7 ms·

Ask HN: How prevalent is non-cookie-based web tracking today?

140 points by ryeguy_24 7y ago

I just started reading about things like Header Enhancement and SuperCookies and find them to be quite egregious. Does anyone know how much of this activity is being used by big known companies? For example, I just found out that my account settings at Verizon Wireless were allowing them to use Header Enhancement (UIDH) adding a unique identifier on every http request I sent. So, if I log in to a site, they can associate the UIDH with my account so next time I’m in browser incognito mode, they already know who I am (or have a good guess).

air7 7y ago
I can't provide stats on your questions, but as per your example, your ISP can only add headers to non SSL traffic. Any website you access with HTTPS is safe from this type of privacy violation. So as "Encrypted web traffic now exceeds 90%" [0] I'd guess at least this type of tracking is gone. [0] https://news.ycombinator.com/item?id=21421195 https://news.ycombinator.com/item?id=21421195
lucb1e 7y ago
You give a USA specific example, so I'll give one from where I live: aside from a few (like Google, Facebook, LinkedIn) that I suspect do things like recommendations or friend suggestions based on our static IP address, in the Netherlands it's virtually nonexistent. And illegal, at least without telling us that they do tracking (no matter if it's through cookies, the law never even mentions cookie). Header injection (MITMing traffic) is something I only hear about from far away and seems very invasive to me. Same in Germany, but there they have rotating IP addresses (which is both a pain (hosting) and a blessing (privacy)). Hmm, although, would MAC address tracking count? That happens here and there (by roughly the same amount in any EU country, as far I can tell, which is not very much), mostly with WiFi captive portals where you sign away your soul in the terms of service. I'm not sure about the legality (hiding GDPR consent in the TOS) but it happens. From experience, I can say that if you find out and you send them a letter with a copy of your ID, they'll happily give you all the data they have on any MAC address you claim.
- Left4Yee 7y ago
  I caught Vodafone and Telekom in Germany injecting headers. The former for shady cooperations and tracking, the latter for cache screwery. The latter did dns modification to turn nxdomain into a navigation help, a site that looks like google but everything is ads. Vodafone CPE equipment saves all mac adresses ever present in the local network and unassociated wifi client macs in the air and sends them back as part of diagnostic data. Edit: They also DNS Censor popular warez sites and libgen
  - dvfjsdhgfv 7y ago
    > They also DNS Censor popular warez sites and libgen This happens in some other European countries, too, like Italy.
- rocqua 7y ago
  Regarding MAC tracking, I found a sticker in Centraal Station Utrecht that said 'wifi tracking' with 'voor meer informatie: www.ns.nl/privacy' Edit: the relevant privacy page is: https://www.ns.nl/privacy/op-en-rondom-het-station.html https://www.ns.nl/privacy/op-en-rondom-het-station.html which also has an image of the sticker I saw.
- newscracker 7y ago
  Apple’s operating systems have been randomizing MAC addresses since late 2014 (or before). So the MAC address has not been a unique device identifier for users of Apple devices.
  - lucb1e 7y ago
    Don't they use the same MAC for the same network? So when it reconnects to the same network, doesn't it adopt the same MAC as before? Otherwise one could not give a device a static IP in DHCP. I'm not sure but I think I remember reading this. And it would mean that hotspot tracking (the most prevalent form as far as I've noticed) still works.
soumyadeb 7y ago
I would think Header Enhancement is not widely used (only few ISPs or so use it) but Browser fingerprinting must be quite wide-spread. It is hard to detect from the client-side so hard to say how wide-spread is it Here is a study of fingerprinting effectiveness. Not what you wanted but a worthwhile read. https://medium.com/slido-dev-blog/we-collected-500-000-browser-fingerprints-here-is-what-we-found-82c319464dc9 https://medium.com/slido-dev-blog/we-collected-500-000-brows...
- ryeguy_24 7y ago
  So, how does browser fingerprinting work. Does it basically look at the 1) IP and 2) Browser Agent pair for near uniqueness?
  - soumyadeb 7y ago
    Lots of things from browser settings to what plugins you have. These guys will tell you how unique is your browser fingerprint https://amiunique.org/fp https://amiunique.org/fp
    - sm4rk0 7y ago
      This should be mentioned here, too https://panopticlick.eff.org/ https://panopticlick.eff.org/
  - simpss 7y ago
    fingerprintjs readme does a good job of explaining it: https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2
- mylons 7y ago
  you can spoof a browser pretty easily in the request. you can tell the server you are w/e you want the server to think you are.
- tinus_hn 7y ago
  These days over 90% of traffic is encrypted so the amount of requests they can touch is pretty limited.
Left4Yee 7y ago
