13 ms·

Preventing Tracking Prevention Tracking

212 points by om2 7y ago

choeger 7y ago
So what's next? Tracking the Prevention of Tracking Prevention? Honestly, this shit gets confusing, can someone please ML us out of it? Or maybe we just design a sane and understandable First-Party only policy?
- Toast_25 7y ago
  It's impossible to build a perfect system, even ML could have a bias towards a certain solution or the badguys could ML a way to track us again.
  - choeger 7y ago
    You might need a sarcasm detector.
    - kirubakaran 7y ago
      An ML based one of course.
  - baroffoos 7y ago
    Its funny how our brains have a kind of built in adblocker named banner blindness. There have been a few times I was unable to understand a UI because the important part was rectangle and too prominent so I ignore it entirely without realizing it.
    - rhizome 7y ago
      Why do you think advertisers moved to moving ads, ads that fade in over the page once you scroll a little and can be assumed to be focusing on the page, reading? Autoplay video that moves down to the picture-in-picture corner? The more annoyingly distracting the ad is, the better. Or so advertisers think.
  - OrgNet 7y ago
    cat and mouse game because no software is perfect, yet
- saagarjha 7y ago
  Intelligent Tracking Prevention uses a machine learning classifier.
apacheCamel 7y ago
I hope there is a light at the end of the tunnel for all of this. It seems like there will always be a cat and mouse effort to be just one step ahead of the other. Like how many websites have those popups now where they ask you to turn off ad-blocking. Intrusive ads and website tracking should both be a problem by default. I guess not all ads can be a problem, but I am unsure if the same could be said about tracking...
- umvi 7y ago
  2021: "Preventing Tracking Prevention Tracking Prevention Tracking"
  - HeWhoLurksLate 7y ago
    [2019/12/12] [Hotfix] Pre-Emptive Tracking of Track-Preventative Tracking Users by Home Address
- om2 7y ago
  We're willing to play the cat and mouse game indefinitely, if that's what it takes. Widely deployed trackers are limited in how fast they can try new tricks. And in practice, we know that ITP is working pretty well to block cross-site tracking: https://daringfireball.net/linked/2019/12/09/the-information-ad-tracking https://daringfireball.net/linked/2019/12/09/the-information...
  - saagarjha 7y ago
    > Widely deployed trackers are limited in how fast they can try new tricks. How so? Tracking scripts are often included by a script tag that points at a website. Can’t the code be updated, “deployed” to websites immediately, and take advantage of the relatively slower release cycle of Safari?
    - om2 7y ago
      Maybe I should have said that some tricks are slow to deploy. Sometimes the publisher only embeds an image form the tracker (the famed "tracking pixel"). Getting lots of sites to change that to script is a pain. Sometimes they need to deploy new server-side tech for a workaround. For the recent CNAME cloaking trick, they have to get sites to modify their DNS and change what URL they embed script from.
Spivak 7y ago
If you want this in Firefox you need to tweak an about:config setting. I really hope it becomes the default at some point. # Only send the origin cross-domain. network.http.referer.XOriginTrimmingPolicy = 2 This alone is a pretty liberal policy. People in this crowd probably want even more which can be found here: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer
- xvector 7y ago
  Why does this header need to exist in the first place? Seems like a huge privacy breach. Why can't 0 be the default setting?
  - RussianCow 7y ago
    Believe it or not, there actually exist websites that rely on the Referer header for navigation. The last time I bumped into this was a few years ago, but a local government site refused to work unless my browser sent that header. Granted, this is probably rare enough that it's safe to disable the header for the vast majority of websites, but it's something to keep in mind.
    - SAI_Peregrinus 7y ago
      Atlassian requires it for Jira (& other bits of their crap) logins to work.
      - jlarocco 7y ago
        I'm honestly not surprised. Judging solely by the UI, I actually kinda like Atlassian's tools, but they're a huge pain in the ass to get working with privacy extensions installed (uMatrix, uBlock, etc.). They make cross-site requests all over the place (to weird servers like "some-huge-name-that-obscures-the-host-name.atl-pass.net", and even some third party servers!), tons of Javascript and css for basic features, etc. Using dubious features like referer headers seems right up their alley. It's one of the main reasons I only use them at work, and won't use them for my personal projects. I'd rather pay for GitHub and Sourcehut so I don't feel like I'm opening my browser up to a bunch of security problems. In the past they've also made some really brain dead (IMO) decisions like going out of the way to break middle-click paste on Linux.
rapind 7y ago
Why can't a browser solve this (except for IP) by simply having an option to not leak any data? Make audio and GL calls constant time, and don't persist anything past the tab / window / site? No fonts or cache reuse beyond the host? No referrers etc. What's the hard problem here that prevents major browsers from having an option like this?
- cpeterso 7y ago
  Firefox has an about:config preference called "privacy.resistFingerprinting" to enable some of Tor's mitigations against fingerprinting. Tor is based on Firefox code and Mozilla merges some of Tor's code changes into Firefox to make updating easier for the Tor team. More details in this ghacks article: https://www.ghacks.net/2018/03/01/a-history-of-fingerprinting-protection-in-firefox/ https://www.ghacks.net/2018/03/01/a-history-of-fingerprintin...
- Etheryte 7y ago
