16 ms·

Apple will soon treat online web tracking the same as a security vulnerability

539 points by praveenscience 7y ago

maxekman 7y ago
Great news, I’ll continue to use Safari as my main browser (have done so the last 10 years). I’m becoming more and more skeptical to Google, just a shame that GCP is such a nice cloud platform.
reilly3000 7y ago
This is kind of scary, especially with sparse details. I'm always having to turn off ad blockers to support site's basic functionality, like forms and even navigation if they rely on ajax requests. What functionality can I support on which versions of Safari? Can I ensure items that talk to my origin are never blocked? Since this is now a 'security' issue will its implementation be opaque?
- saagarjha 7y ago
  > Since this is now a 'security' issue will its implementation be opaque? Security by obscurity doesn't generally work. FWIW, here's what WebKit has to say about what it'll block: https://webkit.org/tracking-prevention-policy/ https://webkit.org/tracking-prevention-policy/. I hear that a specific list may also be released at some point.
  - reilly3000 7y ago
    Thanks for sharing. That is really helpful. I work with an enterprise publisher that has literally every item listed as an essential part of how it does business, from running programmatic ads to SSO and Google Analytics. The Unintended Impact and No Exceptions parts would mean a rework of that entire business for all of WebKit. That is true of most web publishers today. I cannot overstate what a vast impact this will have on web publishing. Maybe those things need to change. We want to move towards a member driven model and move away from ads, but in order to fund that transition ads need to continue running as the product is developed and user base grows. Even then, since we use Okta for SSO, that would also break or require a significant reimplementation to server-side auth, which could also break cache for authenticated users. We have a grand, beautiful plan for creating a publishing model that is trackerless except for a first party event logger that hashes all PII before it’s stored. We need data to operate, and some of it needs to come from the client. We would share client data with zero 3rd parties. For now our pages are a brothel of 3rd party scripts. We hate it, we can’t survive with our it, and forcing this change could force us and most web publishers today out of business. Below is a quote from the link above: >Unintended Impact There are practices on the web that we do not intend to disrupt, but which may be inadvertently affected because they rely on techniques that can also be used for tracking. We consider this to be unintended impact. These practices include: Funding websites using targeted or personalized advertising (see Private Click Measurement below). Measuring the effectiveness of advertising. Federated login using a third-party login provider. Single sign-on to multiple websites controlled by the same organization. Embedded media that uses the user’s identity to respect their preferences. “Like” buttons, federated comments, or other social widgets. Fraud prevention. Bot detection. Improving the security of client authentication. Analytics in the scope of a single website. Audience measurement.
jjtheblunt 7y ago
Good
gnicholas 7y ago
One thing I've experienced with Apple's tracker blocking is that the WSJ guest pass doesn't persist across sessions. It's supposed to last for 7 days (and does on Chrome), but on Safari I have to enter it fresh every time. I wonder: if the WSJ took steps to make their guest pass persist, would Apple view this as a security vulnerability?
- Betelgeuse90 7y ago
  I have a similar issue I think: I can't get YouTube to remember my Autoplay, Dark Mode and language settings at all, even though I'm logged in. EDIT: Maybe not 'not at all', but it's remembered for a very short while anyway.
  - majewsky 7y ago
    Even though you're logged in? This sounds like YouTube just being intentionally cruel to tracking-blocker users.
- sitharus 7y ago
  If the tracking is done by a site you directly visit, no. Only cross-site tracking, like Google do to build ad profiles, is targeted for blocking. I guess the next step for advertisers will be to enlist the websites themselves to send through more user data.
  - gnicholas 7y ago
    Huh, OK thanks for explaining. I think I actually understand why this was happening with the particular WSJ guest pass I was getting, and how it can be fixed. Thanks!
  - zaidf 7y ago
    I’ve been thinking that SaaS companies that provide JS code to embed could work around this by letting you attach a subdomain; so instead Of the js pointing to say adroll.com, it would point to ads.adrollcustomer.com (with dns set up to goto adroll.)
germinalphrase 7y ago
Online privacy for average people will never be a fair fight. Someone needs to draw tighter lines.
- bboygravity 7y ago
  Privacy for average people will never be a fair fight in limited democracies. The people need to demand a more direct democracy to be able to draw tighter lines. FTFY
  - Vige 7y ago
    Its funny when apple users talking about democracy, since apple product is less democracy and freedom
ianamartin 7y ago