Google Captcha only works if webgl canvas is available. If its not available they give me infinite captchas and never let me through.
dharmab 7y ago
I don't want to go into much detail, but I work for a major company in this space and nost companies in the industry can track you with reasonable success even if you are logged out over multiple devices. Your (approximate) location, browsing habits and patterns are good enough data to predict what kind of stuff you buy. If you want to not be tracked, turn off JavaScript for a start.
- Left4Yee 7y ago
  Turning off js in turn locks you out of normieweb completely. Google captchas dont work, fat sites break...
  - mylons 7y ago
    it is how almost all of the data collection happens though
  - cameronbrown 7y ago
    I've solved Google CAPTCHAs without JS, so I don't think it's a requirement.
    - pmoriarty 7y ago
      Really? Could you go in to detail on how you did this? I thought JS was an absolute requirement for them.
      - tempguy9999 7y ago
        HN had a google captcha it subjected me to for a while. It did not need JS[0] At the same time I have come across captchas that do need JS. I guess google offers both. [0] if it had, I would have stopped posting here as I never accept browser JS outside of a VM.
      - cameronbrown 7y ago
        Whenever I've solved them without JS, it reverts to standard HTML forms. Since it's in an iframe, when you click submit it doesn't reload the whole page, only the frame. When you've been validated it gives you a code which you can copy and paste into the host site. Note, I've only seen this on Cloudflare pages so far. Disclaimer: I work for Google, but not on reCAPTCHA.
soared 7y ago
Excellent reading for anyone interested the subject from a technical and business/enterprise point of view. This gets rid of the FUD 'browser fingerprinting' and uses actual industry terms. https://blogs.gartner.com/martin-kihn/how-cross-device-identity-matching-works-part-1/ https://blogs.gartner.com/martin-kihn/how-cross-device-ident... https://blogs.gartner.com/martin-kihn/how-cross-device-identity-matching-works-part-2/ https://blogs.gartner.com/martin-kihn/how-cross-device-ident...
- soumyadeb 7y ago
  This is mostly talking about creating a probabilistic ID graph - creating a unique ID across devices. This is technically not same as browser-fingerprinting. Latter is much simpler
  - soared 7y ago
    Yeah that is kind of the point I wanted to get across. Fingerprinting isn't some major secret that big tech is using.. its a small tactic used by some companies that gets more attention than it really deserves. There is a section in part 2 specifically about fingerprinting under the subtitle "DENTIFYING A DEVICE WITHOUT AN ID". Browser fingerprinting is a single piece in creating an id graph. Fingerprinting would be 100% useless without a graph, unless you're doing it to individuals which would be NSA-level acting.
soared 7y ago
The most common non-cookie based tracking are cross-device graphs that are registration based (reg based) and run by facebook/google/linkedin/pinterest/etc. If you've ever logged in to facebook (or haven't logged in) and a site has a fb pixel or share button, its much easier for them to track you. These all have cookie/nonreg-based components, and there are plenty that don't rely on reg based data at all.
joyjoyjoy 7y ago
Use browser plug ins * ublock origin * no script * cookie auto delete plug in, deletes cookies if tab is closed * (I use also I don't care about cookies for the EU cookies clusterfuck) * Canvas blocker * Privacy badger * Glyph detection blocker * Decentral eyes * Privacy settings * Privacy-Oriented Origin Policy * WebRTC leak protection * https everywhere * I have a browser spoofing plug-in too but don't think it works so well. Use VPN use different browsers for different purposes. use startpage.com instead of google Here, try your luck: https://amiunique.org/ https://amiunique.org/ https://panopticlick.eff.org https://panopticlick.eff.org Does not work so well. Instead of preventing canvas, fonts, browser ID etc., the plug-ins should randomize it.
- rapnie 7y ago
  You may want to re-evaluate your use of startpage.com: https://news.ycombinator.com/item?id=21371577 https://news.ycombinator.com/item?id=21371577
  - jplayer01 7y ago
    It seems really concerning that Startpage is still recommended on privacytools.io. Instead the forum post discussing the delisting is hung up on getting a statement from the new CEO and giving them a chance, which seems insane to me. Either being owned by an advertising company is a problem for all privacy-focused services or it isn’t a problem for any of them. In which case they might as well redo the entire site. I don’t see why this CEOs word would be worth any more than nothing nor why he should be treated any differently from the owners or CEOs of other questionable businesses/services/addons/programs/etc. This questionable judgment on their part seriously puts their reputation at risk in my eyes.
- ignoramous 7y ago
  Relevant discussion from not that long ago: https://news.ycombinator.com/item?id=20783339 https://news.ycombinator.com/item?id=20783339
- cartoonworld 7y ago
