8 ms·

I wonder if this will undo, in large parts, the "new" web that's being worked on for the better part of this millenium. Third-party cookies are blocked, presuma

I wonder if this will undo, in large parts, the "new" web that's being worked on for the better part of this millenium. Third-party cookies are blocked, presumably YouTube-like redirection to make cookies first-party are detected, other cookies are held no longer than a week, etc. So advertisers will turn to browser fingerprinting, so soon we'll see requesting window/viewport dimensions as being flagged as insecure. Even CSS media queries aren't safe as they can trivially be used for fingerprinting (and I have seen CSS where max-width was beeing queried in steps of 3 pixels out of sheer incompetence). Also caching/timing "attacks" for fingerprinting. And finally, arbitrary JavaScript execution will be questioned, as it should've been a long time ago. It'll be interesting to see this arms race enroll, with Apple protecting their users (and also their apps and iDevice market) and Google protecting their version of freedom (and unchecked privacy invasion and monopolization of the ad space and web). Hint: I've recently purchased an iPhone

spockz 7y ago
Although I share this dream I’m unsure whether Apple is pursuing the security and privacy of their users for intrinsic reasons or just to be not Google. Meaning that when they get all users and Google is gone that they can turn all the tracking they like.
- Despegar 7y ago
  They're never going to "get all users" because you need Apple hardware. And unless they plan on selling $50 iPhones that's never going to happen.
  - spockz 7y ago
    Of course, I meant all users that care about privacy and security.
    - majewsky 7y ago
      Caring about privacy and security does not magically make you wealthy enough to afford Apple hardware.
      - checktheorder 7y ago
        And even if one can afford Apple hardware, I'd bet on there being significant overlap between the "has keen interest in security" and "likes to fix own hardware" crowds. I could easily afford to have an all-Apple household. I don't, because I don't like Apple's attitude towards individuals fixing something rather than buying new.
      - asdjlkadsjklads 7y ago
        This feels pedantic and totally besides the point. The author was describing "gets all users" as in, gets all users that Apple can get. What's next, would you point out how people in the 3rd world wouldn't be buying Apple/Google phones either? The point was, when Apple has all of the market share they can expect to get, will they turn around and flip tracking on and etc. Please don't deviate topics for solely pedantic reasons. I generally love pedantic distinctions, but this i think added little to no value.
        mrec 7y ago
        I don't think it's pedantic at all. spockz's scenario was explicitly "they get all users and Google is gone" (my emphasis). That is, Apple would be able to re-enable tracking because at that point users would have nowhere else to go. The counter-arguments were that this would never happen because Apple's unlikely to deviate from the luxury pricing model that's worked so well for them. If Apple "gets all users that Apple can get" then turns tracking back on, while Android is still around with the same tracking but at a small fraction of the price, there's no reason for privacy-conscious users to stick with Apple.
        tim58 7y ago
        > there's no reason for privacy-conscious users to stick with Apple. There is a cost of switching platforms.
- sieabahlpark 7y ago
  Their goal has and always will be to get you into the Apple ecosystem where they have complete control over what you can do. Hope you never your Apple account revoked. Good luck recovering everything you've purchased. Oh and all the features of the ecosystem stop as well.
  - saagarjha 7y ago
    This is a separate issue and one inherent to every platform that encourages lock-in (which today unfortunately includes pretty much every major one).
    - sieabahlpark 7y ago
      I don't think they have it mastered as well as Apple does, you're locked out of OS updates, iOS updates, all entertainment, iMessage, etc. You essentially turn everything into a paperweight.
      - saagarjha 7y ago
        I think you can get updates without signing in to iCloud.