I wonder if I can blitz Apple's newly revamped bug bounty program to make a boatload of money by reporting websites that track?
- saagarjha 7y ago
  That's not what the bug bounty program covers.
mirimir 7y ago
This seems like more good news from Apple. TFA is a little incoherent, however. > Publishers and companies rely heavily on online tracking — i.e. collecting (anonymized) data about a user’s activity on the web — to keep tabs on your every move as you hop from one site to the other. [emphasis added] > While this is typically used for targeted advertising, the implications go beyond just serving relevant ads in that it allows marketers to create detailed dossiers about your interests — resulting in significant loss of privacy. > This involves the use of cookies, tracking pixels, browser and device fingerprinting, and other adtech-based navigational tracking methods intended to amass browsing activities and build elaborate profiles of web users. None of that is at all "anonymized".
- luckylion 7y ago
  > None of that is at all "anonymized". It sounds like many people now use anonymized whenever there's no obvious personal identifier (name, email, social security number etc) in the data. Never mind that a thorough profile doesn't need one to identify individuals.
  - mirimir 7y ago
    Exactly. IP addresses are PII under GDPR, for example. And it's well known that many HIPPA-level "anonymized" datasets have been deanonymized.
whatshisface 7y ago
For a long time people have said that tracking will be an endless arms race between blockers and ads. You know what else is an endless arms race? Malware. However for many purposes the arms race has been "won" by companies like Apple: vulnerabilities exist, but they are not a major part of the daily life of Mac users. Apple provisionally won the malware arms race, maybe they can win against tracking too.
tannhaeuser 7y ago
I wonder if this will undo, in large parts, the "new" web that's being worked on for the better part of this millenium. Third-party cookies are blocked, presumably YouTube-like redirection to make cookies first-party are detected, other cookies are held no longer than a week, etc. So advertisers will turn to browser fingerprinting, so soon we'll see requesting window/viewport dimensions as being flagged as insecure. Even CSS media queries aren't safe as they can trivially be used for fingerprinting (and I have seen CSS where max-width was beeing queried in steps of 3 pixels out of sheer incompetence). Also caching/timing "attacks" for fingerprinting. And finally, arbitrary JavaScript execution will be questioned, as it should've been a long time ago. It'll be interesting to see this arms race enroll, with Apple protecting their users (and also their apps and iDevice market) and Google protecting their version of freedom (and unchecked privacy invasion and monopolization of the ad space and web). Hint: I've recently purchased an iPhone
- spockz 7y ago
  Although I share this dream I’m unsure whether Apple is pursuing the security and privacy of their users for intrinsic reasons or just to be not Google. Meaning that when they get all users and Google is gone that they can turn all the tracking they like.
  - Despegar 7y ago
    They're never going to "get all users" because you need Apple hardware. And unless they plan on selling $50 iPhones that's never going to happen.
    - spockz 7y ago
      Of course, I meant all users that care about privacy and security.
      - majewsky 7y ago
        Caring about privacy and security does not magically make you wealthy enough to afford Apple hardware.
onyva 7y ago
Isn’t it strange that an article that has a very specific title immediately changes the topic and starts promoting brave—a browser that practically nobody uses, and has a controversial business model—while there are companies like Mozilla, that have proven record of protecting users’ privacy online? It’s not the first time I’ve seen this aggressive, misleading, promotional articles, which makes you wonder about if Eich and friends are desperate to hype their Ware by injecting brave into this clickbait articles?
- tannhaeuser 7y ago
  Yes I've noticed it as well. But I don't want to give it airtime and lead us into offtopic discussions so I've downvoted you (sorry).
  - ryanlol 7y ago
    I know nobody comes here to read the articles, but I still feel that this is going a bit far.
- mosselman 7y ago
  I also noticed this. To be fair Mozilla is mentioned. I wonder what the motivation is, are they planning on building revenue through Brave’s reward program? Anyway, I wanted to give this more airtime so I upvoted you ;)
  - onyva 7y ago
    True. Though there’s nothing to suggest the a for profit like brave should be users’ first option in the fight for user privacy online... what’s their record? If anything this man in the middle concept is even worse because it creates an illusion of safety where there’s non. Sort of like Adblock and it’s symbiotic relationship with advertisers. They’re part of the same ecosystem and Mozilla is definitely not part of.
    - d0gbread 7y ago
      If you're looking for a record on something new you'll never see anything new.
orhmeh09 7y ago