  The difficult bit is that your browser is programmable and browsers are different across vendors, devices and releases. This means whatever a bad guy can think of as a test can be sent back over the wire, and you can't realistically block sites from sending data back to servers. So long as there are different browsers etc, there will be tests that can differentiate between them. Currently canvas fingerprinting [1] is a popular option, but there's quite a lot of options for that next thing you can use. Even generic code execution time could be used to an extent. Realistically there is hope at the end of the tunnel, but it's a very long way to go given just how complex of a corner we've painted ourselves into with modern web standards. While it wouldn't stop purely malicious actors, I personally think it might be easier to address the whole situation on the legislation side rather than with technology. Imagine GDPR, except tracking would be illegal altogether: there will always be actors who will work to bypass it, but the majority would do their best to conform, lest they want to go bust with fines. [1] https://en.wikipedia.org/wiki/Canvas_fingerprinting https://en.wikipedia.org/wiki/Canvas_fingerprinting
3pt14159 7y ago
Some of the people I've talked with over the years study things like nuclear weapons arms control or cyberwarfare. The most paranoid of the bunch have resorted to having Virtual Private Servers screen shot websites with headless browsers once it loads and pipe it back to their research machine. I can't remember if it's a table of PNGs or just one big one, but either way it's sent back over a SSH tunnel and when you click the server knows what you're trying to click on and preforms the action for you, and will randomly forward the click to a new VPS. It's not perfect because the IP blocks make it obvious that it comes from DigitalOcean, AWS, etc, but it's sure better than loading untrusted PDFs or JS locally. Still vulnerable to a network attack, though.
- kube-system 7y ago
  https://en.wikipedia.org/wiki/Browser_isolation https://en.wikipedia.org/wiki/Browser_isolation
- core-questions 7y ago
  So they're taking screenshots via the VM console? Why not just directly interact with the VM console, then?
  - ljm 7y ago
    If they’re forwarding each click to a different VM to avoid persistent tracking then that wouldn’t work.
- alasdair_ 7y ago
  How does this stop something as simple as user-unique URLs for each link? A new VPS that fetches a unique URL is trivial to tie to the same user.
  - chii 7y ago
    open multiple browser sessions for the user, and randomly choose one of them as the 'result' (but still click on all of them, even if the resultant page isn't viewed). Or, just don't use the website if they do this.
wayoutthere 7y ago
> Origin-Only Referrer For All Third-Party Requests This is going to break a lot of things. Things that probably should be broken, but it will cause headaches nonetheless.
- tinus_hn 7y ago
  Luckily if a big browser makes this the default, these things will probably be fixed.
  - spartanatreyu 7y ago
    Conversely, if a big browser makes a new default that ends up being the wrong decision, that default might spread to other browsers and things will definitely be broken. The css value `100vh` meant the height of the viewport of the browser, until it didn't.
    - csande17 7y ago
      > The css value `100vh` meant the height of the viewport of the browser, until it didn't. Huh, what's it mean now? Is there some subtle difference, like it doesn't include the horizonal scroll bar or something?
      - rcgs 7y ago
        Mobile devices interpret it differently because of the hide/show browser UI they often have.
  - r-w 7y ago
    I’m pretty sure that’s only true for Chrome at this point.
kube-system 7y ago
Of course, Google suggests modifications that would hinder their competitors, but not themselves. I wonder what percentage of browsers have a first-party cookie from Google?
- om2 7y ago
  If Google had any motive besides research and responsible disclosure, it would more likely be to persuade us that ITP is not viable. But I think their issue was fair and submitted in good faith.
tomaszs 7y ago
They have an app store they earn money from. They have ads system. For them websites are competition. Because people loose time elsewhere than in apps. They click other ads than theirs. How should anyone believe these actions are for privacy? And not against competition? Against the Internet? Have you seen any consideration how it will impact website owners? I didn't. It seems they really don't care. And it is very dangerous. It looks like the path to break the Internet.
- turboturbo 7y ago
  Those are not mutually exclusive, both can be true
- macinjosh 7y ago
  Why not both? The market is a brilliant system. Privacy is objectively good for users and so is competition as it can lead to lower prices and better products for users.
  - rhizome 7y ago
    The word "can" is doing a lot of heavy lifting there.
- lilyball 7y ago
  Apple doesn't have an ads system, unless you mean the App Store ads that only show up in App Store search (and thus are completely unrelated to Safari). They had an ads system at one point but it was shut down over 3 years ago, and was for in-app ads anyway, not browser ads.
  - saagarjha 7y ago
    Apple also runs ads in Apple News.
  - tomaszs 7y ago
    True, i was thinking about Apple and Google in the same time
core-questions 7y ago
Trace buster Buster BUSTER! https://www.youtube.com/watch?v=Iw3G80bplTg https://www.youtube.com/watch?v=Iw3G80bplTg
thayne 7y ago
> ITP now downgrades all cross-site request referrer headers to just the page’s origin What is meant by cross-site here? Does it mean a different eTLD+1, or a different origin (as used by CORS)? Specifically, if I make a request from https://www.example.com/path?query https://www.example.com/path?query to https://api.example.com https://api.example.com will the referer header contain the "/path?query"? or will that get blocked as well?
xz0r 7y ago
> We’d like to thank Google for sending us a report in which they explore both the ability to detect when web content is treated differently by tracking prevention and the bad things that are possible with such detection. Its interesting that Google being an ad-tech company is doing something against their own interest.

