that things render properly (matching resolution for example) but that has also been used by thousands/millions of others.

elorant 7y ago

The fight can be won if you block 3rd party JavaScript. Just install uMatrix and enjoy browsing the web in half the time it takes without it. No ads, no trackers, no Facebook widgets, just the web we learn to love. Sanity.

rocky1138 7y ago
Do you know of any way through the about:config editor to do this? I'd hate to have to install yet another browser plugin.
- lstamour 7y ago
  It’s native in a number of browsers but quite hidden these days. Set your JS security settings to (ah I’m making this up as I don’t have the browser window in front of me) “Prompt” or “Allow (Per Site)” or “Blocked” - https://support.google.com/adsense/answer/12654?hl=en https://support.google.com/adsense/answer/12654?hl=en Then in browsers like Chrome, click the site icon, SSL icon, or little plugin icon in the address bar — some icon usually appears, which when clicked gives access to enable/disable blocked content for this site.
- propogandist 7y ago
  uMatrix is a must have add-on and nothing else comes close to matching its functionality. It pairs well with uBlock Origin (same dev). Add-ons like Decentraleyes is also good as it prevents persistent tracking from shared web libraries, like Google ajax, that everyone seems to use... it's free and widely available for a reason. Google is also working to update Chrome APIs that will cripple privacy centric add-ons and those that allow ad-blocking, like uMatrix and uBlock origin soon, so enjoy it all while it lasts.
  - chii 7y ago
    which is why you should switch to firefox asap.
  - hdfbdtbcdg 7y ago
    These addons work fine in Firefox.

dheera 7y ago

What is nytimes.com using now to detect incognito? Enabling filesystem in incognito used to work until a few days ago.

alacombe 7y ago
IIRC, the trick is to time filesystem access and deduce you're running from RAM rather than disk, thus in incognito mode.
- gruez 7y ago
  Sucks for you if you got ramdisk/optane, or have fsync disabled, I guess.
- dheera 7y ago
  Interesting, if that's what they're using it should be possible to inject a JavaScript to replace the filesystem access function with a wrapper that induces delay.
fourthark 7y ago
The article says they are using the quota trick.
- test344 7y ago
  Interesting on Firefox >https://www.bleepingcomputer.com/PoC/incognito-detection/incognito.html https://www.bleepingcomputer.com/PoC/incognito-detection/inc... = NO Incognito Menawhile on NYTimes = You’re in private mode.

oconnor663 7y ago

Sites don't want to bust the experience for brand new devices I think. That would include things like internet cafes where you log into a clean desktop environment, or browsers you use rarely like maybe one in your car. I think if Google can just get a real disk-backed implementation working for Incognito mode, such that there actually is no difference between Incognito and a new regular browser, this feature will be valuable.

cortesoft 7y ago
If they want to block incognito mode, wouldn't they also want to block someone from an Internet cafe? If the reason you block incognito mode is because you can't track the user, you don't want a user coming from an Internet cafe that you can't track.

na85 7y ago

I feel as though your argument is predicated on browsers that leak tracking data such as cookies, etc. If the browser vendors would tighten their products up and start considering things like profiling the user's installed fonts as a security vulnerability, then we might see some progress. Unfortunately Google has a financial incentive to make Chrome trackable to advertisers.

jolux 7y ago
Safari has already started introducing protections for attacks like font profiling and knowing the Chrome security team I would be surprised if they haven’t at least considered that as well.
IX-103 7y ago
Don't forget that the advertisers don't get income directly from tracking you. They get income based on how good they have a profile of your interests (and things that you would buy). If they can get a good enough profile without tracking then maybe they'll stop tracking. Or maybe it would be easier to block the few that continue taking than wave war on an entire industry.... There's already been some talk about changing things so that tracking is less necessary (https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/ https://webkit.org/blog/8943/privacy-preserving-ad-click-att...) and I wouldn't be surprised if a lot more comes out by the end of the year. Anyway, anyone that knows the details of the web could have seen this coming. [Private mode is not private](https://brave.com/private-mode-is-not-really-private/ https://brave.com/private-mode-is-not-really-private/). Websites can calculate fingerprints from users just by running JavaScript (they can easily get the processor speed, GPU version, local IP, and other details) so they can identify you even if you clear cookies. And the funny thing is that all of these APIs have reasonable intended uses and getting rid of them would large portions of content on the web.
- nyuszika7h 7y ago
  I think you accidentally a word
- na85 7y ago