According to this article, Goldman-Sachs is paying Apple a considerable amount for the privilege of facilitating Apple Card, expects to lose money for a while, but is confident it can make the deal profitable by employing brand-new technology. This suggests to me something highly intrusive. I cannot take Apple seriously on any privacy claims as they partner with GS and do things like develop iBeacon. https://9to5mac.com/2019/06/10/apple-card-goldman-comments/ https://9to5mac.com/2019/06/10/apple-card-goldman-comments/
- stock_toaster 7y ago
  They could be desiring data (even anonymized) to assist leading edge prediction of market trends (purchasing, interest, etc) immediately as they happen. In a world of algorithmic trading and futures speculation, perhaps that matters a great deal? It is goldman though after all, so you could be right!
  - fauigerzigerk 7y ago
    The customer segment served by the intersection of Apple and Goldman seems awfully narrow. I'm not sure there's much in it when it comes to gauging wider market trends.
    - mieseratte 7y ago
      > I'm not sure there's much in it when it comes to gauging wider market trends. It's not about Apple customers AND Goldman Sachs customers, it's about consumer trends. Having access to millions of purchases as they happen is useful unto itself when it comes to market trends. In this day and age effectively anyone can get HFT hardware / software, but having that pipe of data is a real moat that your average shop cannot compete with.
      - lotsofpulp 7y ago
        That info has been available for a long time already to anyone who is willing to pay for it: https://www.gsam.com/content/gsam/global/en/market-insights/gsam-insights/quantinomics/credit-card-data.html https://www.gsam.com/content/gsam/global/en/market-insights/... The card networks can even receive data of exactly what is purchased at what price with level 3 data: https://www.bluepay.com/payment-processing/gateway/level-3/ https://www.bluepay.com/payment-processing/gateway/level-3/ I know staples.com reports it because it shows you everything purchased on the AmEx statement, and hotel stays will have check in/check out dates.
rhaksw 7y ago
Has anyone seen this error [1] before? A user reported seeing it the other day and I can't figure out if it was an issue with Safari, his ISP, or what. It only happens for him when connected via WiFi on mobile. My SSL certs are auto-updating and I manually refreshed them, yet he still sees this a day later. Thanks in advance! [1] https://imgur.com/j63UaIR https://imgur.com/j63UaIR
- mopsi 7y ago
  Looks like DNS-level blocking from the WiFi gateway or ISP. When a blacklisted domain is requested, it gets IP pointing to the site with that notification, not the actual IP of the requested domain. This can be overridden by manually setting DNS servers on the phone or computer to non-filtering public DNS servers, eg. 1.1.1.1 or 8.8.8.8.
  - rhaksw 7y ago
    Thanks! I didn't know American ISPs would blacklist domains so easily. I'm also going to try contacting Comcast as I can't figure out what is "dangerous" about the site. It's just client-side javascript that queries content from reddit's API.
    - mopsi 7y ago
      It's probably blacklisted because it is only a single typo away from reddit.com. You can expect domains like revddit.com or hotnail.com to get blocked by anti-phishing filters.
      - rhaksw 7y ago
        I can prove that's not a typo people make, nobody visited the site for weeks when I first set it up =)
tjpnz 7y ago
They're essentially one and the same given how ad networks are being actively utilized as an attack vector.
Avamander 7y ago
In my opinion Firefox could take it one step further and build-in Ublock Origin into the browser. Give it extreme speed with native Rust code. Of course configurable but with a few malware lists enabled by default and a few trackers blocked. That'd make me definitely switch if I'd get faster ad-blocking and only lose HW accelerated video.
- woah 7y ago
  You’ve just described Brave
  - Avamander 7y ago
    Brave doesn't have enough of an userbase for any impact compared to say Firefox saying they're one-upping Apple. It also isn't mainstream enough that I'd trust it security wise, any steps behind me and vendor security patches is usually bad.
    - liquid9 7y ago
      I'd give it a try. I disabled the Rewards button and everything else that I don't like and it has been working great for me.
droithomme 7y ago
It's a reasonable perspective to treat it as a security issue because it is a security issue.
- perl4ever 7y ago
  What about offline tracking? I went to a big box store today, and after I got home, I got an email asking me to review my visit. Now, I'm sure that somewhere I ostensibly consented to any and every form of tracking, but it was startling to have my nose rubbed in the fact that every time I use my credit card and everywhere I carry my phone it is being tracked and linked to every available piece of information about me, which I'm sure is far more than I would like to be public. I don't fill out surveys anyway, but I was feeling particularly pissed, just because it should be socially unacceptable to behave like this, just because you think you can legally do it and nobody can stop you. So I flagged it as spam. Oh, and the chain store that did this has been in the news for data breaches, not long ago at all.