  Are you aware of any way to bundle setting for Firefox (or whatever) that include these kinds of changes? I know you can export the about:config and share that, but I have always wanted a kind of ansible for setting up a browser with plugins and other changes for my personal use. Additionally, If I could tell my friends and family: Hey just use my Firefox Playbook and feel safe on the internet, thereby reducing the cognitive load of figuring out how to do that, I'd probably have a lot more success helping curious but busy people take control of their privacy.
ignoramous 7y ago
Apart from the usual canvas / webrtc in-browser shenanigans, the most surprising one that I found was using a dns cookie to track users across browsers and devices discovered/invented/disclosed by u/DanielDent: https://news.ycombinator.com/item?id=20219878 https://news.ycombinator.com/item?id=20219878 > As with traditional HTTP cookies, DNS cookies can be used to track users on the web. They have no concept of "first party" or "third party" and can be read across different websites or from a different browser. They can also be used outside the web environment, for instance to track a web conversion which occurs after reading an email but not clicking on a link, or to track a sign-up in a mobile application after viewing a website. They also have application in DDoS mitigation - especially on IPv6 networks. I am curious what other techniques are in active use to track a user across devices / software...
- pygy_ 7y ago
  DNS cookies are nasty. The POC tracks you between normal and private tabs, even with the Tor browser.
mirimir 7y ago
Trying to circumvent tracking at the browser level is hopeless. The only effective approaches that I know of are 1) using Whonix (best in Qubes) to connect via Tor; and 2) using multiple OS-level VMs that connect via different nested VPN chains. And even then, there are risks from fingerprints that depend on GPU and virtual graphics drivers in VMs. So when compartmentalization really matters, it's necessary to use different host machines, on different LANs (or at least vLANs). Using Tor is rather painful, given all the CAPTCHAs. And the learning curve for Qubes is a little steep. But using multiple VMs with different nested VPN chains is actually quite convenient, once you've set it up. I use a pfSense VM as the gateway router for each VPN service. So creating nested VPN chains is easy: You just create virtual networks of the pfSense VMs, with Linux workspace VMs wherever you like. With a decent host machine, I can work ~seamlessly as a few low-isolation personas via nested VPN chains, and another few high-isolation personas via nested VPN chains and Whonix instances.
- bo1024 7y ago
  Not sure about the priorities here. Fingerprinting should be the main concern, so steps 1,2,3 are obscuring IP address and disabling cookies and JavaScript. Even beyond that, not sure how chaining VMs etc helps much more than a single VPN. Although an ideal solution would spin up a random VM, browser, screen size, and tor connection for each new web page visited...
  - mirimir 7y ago
    > an ideal solution would spin up a random VM, browser, screen size, and tor connection for each new web page visited... Sure. I wouldn't limit it to Tor, though. Because there are just too many CAPTCHAs. That's much less of an issue using VPNs. Chaining VPNs is arguably overkill for avoiding fingerprinting. Still, trusting a single VPN service is risky. If they were complicit, you'd still be tracked. But if you at least chain two VPN services, there's less risk. Overall risk is more or less the product of all the individual risks, if they're independent. Edit: If exploit resistance is less of an issue, it's easy to chain VPNs at the Linux OS level using ip route and iptables. Iptables rules drop everything on enp0s3 except traffic to the first VPN server, and drop everything on tun0 except traffic to the second VPN server. You set enp0s3 as the route for the first VPN server. After connecting to it, you set tun0 as the route for the second VPN server. After connecting to it, you check for leaks using tcpdump.
oil25 7y ago
By far the biggest tracking offender is Javascript. Enabling it could reveal your operating system, cpu/gpu architecture, screen resolution, draw a precise and unique canvas fingerprint, etc. There are also mutable browser headers like user-agent and of course your IP address. However, the more advanced and insidious tracking is based on your behavior - what time you're active, what wifi networks are in range, who you communicate with, what is your writing style, and so on. Most of that collection happens on mobile phones, so I strongly advise against signing in on Android/iOS devices if you don't want to be tracked across the Web and beyond, or using telemetry-free open source mobile operating systems altogether.
- deleted 7y ago
  [deleted]
Cactus2018 7y ago
FYI about these two websites that demonstrate the various data your browser shares: https://browserleaks.com/ https://browserleaks.com/ https://webkay.robinlinus.com/ https://webkay.robinlinus.com/
fonosip 7y ago
Here's an option for adblock + vpn. https://ba.net/adblockvpn https://ba.net/adblockvpn