- specialist 7y ago
  Apple's revenue comes from end users. Google's revenue comes from advertisers. Attribute incentives and motivations accordingly.
- tannhaeuser 7y ago
  I'm completely with you. Cynical me says Apple is merely siding with privacy to make their walled garden attractive and protect iOS-exclusive content and apps. Actually, Apple's cancelled iAd program has already shown they're not above privacy invasion. But for now, Apple differentiating on privacy with plausible economic reasoning is a good enough guarantee for consumers I guess. In the end, only new legislation and tech (provable privacy, while also letting advertisers have their unique visitor stats, but no profiling) will overcome the demise of public media and monopolization of the web, and maybe bring back value and trust in online media. As for Google, it's a bit premature to worry about them ;) and they aren't stupid after all.
  - saagarjha 7y ago
    Rumor has it that iAd executives left because they felt that Apple wasn't allowing them to collect the data they wanted.
- tim58 7y ago
  > Meaning that when they get all users and Google is gone that they can turn all the tracking they like. I don't think we have to worry about that. Apple has a small (10-20%) portion of the global market. In many sub markets Apple is struggling against the competition. What we do have to worry about is digital privacy being unevenly distributed with people that have more money being able to afford more privacy.
  - zrm 7y ago
    > What we do have to worry about is digital privacy being unevenly distributed with people that have more money being able to afford more privacy. That's assuming it's only a matter of Apple vs. Google and there is nothing to be said about it by Mozilla or Purism or anyone else whose products don't require Apple money to use. And even if that turned out to be the case, it could sink the whole silly edifice anyway because advertisers want the customers with money. Tracking people who don't buy anything isn't nearly as valuable.
- ryandrake 7y ago
  Not a huge Apple fanboy here, but it should be acknowledged that Apple did an about face and started pushing on user privacy loooong before it was a competitive marketing checkbox vs. other tech companies. Locationgate happened what, 8 years ago?
  - karmakaze 7y ago
    While I agree with you in the history, I don't put trust in a corporation to necessarily keep doing the right thing when conditions change in the future.
    - alexis_fr 7y ago
      Neither would you trust a government, I’m sure?
rasz 7y ago
Dont forget things like tracking by ETag.
xg15 7y ago
Considering that the "new" web looks increasingly like a walk in the wrong direction, I'd honestly not be sorry.
GhostVII 7y ago
Hopefully we move towards a future where advertising is being targeted based on the location of the ad, rather than the person viewing it. If I am watching a car review, I have no problem watching an ad for a car (someone has to pay for the video), since that ad makes sense in that location. But I don't want ads for cars to follow me around the internet.
- broknbottle 7y ago
  Are you telling me that you don't like making small talk or having a quick friendly chat with somebody and than seeing ads for the service or product everywhere you turn for the next few days?
- jsjohnst 7y ago
  > If I am watching a car review, I have no problem watching an ad for a car (someone has to pay for the video), since that ad makes sense in that location. While I mostly agree, it is very annoying seeing the exact same car insurance or <insert random local budget car dealer> ad three times during a ten minute video on YouTube about a super car I was interested in.
  - MR4D 7y ago
    I don’t disagree, it watching the same ad for coke or Taco Bell during a TV add is the same thing. (side note - using TV as a high bar for the Internet would be...well, disappointing to say the least)
  - tripzilch 7y ago
    Yes but video ads are annoying no matter how you do them. It's because they get in your face and you have to wait for them, unlike picture ads. Nobody likes video ads, since the beginning of internet ads. They should just go the way of the popup-window.
- pixl97 7y ago
  That also has issues breaking on VPNs
danShumway 7y ago