ErikAugust 7y ago
This article without JavaScript and other tracking: https://beta.trimread.com/articles/98 https://beta.trimread.com/articles/98
freehunter 7y ago
I supposed this doesn't bode well for the chances of getting AWS Cloud9 working properly on Safari, since it relies on some shifty third-party cookies to work properly.
envolt 7y ago
Guys, it might be possible that our people consider us an anti-privacy practicing company, given that we were listening to anonymized audios similar to what Google has/had been doing Marketing - Might be. Let's put up a banner about it in every corner Tech - Find the most sensitive/concerning topic, and let people debate.
spitfire 7y ago
We can just go all the way and call it counter-intelligence, with a significant component of sigint. OS developers and browsers will need to emit statistical noise to mask a users identity/activity. That will mean all emissions down to wifi packet levels. Expect significant restrictions of what javascript can do in the future (No more window.history, etc). There won't be the opportunity to lay back and say "This emission isn't trackable." very smart people at public and private intelligence agencies (Facebook, Google, GCHQ, Spetssvyaz, NSA) are working to find a way. You might not think FB or Google are evil. But we live in a cyberpunk world now, there are criminals who are learning to act more sophisticated. Eventually they'll get leverage over an employee at Google/FB/etc and the data they get access to will be used offensively. The current guys working in tech, tracking your every move are on the friendly end of the spectrum. They just want to sell you things, or get you hooked on e-cigarettes. EDIT: Also a note that iOS doesn't have any way to control app network access, I don't think Android does either. So there's another easy front.
- efreak 7y ago
  > EDIT: Also a note that iOS doesn't have any way to control app network access, I don't think Android does either. So there's another easy front. I don't know about Apple/iOS, however Android has plenty of third party local vpns that exist specifically to filter per-app internet access (No Root Firewall, NetGuard, etc), as well as iptables GUIs like AFWall+ for those who are rooted. Without installing a third party app, while you can't entirely prevent an app from going online, there's a toggle in app settings, "Background data: Enable usage of mobile data in the background", though I'm unsure of the exact effect this toggle has. With more technical knowledge, you can leave the Android platform and run a pihole or a privoxy. It should also be possible on Android to write a no-root vpn that switches between different proxies/profiles for various apps (ie, use squid/privoxy on browsers, use DNS proxies for native apps, whitelist as necessary). If you're rooted, you can also run your privoxy/pihole on the local device; I've had success with running a local dnsmasq, however it's far from battery friendly.
bluepnume 7y ago
The point where this becomes annoying is, when you're building a third party app or experience that is designed to be embedded in an iframe. Not a hidden iframe to track users, or for advertizing, but as a first-class experience, which can be embedded and displayed on a page on a different domain, and interacted with by users. I wish the latest round of privacy restrictions (which I think are overall a decent idea) would take these use cases into account, or at least allow a mechanism to request the user's permission to use third party cookies for sites they trust. Native apps have pretty robust permissioning systems. Why shouldn't websites? (For context, these are some of the things we use at PayPal to build embeddable cross-domain components: https://medium.com/@bluepnume/introducing-paypals-open-source-cross-domain-javascript-suite-95f991b2731d https://medium.com/@bluepnume/introducing-paypals-open-sourc...)
- hombre_fatal 7y ago
  > Native apps have pretty robust permissioning systems. They really don't, though. No better than websites. I was astounded when I first used Little Snitch and saw how often random apps were making network requests. For example, Translate Tab (a simple language translation app) sends every translation to Google Analytics. And you need a relatively sophisticated tool / expertise just to see this. It made me rethink the superiority of native apps since all this is so hidden. I prefer websites over native apps because I can run uBlock/uMatrix. Native apps can do whatever they want when it comes to tracking. People aren't even talking about it. Not only do native apps get off scot free, HN glamorizes them as superior with no questions asked.
  - bluepnume 7y ago
    That's a fair point. I wonder if 'make network calls' was ever considered as an app permission, or if it was just considered so ubiquitous that it would be granted by default. Or if there was any thought made around 'same domain' and 'cross domain' restrictions for apps.
- comex 7y ago
  > or at least allow a mechanism to request the user's permission to use third party cookies for sites they trust. Isn’t that what the Storage Access API is for?
xtat 7y ago
Apple: only we can track.