0xADEADBEE 7y ago

In the same way that ublock is a must-have extension for many people, I won't browse without cookieAutoDelete [0]. Mostly I don't bother authenticating with websites anymore, and (I think about 3 maybe? And I just reauthenticate when I want to use those) and for mobile browsing I mostly use Firefox Focus [1]. The ad networks are down to browser fingerprinting now, which will be devastatingly accurate but realistically be the next frontier in the privacy war. I habitually roll IP addresses from different VPS service providers but I'm not sure there's much more an end user can do currently. Fascinated to see how this front will develop - if things like GDPR are coming into effect, then it's only a matter of time before a gratuitous misuse of data is closed in on, though I suspect it's too late for the current generation. [0] - https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... [1] - https://support.mozilla.org/en-US/kb/focus https://support.mozilla.org/en-US/kb/focus

kevin_thibedeau 7y ago
Random user agent to throw off the fingerprinting. Decentraleyes to defeat CDN tracking.
- artificial 7y ago
  Another fun one is viewport tracking.
JMTQp8lwXL 7y ago
The browser shouldn't be providing a User Agent anyways. No matter what device I use, my user agent should have no bearing on the HTML or JS I receive.

obese_by_nature 7y ago

> Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. Or Brave.

millstone 7y ago

The big idea here is that the web advertising economy is user-hostile, and has to go. Someone - Apple, Chrome extension, whatever - will go nuclear, and craft the AI ad blocker that will do to ads what Gmail did to spam. God willing.

gfosco 7y ago
I think the solution lies in a system that doesn't use HTTP. Been thinking about it for years.
- mesid 7y ago
  meaning?
- xyzal 7y ago
  Why? Would you please be more specific?

B-Con 7y ago

> All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. What's funny is that this is pretty much what ReCaptcha v3 is. Asking how "authentic" the Google cookie looks.

sgjohnson 7y ago

>If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. I don't, as I block all third party cookies. No exceptions.

m12k 7y ago
Interesting. Are there any legitimate uses for third party cookies (i.e. functionality that you as the user actually care about) or are they only ever used for tracking?
- 9HZZRfNlpR 7y ago
  For me fair amount of sites break where they have login authentication scattered around different domains.
- SmellyGeekBoy 7y ago
  As someone who also blocks third party cookies - Captchas. But nothing else important IME.

swebs 7y ago

I remember around 10 years ago people were calling Stallman paranoid for this. Now he seems more like a prophet: >I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it (using konqueror, which won't fetch from other sites in such a situation). https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html

shultays 7y ago
Well, that is a bit paranoid.
- mort96 7y ago
  It's not though? If your goal is to avoid having your every move online tracked by companies hoping to earn money from spying on you, what Stallman does is one of the few strategies which work.
  - shultays 7y ago
    You can take various actions to improve your privacy. At some point it becomes a paranoia. If you are fetching web pages on a remote server and email stuff to yourself then I would say it is becoming paranoia. And I would say what Stallman does probably gives him a very unique fingerprint (wget ting web pages from a unique server). I doubt he is doing that for privacy.
  - ludjer 7y ago
    Well the fact that he uses WGET on a remote server means that its a static ip in a DC most probably. Which means its allot easier to track him. Also considering the amount of pages i go through i would rather have no internet then have to wait for a email for ever page i want to use. Then also half the pages wont work because of no JS.

yummypaint 7y ago

That arms race is winnable because its a question of economics, not capability. As long as the cost of unmasking people remains higher than the expected profit from doing so, the fight is won.

imgabe 7y ago

Ultimately, if you block ads isn't the tracking useless? Sure, you can figure out the perfect ad to show me, but if I'm never going to see it, you're wasting your time.

NullPrefix 7y ago

>If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks This does not really work without 3rd party cookies, does it?

tinus_hn 7y ago

Yes, Google is committed to patching out anything used to detect incognito mode. If they make good on that promise detection will become harder and harder until it becomes practically impossible. Incognito mode can be made to look exactly as if you opened your browser after creating a new profile and immediately opening the site. As long as they can’t afford to block these users it can be made to work.

anticensor 7y ago
You can remove the as long out of the last sentence and it still makes sense.