> And finally, arbitrary JavaScript execution will be questioned, as it should've been a long time ago. I run UMatrix and manually whitelist 3rd-party scripts, I've blocked web features like WebGL and Canvas behind prompts, and I regularly disable JS on websites that I think don't need it (news sites in particular). At the moment, if you're really worried about tracking, it is a very good idea to think about blocking most Javascript and culling down the language features your browser supports. However, I want to stress at the moment. The problem is that pervasive tracking and device fingerprinting will go wherever the app functionality is. Currently, even with all of the many, many problems on the web, it's still better to use apps like Facebook via a website than it is to download them as native apps to your phone. The web has better fingerprinting resistance than most native platforms. Again, doesn't mean the web is great. It just means we need to think about where Google Maps is going to end up if it's not on the web. What I'm getting at is that blocking scripting isn't a long-term solution to fingerprinting in general. We could get rid of Javascript on the web, it might even be a good idea. We will still need to solve the same problem with native apps. Forget the web for a second, what it comes down to is that we need a way to run a turing complete language that is incapable of fingerprinting the host environment. That language doesn't have to be Javascript, and it doesn't have to be on the web, but it does have to be something, somewhere. It's a really hard problem -- vulnerabilities like Spectre and Meltdown have made it worse. Now we're asking questions like, "is it actually reasonable for applications to have access to high-resolution timers?" People look at the web and say, "oh, this is a web problem." It's an everything problem. If we really want to get rid of pervasive tracking, we now have to think about how high-resolution timers are going to work on desktops. What the web promised was a VM where anybody (technical or not) could run almost anything, without validating that the code was safe, and the VM would just protect them. We're finding holes in this particular implementation, but I still eventually want that VM as promised.
- hollerith 7y ago
  Thank you for your well-written comment. I don't want to deprive you of the VM as promised, but that seems very hard to implement, and I don't have time to help. I just want to solve the much easier problem of giving people some way to use the internet to read documents without getting tracked [1]. By "document" I mean a page of text, images, links to other documents and maybe some other easy-to-implement non-privacy-compromising things. The web is how almost all documents are made available on the public internet. Most document authors don't even consider or imagine any other way to do it. And the web is a privacy nightmare. That is the problem I'd like to solve. I felt the need to write this because past discussions on this site of the problem I want to solve have gotten derailed into a discussion of how finally to achieve the vision of "a VM where anybody (technical or not) could run almost anything", which, like I said, strikes me as a much harder nut to crack. [1]: and without the need for anything as demanding of the user's time or the user's technical skills as you described when you wrote, "I run UMatrix and manually whitelist 3rd-party scripts, I've blocked web features like WebGL and Canvas behind prompts".
6gvONxR4sf7o 7y ago
One solution to an arms race is labelling bad actors. If site XYZ keeps trying to find a workaround, maybe there's a way to label them as such to the consumers?
- youareostriches 7y ago
  This is already the solution that Apple takes using their app store review process.
- saagarjha 7y ago
  Labelling bad actors is a fundamentally abusable process from both sides: those doing the labelling have a massive amount of control, and those being labelled are in a constant arms race to fix their image via something that isn't currently labelled as "bad". Consider if Apple blocked Facebook from their browser today: Apple would very likely (and probably rightly) be called a monopolist, while Facebook would probably reincorporate under TotallyNotFacebook or something similar or seek to find another loophole in the labelling process.