Great news, I’ll continue to use Safari as my main browser (have done so the last 10 years). I’m becoming more and more skeptical to Google, just a shame that GCP is such a nice cloud platform.

reilly3000 7y ago

This is kind of scary, especially with sparse details. I'm always having to turn off ad blockers to support site's basic functionality, like forms and even navigation if they rely on ajax requests. What functionality can I support on which versions of Safari? Can I ensure items that talk to my origin are never blocked? Since this is now a 'security' issue will its implementation be opaque?

saagarjha 7y ago
> Since this is now a 'security' issue will its implementation be opaque? Security by obscurity doesn't generally work. FWIW, here's what WebKit has to say about what it'll block: https://webkit.org/tracking-prevention-policy/ https://webkit.org/tracking-prevention-policy/. I hear that a specific list may also be released at some point.
- reilly3000 7y ago
  Thanks for sharing. That is really helpful. I work with an enterprise publisher that has literally every item listed as an essential part of how it does business, from running programmatic ads to SSO and Google Analytics. The Unintended Impact and No Exceptions parts would mean a rework of that entire business for all of WebKit. That is true of most web publishers today. I cannot overstate what a vast impact this will have on web publishing. Maybe those things need to change. We want to move towards a member driven model and move away from ads, but in order to fund that transition ads need to continue running as the product is developed and user base grows. Even then, since we use Okta for SSO, that would also break or require a significant reimplementation to server-side auth, which could also break cache for authenticated users. We have a grand, beautiful plan for creating a publishing model that is trackerless except for a first party event logger that hashes all PII before it’s stored. We need data to operate, and some of it needs to come from the client. We would share client data with zero 3rd parties. For now our pages are a brothel of 3rd party scripts. We hate it, we can’t survive with our it, and forcing this change could force us and most web publishers today out of business. Below is a quote from the link above: >Unintended Impact There are practices on the web that we do not intend to disrupt, but which may be inadvertently affected because they rely on techniques that can also be used for tracking. We consider this to be unintended impact. These practices include: Funding websites using targeted or personalized advertising (see Private Click Measurement below). Measuring the effectiveness of advertising. Federated login using a third-party login provider. Single sign-on to multiple websites controlled by the same organization. Embedded media that uses the user’s identity to respect their preferences. “Like” buttons, federated comments, or other social widgets. Fraud prevention. Bot detection. Improving the security of client authentication. Analytics in the scope of a single website. Audience measurement.

jjtheblunt 7y ago

Good

gnicholas 7y ago

One thing I've experienced with Apple's tracker blocking is that the WSJ guest pass doesn't persist across sessions. It's supposed to last for 7 days (and does on Chrome), but on Safari I have to enter it fresh every time. I wonder: if the WSJ took steps to make their guest pass persist, would Apple view this as a security vulnerability?

Betelgeuse90 7y ago
I have a similar issue I think: I can't get YouTube to remember my Autoplay, Dark Mode and language settings at all, even though I'm logged in. EDIT: Maybe not 'not at all', but it's remembered for a very short while anyway.
- majewsky 7y ago
  Even though you're logged in? This sounds like YouTube just being intentionally cruel to tracking-blocker users.
sitharus 7y ago
If the tracking is done by a site you directly visit, no. Only cross-site tracking, like Google do to build ad profiles, is targeted for blocking. I guess the next step for advertisers will be to enlist the websites themselves to send through more user data.
- gnicholas 7y ago
  Huh, OK thanks for explaining. I think I actually understand why this was happening with the particular WSJ guest pass I was getting, and how it can be fixed. Thanks!
- zaidf 7y ago
  I’ve been thinking that SaaS companies that provide JS code to embed could work around this by letting you attach a subdomain; so instead Of the js pointing to say adroll.com, it would point to ads.adrollcustomer.com (with dns set up to goto adroll.)

germinalphrase 7y ago

Online privacy for average people will never be a fair fight. Someone needs to draw tighter lines.

bboygravity 7y ago
Privacy for average people will never be a fair fight in limited democracies. The people need to demand a more direct democracy to be able to draw tighter lines. FTFY
- Vige 7y ago
  Its funny when apple users talking about democracy, since apple product is less democracy and freedom

ianamartin 7y ago

I wonder if I can blitz Apple's newly revamped bug bounty program to make a boatload of money by reporting websites that track?