212 points by om2 7y ago

So what's next? Tracking the Prevention of Tracking Prevention? Honestly, this shit gets confusing, can someone please ML us out of it? Or maybe we just design a sane and understandable First-Party only policy?

Toast_25 7y ago
It's impossible to build a perfect system, even ML could have a bias towards a certain solution or the badguys could ML a way to track us again.
- choeger 7y ago
  You might need a sarcasm detector.
  - kirubakaran 7y ago
    An ML based one of course.
- baroffoos 7y ago
  Its funny how our brains have a kind of built in adblocker named banner blindness. There have been a few times I was unable to understand a UI because the important part was rectangle and too prominent so I ignore it entirely without realizing it.
  - rhizome 7y ago
    Why do you think advertisers moved to moving ads, ads that fade in over the page once you scroll a little and can be assumed to be focusing on the page, reading? Autoplay video that moves down to the picture-in-picture corner? The more annoyingly distracting the ad is, the better. Or so advertisers think.
- OrgNet 7y ago
  cat and mouse game because no software is perfect, yet
saagarjha 7y ago
Intelligent Tracking Prevention uses a machine learning classifier.

apacheCamel 7y ago

I hope there is a light at the end of the tunnel for all of this. It seems like there will always be a cat and mouse effort to be just one step ahead of the other. Like how many websites have those popups now where they ask you to turn off ad-blocking. Intrusive ads and website tracking should both be a problem by default. I guess not all ads can be a problem, but I am unsure if the same could be said about tracking...