spockz 7y ago

Although I share this dream I’m unsure whether Apple is pursuing the security and privacy of their users for intrinsic reasons or just to be not Google. Meaning that when they get all users and Google is gone that they can turn all the tracking they like.

Despegar 7y ago
They're never going to "get all users" because you need Apple hardware. And unless they plan on selling $50 iPhones that's never going to happen.
- spockz 7y ago
  Of course, I meant all users that care about privacy and security.
  - majewsky 7y ago
    Caring about privacy and security does not magically make you wealthy enough to afford Apple hardware.
    - checktheorder 7y ago
      And even if one can afford Apple hardware, I'd bet on there being significant overlap between the "has keen interest in security" and "likes to fix own hardware" crowds. I could easily afford to have an all-Apple household. I don't, because I don't like Apple's attitude towards individuals fixing something rather than buying new.
    - asdjlkadsjklads 7y ago
      This feels pedantic and totally besides the point. The author was describing "gets all users" as in, gets all users that Apple can get. What's next, would you point out how people in the 3rd world wouldn't be buying Apple/Google phones either? The point was, when Apple has all of the market share they can expect to get, will they turn around and flip tracking on and etc. Please don't deviate topics for solely pedantic reasons. I generally love pedantic distinctions, but this i think added little to no value.
      - mrec 7y ago
        I don't think it's pedantic at all. spockz's scenario was explicitly "they get all users and Google is gone" (my emphasis). That is, Apple would be able to re-enable tracking because at that point users would have nowhere else to go. The counter-arguments were that this would never happen because Apple's unlikely to deviate from the luxury pricing model that's worked so well for them. If Apple "gets all users that Apple can get" then turns tracking back on, while Android is still around with the same tracking but at a small fraction of the price, there's no reason for privacy-conscious users to stick with Apple.
        tim58 7y ago
        > there's no reason for privacy-conscious users to stick with Apple. There is a cost of switching platforms.
sieabahlpark 7y ago
Their goal has and always will be to get you into the Apple ecosystem where they have complete control over what you can do. Hope you never your Apple account revoked. Good luck recovering everything you've purchased. Oh and all the features of the ecosystem stop as well.
- saagarjha 7y ago
  This is a separate issue and one inherent to every platform that encourages lock-in (which today unfortunately includes pretty much every major one).
  - sieabahlpark 7y ago
    I don't think they have it mastered as well as Apple does, you're locked out of OS updates, iOS updates, all entertainment, iMessage, etc. You essentially turn everything into a paperweight.
    - saagarjha 7y ago
      I think you can get updates without signing in to iCloud.
specialist 7y ago
Apple's revenue comes from end users. Google's revenue comes from advertisers. Attribute incentives and motivations accordingly.
tannhaeuser 7y ago
I'm completely with you. Cynical me says Apple is merely siding with privacy to make their walled garden attractive and protect iOS-exclusive content and apps. Actually, Apple's cancelled iAd program has already shown they're not above privacy invasion. But for now, Apple differentiating on privacy with plausible economic reasoning is a good enough guarantee for consumers I guess. In the end, only new legislation and tech (provable privacy, while also letting advertisers have their unique visitor stats, but no profiling) will overcome the demise of public media and monopolization of the web, and maybe bring back value and trust in online media. As for Google, it's a bit premature to worry about them ;) and they aren't stupid after all.
- saagarjha 7y ago
  Rumor has it that iAd executives left because they felt that Apple wasn't allowing them to collect the data they wanted.
tim58 7y ago
> Meaning that when they get all users and Google is gone that they can turn all the tracking they like. I don't think we have to worry about that. Apple has a small (10-20%) portion of the global market. In many sub markets Apple is struggling against the competition. What we do have to worry about is digital privacy being unevenly distributed with people that have more money being able to afford more privacy.
- zrm 7y ago
  > What we do have to worry about is digital privacy being unevenly distributed with people that have more money being able to afford more privacy. That's assuming it's only a matter of Apple vs. Google and there is nothing to be said about it by Mozilla or Purism or anyone else whose products don't require Apple money to use. And even if that turned out to be the case, it could sink the whole silly edifice anyway because advertisers want the customers with money. Tracking people who don't buy anything isn't nearly as valuable.
ryandrake 7y ago
Not a huge Apple fanboy here, but it should be acknowledged that Apple did an about face and started pushing on user privacy loooong before it was a competitive marketing checkbox vs. other tech companies. Locationgate happened what, 8 years ago?
- karmakaze 7y ago
  While I agree with you in the history, I don't put trust in a corporation to necessarily keep doing the right thing when conditions change in the future.
  - alexis_fr 7y ago
    Neither would you trust a government, I’m sure?

rasz 7y ago

Dont forget things like tracking by ETag.

xg15 7y ago

Considering that the "new" web looks increasingly like a walk in the wrong direction, I'd honestly not be sorry.

GhostVII 7y ago

Hopefully we move towards a future where advertising is being targeted based on the location of the ad, rather than the person viewing it. If I am watching a car review, I have no problem watching an ad for a car (someone has to pay for the video), since that ad makes sense in that location. But I don't want ads for cars to follow me around the internet.