saagarjha 7y ago
That's not what the bug bounty program covers.

mirimir 7y ago

This seems like more good news from Apple. TFA is a little incoherent, however. > Publishers and companies rely heavily on online tracking — i.e. collecting (anonymized) data about a user’s activity on the web — to keep tabs on your every move as you hop from one site to the other. [emphasis added] > While this is typically used for targeted advertising, the implications go beyond just serving relevant ads in that it allows marketers to create detailed dossiers about your interests — resulting in significant loss of privacy. > This involves the use of cookies, tracking pixels, browser and device fingerprinting, and other adtech-based navigational tracking methods intended to amass browsing activities and build elaborate profiles of web users. None of that is at all "anonymized".

luckylion 7y ago
> None of that is at all "anonymized". It sounds like many people now use anonymized whenever there's no obvious personal identifier (name, email, social security number etc) in the data. Never mind that a thorough profile doesn't need one to identify individuals.
- mirimir 7y ago
  Exactly. IP addresses are PII under GDPR, for example. And it's well known that many HIPPA-level "anonymized" datasets have been deanonymized.

whatshisface 7y ago

For a long time people have said that tracking will be an endless arms race between blockers and ads. You know what else is an endless arms race? Malware. However for many purposes the arms race has been "won" by companies like Apple: vulnerabilities exist, but they are not a major part of the daily life of Mac users. Apple provisionally won the malware arms race, maybe they can win against tracking too.

tannhaeuser 7y ago

I wonder if this will undo, in large parts, the "new" web that's being worked on for the better part of this millenium. Third-party cookies are blocked, presumably YouTube-like redirection to make cookies first-party are detected, other cookies are held no longer than a week, etc. So advertisers will turn to browser fingerprinting, so soon we'll see requesting window/viewport dimensions as being flagged as insecure. Even CSS media queries aren't safe as they can trivially be used for fingerprinting (and I have seen CSS where max-width was beeing queried in steps of 3 pixels out of sheer incompetence). Also caching/timing "attacks" for fingerprinting. And finally, arbitrary JavaScript execution will be questioned, as it should've been a long time ago. It'll be interesting to see this arms race enroll, with Apple protecting their users (and also their apps and iDevice market) and Google protecting their version of freedom (and unchecked privacy invasion and monopolization of the ad space and web). Hint: I've recently purchased an iPhone

spockz 7y ago
Although I share this dream I’m unsure whether Apple is pursuing the security and privacy of their users for intrinsic reasons or just to be not Google. Meaning that when they get all users and Google is gone that they can turn all the tracking they like.
- Despegar 7y ago
  They're never going to "get all users" because you need Apple hardware. And unless they plan on selling $50 iPhones that's never going to happen.
  - spockz 7y ago
    Of course, I meant all users that care about privacy and security.
    - majewsky 7y ago
      Caring about privacy and security does not magically make you wealthy enough to afford Apple hardware.

onyva 7y ago

Isn’t it strange that an article that has a very specific title immediately changes the topic and starts promoting brave—a browser that practically nobody uses, and has a controversial business model—while there are companies like Mozilla, that have proven record of protecting users’ privacy online? It’s not the first time I’ve seen this aggressive, misleading, promotional articles, which makes you wonder about if Eich and friends are desperate to hype their Ware by injecting brave into this clickbait articles?

tannhaeuser 7y ago
Yes I've noticed it as well. But I don't want to give it airtime and lead us into offtopic discussions so I've downvoted you (sorry).
- ryanlol 7y ago
  I know nobody comes here to read the articles, but I still feel that this is going a bit far.
mosselman 7y ago
I also noticed this. To be fair Mozilla is mentioned. I wonder what the motivation is, are they planning on building revenue through Brave’s reward program? Anyway, I wanted to give this more airtime so I upvoted you ;)
- onyva 7y ago
  True. Though there’s nothing to suggest the a for profit like brave should be users’ first option in the fight for user privacy online... what’s their record? If anything this man in the middle concept is even worse because it creates an illusion of safety where there’s non. Sort of like Adblock and it’s symbiotic relationship with advertisers. They’re part of the same ecosystem and Mozilla is definitely not part of.
  - d0gbread 7y ago
    If you're looking for a record on something new you'll never see anything new.

