4 ms·

I don't really have a problem with first party tracking, unless it can correlate my identity across websites. But otherwise I have no problem with website X kno

by cm2187 7y ago

I don't really have a problem with first party tracking, unless it can correlate my identity across websites. But otherwise I have no problem with website X knowing that I browse website X. Can first party tracking do this sort of correlation other than through browser fingerprinting?

cyborgx7 7y ago
If I'm understanding this correctly, it's only first party tracking in that it comes from a subdomain of the domain of the website you are browsing. But that subdomain points at a third party tracking provider. So this still seems like a single tracking provider on multiple website being able to correlate your browsing.
- wongarsu 7y ago
  You still get full cookie separation because each website has a different subdomain and thus a different cookie. The analytics provider can track you across the internet, but they have to invest work and resources instead of getting it basically free.
  - cyborgx7 7y ago
    I agree that this is not an insignificant aspect. But I still don't think it is therefore something that should be tolerated.
  - cm2187 7y ago
    But how would the provider track you across the internet with cookie separation (other than through fingerprinting)?
    - Red_Leaves_Flyy 7y ago
      Do you have a great way to block every fingerprinting method?
      - cm2187 7y ago
        Firefox seems to be on the case. There is really no good reason to give any means for a website to fingerprint a browser.
    - gpvos 7y ago
      I wouldn't know, but fingerprinting is a thing and is bad enough.
    - kasey_junk 7y ago
      The provider a) is the other parts of the internet (think big cdn) and b) they communicate with other data brokers via a side channel instead of via cookie syncing. This is already happening with large web publishers.
      - cm2187 7y ago
        But even if they do that, how can they tell it is the same user on two different domains?
  - squiggleblaz 7y ago
    Well, I'm hardly about to accept that it's legitimate to spy on me "because they invested work and resources instead of getting it basically for free". It's like, a peeping Tom who just looks through a window - yuck that's gross. But a peeping Tom who spies by building a microdrone that can fly in the door when it opens and mount itself on the ceiling with suction pads - oh that's perfectly legitimate because of the work and resources Tom invested. I mean, if it's gross to do something by accident and it's gross to do something without any investment, it's super gross to do it with resources. It's not all that hard to track someone across the internet. I think many people have demonstrate hacks that steal legitimate functionality and get you there. I think we'll probably have to go for a containerised internet (separate apps) and just deal with the disadvantages.
- input_sh 7y ago
  uBlock origin (more specifically, EasyPrivacy list) blocks 1st party tracking as well. For example, you could spin up an instance of Matomo (formerly Piwik) for your own website and still see no traffic from adblock users by default.
  - ddtaylor 7y ago
    This is also why if you're using Matamo you should have it parse your access logs instead.
stilisstuk 7y ago
Yes. E.g. Danish newspapers are working in a joint effort to do just that, via 1st party tracking. https://translate.googleusercontent.com/translate_c?depth=1&nv=1&rurl=translate.google.com&sl=da&sp=nmt4&tl=en&u=https://jppol.dk/pressemeddelelser/jp-politikens-hus-lancerer-ny-dataplatform-til-det-digitale-annoncemarked/&xid=17259,15700023,15700186,15700190,15700256,15700259,15700262,15700265,15700271,15700283&usg=ALkJrhgePYTeTSRO_Bb3l3qDQDGLCcckMQ https://translate.googleusercontent.com/translate_c?depth=1&...
Jestar342 7y ago
Think of this as SSR for adverts/trackers. The harvested data is still going to 3rd parties, even if your browser connection(s) aren't.
pdkl95 7y ago
This is about 3rd party trackers masquerading as the 1st party by asking the hosting page to provide a CNAME under their own domain. With the tracker hosted under the 1st party's domain, they work around people that deny 3rd party cookies. The example at the top of the thread: https://www.liberation.fr/ https://www.liberation.fr/ has a tracker from f7ds.liberation.fr, which is really part of tracking provider Eulerian. f7ds.liberation.fr. 3599 IN CNAME liberation.eulerian.net. TL;DR - the entire point of this is to let 3rd parties continue to correlate your identity by hiding as part of the 1st party.
throwaway6845 7y ago
I agree. I have a big problem with UBO etc. blocking self-hosted, single-site Piwik. It feels like being penalised for doing the right thing.
- ekianjo 7y ago
  In the world of tracking a self hosted, self-owned tracking solution would probably be by far the exception rather than the rule.
- account42 7y ago
  > It feels like being penalised for doing the right thing. Just because there are worse things to do does not make Piwik the right thing. The right thing is not to collect the data at all.
  - throwaway6845 7y ago
    What's wrong with finding out how people use my site, so I can write more of the content they like, and make it easier for them to navigate through?
beagle3 7y ago
Google and Facebook have been adding gclid and fbclid arguments to outgoing links for a while. Click one of those, and the linked site can conspire with googbook to correlate identities. More sites could do that. This is generally better than 3rd partyies because the sites would have to actually conspire, cooperate and trust each other, which is a huge hurdle. And if the trust is actually there, they could correlate offline without any indication. Facebook already does that (with credit records, likely phone records and medical records as well) and I wouldn’t be surprised if others don’t. Correlation is less than perfect this way - but e.g. zip, gender and age are enough to give a pretty good correlation, and name makes it almost perfect - if you have an account somewhere, you probably gave these details.
- jedimastert 7y ago
  > Google and Facebook have been adding gclid and fbclid arguments to outgoing links for a while. Can you you send me an example of both of those please?
  - Hello71 7y ago
    gclid seems to be for adwords only. imo, if you're already the type to click on ads, you shouldn't object to tracking of which site you came from. fbclid on the other hand applies to all links from facebook. it was a major story on HN: https://hn.algolia.com/?query=fbclid https://hn.algolia.com/?query=fbclid
Iv 7y ago
Browser and IP fingerprinting are already good enough to pinpoint you.