broknbottle 7y ago
Are you telling me that you don't like making small talk or having a quick friendly chat with somebody and than seeing ads for the service or product everywhere you turn for the next few days?
jsjohnst 7y ago
> If I am watching a car review, I have no problem watching an ad for a car (someone has to pay for the video), since that ad makes sense in that location. While I mostly agree, it is very annoying seeing the exact same car insurance or <insert random local budget car dealer> ad three times during a ten minute video on YouTube about a super car I was interested in.
- MR4D 7y ago
  I don’t disagree, it watching the same ad for coke or Taco Bell during a TV add is the same thing. (side note - using TV as a high bar for the Internet would be...well, disappointing to say the least)
- tripzilch 7y ago
  Yes but video ads are annoying no matter how you do them. It's because they get in your face and you have to wait for them, unlike picture ads. Nobody likes video ads, since the beginning of internet ads. They should just go the way of the popup-window.
pixl97 7y ago
That also has issues breaking on VPNs

danShumway 7y ago

> And finally, arbitrary JavaScript execution will be questioned, as it should've been a long time ago. I run UMatrix and manually whitelist 3rd-party scripts, I've blocked web features like WebGL and Canvas behind prompts, and I regularly disable JS on websites that I think don't need it (news sites in particular). At the moment, if you're really worried about tracking, it is a very good idea to think about blocking most Javascript and culling down the language features your browser supports. However, I want to stress at the moment. The problem is that pervasive tracking and device fingerprinting will go wherever the app functionality is. Currently, even with all of the many, many problems on the web, it's still better to use apps like Facebook via a website than it is to download them as native apps to your phone. The web has better fingerprinting resistance than most native platforms. Again, doesn't mean the web is great. It just means we need to think about where Google Maps is going to end up if it's not on the web. What I'm getting at is that blocking scripting isn't a long-term solution to fingerprinting in general. We could get rid of Javascript on the web, it might even be a good idea. We will still need to solve the same problem with native apps. Forget the web for a second, what it comes down to is that we need a way to run a turing complete language that is incapable of fingerprinting the host environment. That language doesn't have to be Javascript, and it doesn't have to be on the web, but it does have to be something, somewhere. It's a really hard problem -- vulnerabilities like Spectre and Meltdown have made it worse. Now we're asking questions like, "is it actually reasonable for applications to have access to high-resolution timers?" People look at the web and say, "oh, this is a web problem." It's an everything problem. If we really want to get rid of pervasive tracking, we now have to think about how high-resolution timers are going to work on desktops. What the web promised was a VM where anybody (technical or not) could run almost anything, without validating that the code was safe, and the VM would just protect them. We're finding holes in this particular implementation, but I still eventually want that VM as promised.

hollerith 7y ago
Thank you for your well-written comment. I don't want to deprive you of the VM as promised, but that seems very hard to implement, and I don't have time to help. I just want to solve the much easier problem of giving people some way to use the internet to read documents without getting tracked [1]. By "document" I mean a page of text, images, links to other documents and maybe some other easy-to-implement non-privacy-compromising things. The web is how almost all documents are made available on the public internet. Most document authors don't even consider or imagine any other way to do it. And the web is a privacy nightmare. That is the problem I'd like to solve. I felt the need to write this because past discussions on this site of the problem I want to solve have gotten derailed into a discussion of how finally to achieve the vision of "a VM where anybody (technical or not) could run almost anything", which, like I said, strikes me as a much harder nut to crack. [1]: and without the need for anything as demanding of the user's time or the user's technical skills as you described when you wrote, "I run UMatrix and manually whitelist 3rd-party scripts, I've blocked web features like WebGL and Canvas behind prompts".

6gvONxR4sf7o 7y ago

One solution to an arms race is labelling bad actors. If site XYZ keeps trying to find a workaround, maybe there's a way to label them as such to the consumers?

youareostriches 7y ago
This is already the solution that Apple takes using their app store review process.
saagarjha 7y ago
Labelling bad actors is a fundamentally abusable process from both sides: those doing the labelling have a massive amount of control, and those being labelled are in a constant arms race to fix their image via something that isn't currently labelled as "bad". Consider if Apple blocked Facebook from their browser today: Apple would very likely (and probably rightly) be called a monopolist, while Facebook would probably reincorporate under TotallyNotFacebook or something similar or seek to find another loophole in the labelling process.