orhmeh09 7y ago

According to this article, Goldman-Sachs is paying Apple a considerable amount for the privilege of facilitating Apple Card, expects to lose money for a while, but is confident it can make the deal profitable by employing brand-new technology. This suggests to me something highly intrusive. I cannot take Apple seriously on any privacy claims as they partner with GS and do things like develop iBeacon. https://9to5mac.com/2019/06/10/apple-card-goldman-comments/ https://9to5mac.com/2019/06/10/apple-card-goldman-comments/

stock_toaster 7y ago
They could be desiring data (even anonymized) to assist leading edge prediction of market trends (purchasing, interest, etc) immediately as they happen. In a world of algorithmic trading and futures speculation, perhaps that matters a great deal? It is goldman though after all, so you could be right!
- fauigerzigerk 7y ago
  The customer segment served by the intersection of Apple and Goldman seems awfully narrow. I'm not sure there's much in it when it comes to gauging wider market trends.
  - mieseratte 7y ago
    > I'm not sure there's much in it when it comes to gauging wider market trends. It's not about Apple customers AND Goldman Sachs customers, it's about consumer trends. Having access to millions of purchases as they happen is useful unto itself when it comes to market trends. In this day and age effectively anyone can get HFT hardware / software, but having that pipe of data is a real moat that your average shop cannot compete with.
    - lotsofpulp 7y ago
      That info has been available for a long time already to anyone who is willing to pay for it: https://www.gsam.com/content/gsam/global/en/market-insights/gsam-insights/quantinomics/credit-card-data.html https://www.gsam.com/content/gsam/global/en/market-insights/... The card networks can even receive data of exactly what is purchased at what price with level 3 data: https://www.bluepay.com/payment-processing/gateway/level-3/ https://www.bluepay.com/payment-processing/gateway/level-3/ I know staples.com reports it because it shows you everything purchased on the AmEx statement, and hotel stays will have check in/check out dates.

rhaksw 7y ago

Has anyone seen this error [1] before? A user reported seeing it the other day and I can't figure out if it was an issue with Safari, his ISP, or what. It only happens for him when connected via WiFi on mobile. My SSL certs are auto-updating and I manually refreshed them, yet he still sees this a day later. Thanks in advance! [1] https://imgur.com/j63UaIR https://imgur.com/j63UaIR

mopsi 7y ago
Looks like DNS-level blocking from the WiFi gateway or ISP. When a blacklisted domain is requested, it gets IP pointing to the site with that notification, not the actual IP of the requested domain. This can be overridden by manually setting DNS servers on the phone or computer to non-filtering public DNS servers, eg. 1.1.1.1 or 8.8.8.8.
- rhaksw 7y ago
  Thanks! I didn't know American ISPs would blacklist domains so easily. I'm also going to try contacting Comcast as I can't figure out what is "dangerous" about the site. It's just client-side javascript that queries content from reddit's API.
  - mopsi 7y ago
    It's probably blacklisted because it is only a single typo away from reddit.com. You can expect domains like revddit.com or hotnail.com to get blocked by anti-phishing filters.
    - rhaksw 7y ago
      I can prove that's not a typo people make, nobody visited the site for weeks when I first set it up =)

tjpnz 7y ago

They're essentially one and the same given how ad networks are being actively utilized as an attack vector.

Avamander 7y ago

In my opinion Firefox could take it one step further and build-in Ublock Origin into the browser. Give it extreme speed with native Rust code. Of course configurable but with a few malware lists enabled by default and a few trackers blocked. That'd make me definitely switch if I'd get faster ad-blocking and only lose HW accelerated video.

woah 7y ago
You’ve just described Brave
- Avamander 7y ago
  Brave doesn't have enough of an userbase for any impact compared to say Firefox saying they're one-upping Apple. It also isn't mainstream enough that I'd trust it security wise, any steps behind me and vendor security patches is usually bad.
  - liquid9 7y ago
    I'd give it a try. I disabled the Rewards button and everything else that I don't like and it has been working great for me.

droithomme 7y ago

It's a reasonable perspective to treat it as a security issue because it is a security issue.

perl4ever 7y ago
What about offline tracking? I went to a big box store today, and after I got home, I got an email asking me to review my visit. Now, I'm sure that somewhere I ostensibly consented to any and every form of tracking, but it was startling to have my nose rubbed in the fact that every time I use my credit card and everywhere I carry my phone it is being tracked and linked to every available piece of information about me, which I'm sure is far more than I would like to be public. I don't fill out surveys anyway, but I was feeling particularly pissed, just because it should be socially unacceptable to behave like this, just because you think you can legally do it and nobody can stop you. So I flagged it as spam. Oh, and the chain store that did this has been in the news for data breaches, not long ago at all.