pavel_lishin 7y ago

> good enough data to predict what kind of stuff you buy. Then why are the ads that _do_ sneak through my adblockers or onto Instagram, etc., such hot, moist garbage? Is it just a lack of people wanting to advertise at my demographic?

soumyadeb 7y ago
Ad re-targeting (showing products you browsed) is generally cookie based I would think and adblockers block that. Anything other than re-targeting is anyway too broad and generally crap for me - even on Facebook which knows a lot I would think. Other data vendors are totally crap. You can check your BlueKai profile here https://datacloudoptout.oracle.com/registry/ https://datacloudoptout.oracle.com/registry/
Joe8Bit 7y ago
Several reasons: Many large, higher quality ad buyers (agencies and direct sold) can get enough return from non-greyarea inventory like this. There's no point in them taking (even a small) perceived risk of buying this grey market inventory. However, they likely do use this tracking data second or third hand via their third party data providers brokering and including it in larger data sets they use for cross site targeting via DMPs. Finally, there's simple economics: people who go through enough effort to block trackers and other things are (perceived) to be less likely to engage with ads (e.g. they see it as you do, when one 'slips through'). So there's no point in paying $$$ for those eyeballs. All of this in combination means you get low quality, barrel bottoms ads.
- alexbanks 7y ago
  People forget (or just never knew) that tracking and ad-serving isn't necessarily about giving every screenviewer the best possible ads you can all the time. Inventory and return on ad spend are both big factors in determining where to spend. The tracking enables ad placement companies to know that even with the best possible ad (which cost inventory to place), specific users just will not engage. And if that's true, why spend that ad on that person?
  - Joe8Bit 7y ago
    There’s a whole chain of companies who have financial incentives to maximise spend through their platforms. They’ll place creatives in ad units with impressions they know are low quality based on needing to fulfil fill rates and volume. It’s pretty shitty and unethical, but welcome to to add tech!
checkyoursudo 7y ago
I have been suspicious for a while that all of these companies that claim to know everything about us, or people who are afraid that these companies know everything about us, are wrong. I don't feel like I am unusual in any way, as in I can't see how I have any natural, dumb-luck defense against any of this tracking. If companies like Google, Amazon, FB, etc, are in any way really trying to use what they think they know about me to get me to buy stuff or influence my thoughts or behaviour, then they seem to be doing a really, really bad job of it. As far as privacy goes, my concern is far more focused on apps/programs stealing my photos of my kids, or tracking me around town, or knowing who I meet and talk to. As far as predicting my future behaviour, I have not been impressed so far.
itronitron 7y ago
> good enough data to predict what kind of stuff you buy. the only time these are ever close is when they are based on users' previous search terms
madenine 7y ago
probably. Also - lazy ad buys. There's human effort involved in planning a micro targeting campaign. Way easier (and short-term cheaper) to do some broad strokes ads with a couple ok-ish proxies for your target market than pay people that know what they're doing. So your conversion rates are garbage and CAC higher than it could be, but your spending is on the action instead of front-loaded on salaries/agency fees.

pmoriarty 7y ago
How do you pay for your VPNs in a non-trackable way? If you pay via credit card, the VPN account has your name attached to it, no? So what good will chaining VPNs do when all the VPNs have your name attached to them? Bitcoin is also supposedly not anonymous (or so I've heard.. I really don't know much about bitcoin, so please correct me if I'm wrong here), so paying with it sounds like it won't be any better. Also, I have to ask: Who are you trying to prevent being tracked by? If it's by advertisers, I don't see how chaning VPNs would be any better than using a single VPN.
- mirimir 7y ago
  I'd prefer to be tracked by nothing. Or at least, by nothing short of a targeted TLA attack. And yes, Bitcoin is not anonymous. Just the opposite, in fact. Some cryptocurrencies arguably are anonymous. But that's never really been tested, and in any case, they're not widely accepted. Any VPN service that I connect to directly, I pay with credit cards. Because there's ~zero anonymity for them, no matter what. But for the rest, I pay with well-mixed Bitcoin. I anonymize Bitcoin using wallets in a series of Whonix instances, via Tor. Using a different mixing service for each step. With N steps, I have somewhere between N/3 and N-1 ~anonymous Bitcoin pools. Depending on how many mixes I consider adequate. So then I select Bitcoin pools for paying VPN services in proportion to the degree of separation.
- dashwav 7y ago
  I have been using Mullvad[1] for a year or so now and am really happy with the extent they go to avoid storing payment information. One of the things that caught my eye about them initially is that you could literally mail them an envelop containing your account number and $5 cash and they will add that time to your account, which seems to solve what it was you were asking about (although I am sure physically mailing something comes with it's own issues of privacy). [1]https://mullvad.net/en/help/no-logging-data-policy/ https://mullvad.net/en/help/no-logging-data-policy/
  - mirimir 7y ago
    Yeah, love Mullvad. They've been around for about a decade. Along with AirVPN, Insorg and IVPN. IVPN may still accept cash as well.