umvi 7y ago
2021: "Preventing Tracking Prevention Tracking Prevention Tracking"
- HeWhoLurksLate 7y ago
  [2019/12/12] [Hotfix] Pre-Emptive Tracking of Track-Preventative Tracking Users by Home Address
om2 7y ago
We're willing to play the cat and mouse game indefinitely, if that's what it takes. Widely deployed trackers are limited in how fast they can try new tricks. And in practice, we know that ITP is working pretty well to block cross-site tracking: https://daringfireball.net/linked/2019/12/09/the-information-ad-tracking https://daringfireball.net/linked/2019/12/09/the-information...
- saagarjha 7y ago
  > Widely deployed trackers are limited in how fast they can try new tricks. How so? Tracking scripts are often included by a script tag that points at a website. Can’t the code be updated, “deployed” to websites immediately, and take advantage of the relatively slower release cycle of Safari?
  - om2 7y ago
    Maybe I should have said that some tricks are slow to deploy. Sometimes the publisher only embeds an image form the tracker (the famed "tracking pixel"). Getting lots of sites to change that to script is a pain. Sometimes they need to deploy new server-side tech for a workaround. For the recent CNAME cloaking trick, they have to get sites to modify their DNS and change what URL they embed script from.

Spivak 7y ago

If you want this in Firefox you need to tweak an about:config setting. I really hope it becomes the default at some point. # Only send the origin cross-domain. network.http.referer.XOriginTrimmingPolicy = 2 This alone is a pretty liberal policy. People in this crowd probably want even more which can be found here: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer

xvector 7y ago
Why does this header need to exist in the first place? Seems like a huge privacy breach. Why can't 0 be the default setting?
- RussianCow 7y ago
  Believe it or not, there actually exist websites that rely on the Referer header for navigation. The last time I bumped into this was a few years ago, but a local government site refused to work unless my browser sent that header. Granted, this is probably rare enough that it's safe to disable the header for the vast majority of websites, but it's something to keep in mind.
  - SAI_Peregrinus 7y ago
    Atlassian requires it for Jira (& other bits of their crap) logins to work.
    - jlarocco 7y ago
      I'm honestly not surprised. Judging solely by the UI, I actually kinda like Atlassian's tools, but they're a huge pain in the ass to get working with privacy extensions installed (uMatrix, uBlock, etc.). They make cross-site requests all over the place (to weird servers like "some-huge-name-that-obscures-the-host-name.atl-pass.net", and even some third party servers!), tons of Javascript and css for basic features, etc. Using dubious features like referer headers seems right up their alley. It's one of the main reasons I only use them at work, and won't use them for my personal projects. I'd rather pay for GitHub and Sourcehut so I don't feel like I'm opening my browser up to a bunch of security problems. In the past they've also made some really brain dead (IMO) decisions like going out of the way to break middle-click paste on Linux.

rapind 7y ago

Why can't a browser solve this (except for IP) by simply having an option to not leak any data? Make audio and GL calls constant time, and don't persist anything past the tab / window / site? No fonts or cache reuse beyond the host? No referrers etc. What's the hard problem here that prevents major browsers from having an option like this?

cpeterso 7y ago
Firefox has an about:config preference called "privacy.resistFingerprinting" to enable some of Tor's mitigations against fingerprinting. Tor is based on Firefox code and Mozilla merges some of Tor's code changes into Firefox to make updating easier for the Tor team. More details in this ghacks article: https://www.ghacks.net/2018/03/01/a-history-of-fingerprinting-protection-in-firefox/ https://www.ghacks.net/2018/03/01/a-history-of-fingerprintin...
Etheryte 7y ago
The difficult bit is that your browser is programmable and browsers are different across vendors, devices and releases. This means whatever a bad guy can think of as a test can be sent back over the wire, and you can't realistically block sites from sending data back to servers. So long as there are different browsers etc, there will be tests that can differentiate between them. Currently canvas fingerprinting [1] is a popular option, but there's quite a lot of options for that next thing you can use. Even generic code execution time could be used to an extent. Realistically there is hope at the end of the tunnel, but it's a very long way to go given just how complex of a corner we've painted ourselves into with modern web standards. While it wouldn't stop purely malicious actors, I personally think it might be easier to address the whole situation on the legislation side rather than with technology. Imagine GDPR, except tracking would be illegal altogether: there will always be actors who will work to bypass it, but the majority would do their best to conform, lest they want to go bust with fines. [1] https://en.wikipedia.org/wiki/Canvas_fingerprinting https://en.wikipedia.org/wiki/Canvas_fingerprinting