by cm2187 7y ago

cyborgx7 7y ago

If I'm understanding this correctly, it's only first party tracking in that it comes from a subdomain of the domain of the website you are browsing. But that subdomain points at a third party tracking provider. So this still seems like a single tracking provider on multiple website being able to correlate your browsing.

wongarsu 7y ago
You still get full cookie separation because each website has a different subdomain and thus a different cookie. The analytics provider can track you across the internet, but they have to invest work and resources instead of getting it basically free.
- cyborgx7 7y ago
  I agree that this is not an insignificant aspect. But I still don't think it is therefore something that should be tolerated.
- cm2187 7y ago
  But how would the provider track you across the internet with cookie separation (other than through fingerprinting)?
  - Red_Leaves_Flyy 7y ago
    Do you have a great way to block every fingerprinting method?
    - cm2187 7y ago
      Firefox seems to be on the case. There is really no good reason to give any means for a website to fingerprint a browser.
  - gpvos 7y ago
    I wouldn't know, but fingerprinting is a thing and is bad enough.
  - kasey_junk 7y ago
    The provider a) is the other parts of the internet (think big cdn) and b) they communicate with other data brokers via a side channel instead of via cookie syncing. This is already happening with large web publishers.
    - cm2187 7y ago
      But even if they do that, how can they tell it is the same user on two different domains?
- squiggleblaz 7y ago
  Well, I'm hardly about to accept that it's legitimate to spy on me "because they invested work and resources instead of getting it basically for free". It's like, a peeping Tom who just looks through a window - yuck that's gross. But a peeping Tom who spies by building a microdrone that can fly in the door when it opens and mount itself on the ceiling with suction pads - oh that's perfectly legitimate because of the work and resources Tom invested. I mean, if it's gross to do something by accident and it's gross to do something without any investment, it's super gross to do it with resources. It's not all that hard to track someone across the internet. I think many people have demonstrate hacks that steal legitimate functionality and get you there. I think we'll probably have to go for a containerised internet (separate apps) and just deal with the disadvantages.
input_sh 7y ago
uBlock origin (more specifically, EasyPrivacy list) blocks 1st party tracking as well. For example, you could spin up an instance of Matomo (formerly Piwik) for your own website and still see no traffic from adblock users by default.
- ddtaylor 7y ago
  This is also why if you're using Matamo you should have it parse your access logs instead.

stilisstuk 7y ago

Yes. E.g. Danish newspapers are working in a joint effort to do just that, via 1st party tracking. https://translate.googleusercontent.com/translate_c?depth=1&nv=1&rurl=translate.google.com&sl=da&sp=nmt4&tl=en&u=https://jppol.dk/pressemeddelelser/jp-politikens-hus-lancerer-ny-dataplatform-til-det-digitale-annoncemarked/&xid=17259,15700023,15700186,15700190,15700256,15700259,15700262,15700265,15700271,15700283&usg=ALkJrhgePYTeTSRO_Bb3l3qDQDGLCcckMQ https://translate.googleusercontent.com/translate_c?depth=1&...

Jestar342 7y ago

Think of this as SSR for adverts/trackers. The harvested data is still going to 3rd parties, even if your browser connection(s) aren't.

pdkl95 7y ago

This is about 3rd party trackers masquerading as the 1st party by asking the hosting page to provide a CNAME under their own domain. With the tracker hosted under the 1st party's domain, they work around people that deny 3rd party cookies. The example at the top of the thread: https://www.liberation.fr/ https://www.liberation.fr/ has a tracker from f7ds.liberation.fr, which is really part of tracking provider Eulerian. f7ds.liberation.fr. 3599 IN CNAME liberation.eulerian.net. TL;DR - the entire point of this is to let 3rd parties continue to correlate your identity by hiding as part of the 1st party.

throwaway6845 7y ago

I agree. I have a big problem with UBO etc. blocking self-hosted, single-site Piwik. It feels like being penalised for doing the right thing.

ekianjo 7y ago
In the world of tracking a self hosted, self-owned tracking solution would probably be by far the exception rather than the rule.
account42 7y ago
> It feels like being penalised for doing the right thing. Just because there are worse things to do does not make Piwik the right thing. The right thing is not to collect the data at all.
- throwaway6845 7y ago
  What's wrong with finding out how people use my site, so I can write more of the content they like, and make it easier for them to navigate through?

beagle3 7y ago

Google and Facebook have been adding gclid and fbclid arguments to outgoing links for a while. Click one of those, and the linked site can conspire with googbook to correlate identities. More sites could do that. This is generally better than 3rd partyies because the sites would have to actually conspire, cooperate and trust each other, which is a huge hurdle. And if the trust is actually there, they could correlate offline without any indication. Facebook already does that (with credit records, likely phone records and medical records as well) and I wouldn’t be surprised if others don’t. Correlation is less than perfect this way - but e.g. zip, gender and age are enough to give a pretty good correlation, and name makes it almost perfect - if you have an account somewhere, you probably gave these details.

jedimastert 7y ago
> Google and Facebook have been adding gclid and fbclid arguments to outgoing links for a while. Can you you send me an example of both of those please?
- Hello71 7y ago
  gclid seems to be for adwords only. imo, if you're already the type to click on ads, you shouldn't object to tracking of which site you came from. fbclid on the other hand applies to all links from facebook. it was a major story on HN: https://hn.algolia.com/?query=fbclid https://hn.algolia.com/?query=fbclid

Iv 7y ago

Browser and IP fingerprinting are already good enough to pinpoint you.