ErikAugust 7y ago

This article without JavaScript and other tracking: https://beta.trimread.com/articles/98 https://beta.trimread.com/articles/98

freehunter 7y ago

I supposed this doesn't bode well for the chances of getting AWS Cloud9 working properly on Safari, since it relies on some shifty third-party cookies to work properly.

envolt 7y ago

Guys, it might be possible that our people consider us an anti-privacy practicing company, given that we were listening to anonymized audios similar to what Google has/had been doing Marketing - Might be. Let's put up a banner about it in every corner Tech - Find the most sensitive/concerning topic, and let people debate.

spitfire 7y ago

We can just go all the way and call it counter-intelligence, with a significant component of sigint. OS developers and browsers will need to emit statistical noise to mask a users identity/activity. That will mean all emissions down to wifi packet levels. Expect significant restrictions of what javascript can do in the future (No more window.history, etc). There won't be the opportunity to lay back and say "This emission isn't trackable." very smart people at public and private intelligence agencies (Facebook, Google, GCHQ, Spetssvyaz, NSA) are working to find a way. You might not think FB or Google are evil. But we live in a cyberpunk world now, there are criminals who are learning to act more sophisticated. Eventually they'll get leverage over an employee at Google/FB/etc and the data they get access to will be used offensively. The current guys working in tech, tracking your every move are on the friendly end of the spectrum. They just want to sell you things, or get you hooked on e-cigarettes. EDIT: Also a note that iOS doesn't have any way to control app network access, I don't think Android does either. So there's another easy front.

efreak 7y ago
> EDIT: Also a note that iOS doesn't have any way to control app network access, I don't think Android does either. So there's another easy front. I don't know about Apple/iOS, however Android has plenty of third party local vpns that exist specifically to filter per-app internet access (No Root Firewall, NetGuard, etc), as well as iptables GUIs like AFWall+ for those who are rooted. Without installing a third party app, while you can't entirely prevent an app from going online, there's a toggle in app settings, "Background data: Enable usage of mobile data in the background", though I'm unsure of the exact effect this toggle has. With more technical knowledge, you can leave the Android platform and run a pihole or a privoxy. It should also be possible on Android to write a no-root vpn that switches between different proxies/profiles for various apps (ie, use squid/privoxy on browsers, use DNS proxies for native apps, whitelist as necessary). If you're rooted, you can also run your privoxy/pihole on the local device; I've had success with running a local dnsmasq, however it's far from battery friendly.

bluepnume 7y ago

The point where this becomes annoying is, when you're building a third party app or experience that is designed to be embedded in an iframe. Not a hidden iframe to track users, or for advertizing, but as a first-class experience, which can be embedded and displayed on a page on a different domain, and interacted with by users. I wish the latest round of privacy restrictions (which I think are overall a decent idea) would take these use cases into account, or at least allow a mechanism to request the user's permission to use third party cookies for sites they trust. Native apps have pretty robust permissioning systems. Why shouldn't websites? (For context, these are some of the things we use at PayPal to build embeddable cross-domain components: https://medium.com/@bluepnume/introducing-paypals-open-source-cross-domain-javascript-suite-95f991b2731d https://medium.com/@bluepnume/introducing-paypals-open-sourc...)

hombre_fatal 7y ago
> Native apps have pretty robust permissioning systems. They really don't, though. No better than websites. I was astounded when I first used Little Snitch and saw how often random apps were making network requests. For example, Translate Tab (a simple language translation app) sends every translation to Google Analytics. And you need a relatively sophisticated tool / expertise just to see this. It made me rethink the superiority of native apps since all this is so hidden. I prefer websites over native apps because I can run uBlock/uMatrix. Native apps can do whatever they want when it comes to tracking. People aren't even talking about it. Not only do native apps get off scot free, HN glamorizes them as superior with no questions asked.
- bluepnume 7y ago
  That's a fair point. I wonder if 'make network calls' was ever considered as an app permission, or if it was just considered so ubiquitous that it would be granted by default. Or if there was any thought made around 'same domain' and 'cross domain' restrictions for apps.
comex 7y ago
> or at least allow a mechanism to request the user's permission to use third party cookies for sites they trust. Isn’t that what the Storage Access API is for?

xtat 7y ago

Apple: only we can track.