3pt14159 7y ago

Some of the people I've talked with over the years study things like nuclear weapons arms control or cyberwarfare. The most paranoid of the bunch have resorted to having Virtual Private Servers screen shot websites with headless browsers once it loads and pipe it back to their research machine. I can't remember if it's a table of PNGs or just one big one, but either way it's sent back over a SSH tunnel and when you click the server knows what you're trying to click on and preforms the action for you, and will randomly forward the click to a new VPS. It's not perfect because the IP blocks make it obvious that it comes from DigitalOcean, AWS, etc, but it's sure better than loading untrusted PDFs or JS locally. Still vulnerable to a network attack, though.

kube-system 7y ago
https://en.wikipedia.org/wiki/Browser_isolation https://en.wikipedia.org/wiki/Browser_isolation
core-questions 7y ago
So they're taking screenshots via the VM console? Why not just directly interact with the VM console, then?
- ljm 7y ago
  If they’re forwarding each click to a different VM to avoid persistent tracking then that wouldn’t work.
alasdair_ 7y ago
How does this stop something as simple as user-unique URLs for each link? A new VPS that fetches a unique URL is trivial to tie to the same user.
- chii 7y ago
  open multiple browser sessions for the user, and randomly choose one of them as the 'result' (but still click on all of them, even if the resultant page isn't viewed). Or, just don't use the website if they do this.

wayoutthere 7y ago

> Origin-Only Referrer For All Third-Party Requests This is going to break a lot of things. Things that probably should be broken, but it will cause headaches nonetheless.

tinus_hn 7y ago
Luckily if a big browser makes this the default, these things will probably be fixed.
- spartanatreyu 7y ago
  Conversely, if a big browser makes a new default that ends up being the wrong decision, that default might spread to other browsers and things will definitely be broken. The css value `100vh` meant the height of the viewport of the browser, until it didn't.
  - csande17 7y ago
    > The css value `100vh` meant the height of the viewport of the browser, until it didn't. Huh, what's it mean now? Is there some subtle difference, like it doesn't include the horizonal scroll bar or something?
    - rcgs 7y ago
      Mobile devices interpret it differently because of the hide/show browser UI they often have.
- r-w 7y ago
  I’m pretty sure that’s only true for Chrome at this point.

kube-system 7y ago

Of course, Google suggests modifications that would hinder their competitors, but not themselves. I wonder what percentage of browsers have a first-party cookie from Google?

om2 7y ago
If Google had any motive besides research and responsible disclosure, it would more likely be to persuade us that ITP is not viable. But I think their issue was fair and submitted in good faith.

tomaszs 7y ago

They have an app store they earn money from. They have ads system. For them websites are competition. Because people loose time elsewhere than in apps. They click other ads than theirs. How should anyone believe these actions are for privacy? And not against competition? Against the Internet? Have you seen any consideration how it will impact website owners? I didn't. It seems they really don't care. And it is very dangerous. It looks like the path to break the Internet.

turboturbo 7y ago
Those are not mutually exclusive, both can be true
macinjosh 7y ago
Why not both? The market is a brilliant system. Privacy is objectively good for users and so is competition as it can lead to lower prices and better products for users.
- rhizome 7y ago
  The word "can" is doing a lot of heavy lifting there.
lilyball 7y ago
Apple doesn't have an ads system, unless you mean the App Store ads that only show up in App Store search (and thus are completely unrelated to Safari). They had an ads system at one point but it was shut down over 3 years ago, and was for in-app ads anyway, not browser ads.
- saagarjha 7y ago
  Apple also runs ads in Apple News.
- tomaszs 7y ago
  True, i was thinking about Apple and Google in the same time

core-questions 7y ago

Trace buster Buster BUSTER! https://www.youtube.com/watch?v=Iw3G80bplTg https://www.youtube.com/watch?v=Iw3G80bplTg

thayne 7y ago

> ITP now downgrades all cross-site request referrer headers to just the page’s origin What is meant by cross-site here? Does it mean a different eTLD+1, or a different origin (as used by CORS)? Specifically, if I make a request from https://www.example.com/path?query https://www.example.com/path?query to https://api.example.com https://api.example.com will the referer header contain the "/path?query"? or will that get blocked as well?

xz0r 7y ago

> We’d like to thank Google for sending us a report in which they explore both the ability to detect when web content is treated differently by tracking prevention and the bad things that are possible with such detection. Its interesting that Google being an ad-tech company is doing something against their own interest.