6 ms·

What we know about you when you click on this article

90 points by kohtatsu 7y ago

egdod 7y ago
JavaScript is cancer and should be disabled whenever possible.
- cies 7y ago
  In the browser it kinda is. Unless the web app/site is opensource and allows everyone to study it, then it is a benign cancer I guess :) Server-side JS is, well, just an inferior choice IMHO. But that's down to taste or the task at hand. But server-side it sure is no cancer.
  - egdod 7y ago
    Oh I have no problem with it on the server. But 95% of the stuff that tries to run in my browser is garbage I don’t want. 90% of it is garbage no one wants.
et2o 7y ago
Seems like this would have been a good opportunity to actually show you the relevant data they’re collecting from your visit.
- dylan604 7y ago
  I would love to see a site provide a little pop-out window with all of the mined data displayed for the site users to see. I could see where the 3rd parties mining that data would not want all of the users to see that. I've never used GA or similar, but I seriously doubt that the 3rd parties provide the site owners/developers a method for being able to do this. They want to drive eyeballs back to their site to view the metrics.
  - dmurray 7y ago
    Agreed, if Vox had actually done this it would have been underwhelming.
    - teekert 7y ago
      Something like this: [0]? [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/
      - dmurray 7y ago
        Yes exactly, that's really underwhelming to me. It doesn't tell me my age, gender, location or anything about my browser or purchasing history. I'm certain real advertisers can do better. I'm using stock Chrome on Android.
        fingerlocks 7y ago
        I’m not sure they can. How would that work? It’s not at all obvious to me, unless you explicitly provide that information by creating an account and logging in. Tracking pixels are incapable of such feats. At best they have your IP address from the latest visit, and information about your behavior on that site. I don’t see how they can magically conjure information you haven’t provided.
        beatgammit 7y ago
        They just connect your browser to an account that has that data. If you have a Facebook account, a tracking pixel makes it easy. If you don't provide that data, they can guess based on browsing history (e.g. if you look up baby products, you're likely in the 20-30 age range). They can use AI to see how your online behavior matches up with other people in a known demographic. All of that data paints a surprisingly clear picture, even if you don't create an account (e.g. browsing data by IP is likely from the same person/family).
        7y ago
- Traster 7y ago
  The problem is that they can't do that to completion- they often can't know the data that their advertisers are collecting and they certainly can't share the data that they're collecting from 3rd parties using 'profiles'. An important fact from this article is your privacy is often the minimum of the privacy settings you have set. So it might be true that you've never authorized Vox to monitor your demographic data, but they know enough to get that information from other companies. Legally they can't share that information.
superkuh 7y ago
The simplest solution to all of this is to browse with javascript disabled and only temporarily whitelist certain first party domains when required. Like egdod said at the bottom of this comment thread, downvoted into oblivion: "Javascript is a cancer and should be disabled whenever possible."
- chrismmay 7y ago
  I think you would miss out on about 90% of what the web has to offer if you simply disable Javascript. A bit like saying you should never use a bank or credit cards and do everything with cash. Javascript is one of the most popular programming languages these days. This forum is full of programmers, so it's not surprising you get downvoted for recommending that people disable Javascript.
  - edgyquant 7y ago
    I use noscript but I end up with most of the big sites whitelisted anyway (still prevents a lot of bloat.)
  - amazing_stories 7y ago
    Downvotes or not, it is the way. I'm a programmer and I use uMatrix to whitelist only the JavaScript necessary to get the content I want. The Web is user adverse. I'll gladly miss out on that 90% of the Web, most of it is garbage. The average user generally only visits a few sites anyway.
    - chrismmay 7y ago
      The Web can be a dangerous place, much like the rest of the world. Never heard of uMatrix before. It looks interesting. Thanks.
    - mrspeaker 7y ago
      Yep - same: I'm one of the biggest JavaScript fans there are, and there's no way I'm letting any-old schmo run code on my computer just because I visited their web site! I use no script and Privacy Badger... these days it has to be something pretty exceptional to make me temporarily whitelist. If a page is blank, or just says "this app needs javascript to run", then it's insta-close: so not only am I not running javascript, I get a productivity boost too!
zwaps 7y ago
I love that I have to accept ALL tracking & cookies to even read that webpage
- greenyoda 7y ago
  I disabled all cookies, all JavaScript and all 3rd-party content on that page using uMatrix, and it loads just fine.
- wildduck 7y ago
  Or you can > document.getElementById('privacy-consent').style.display = 'none'
tsbinz 7y ago
“If you logged into our network through social media we also have access to portions of your public social profile, such as your name, email address, and photo.“ Obvious in hindsight, but the profile picture is probably a goldmine for targeted advertising. Not sure if anybody does that but using that for age estimation would probably be way more accurate than the guesses I’ve seen implicitly (lots of ads like “people in <age group> love this product”) and explicitly.
- 3pt14159 7y ago
  Also profile photos are frequently reused between sites. Easy way of connecting handles, though they're not always real since some people create fake profiles on one network from real profiles on another.
chrismmay 7y ago
I use Brave and OpenVPN on a cloud server. I tested my privacy with this https://privacy.net/analyzer/ https://privacy.net/analyzer/ ... Strangely, it said I was logged in to twitter, facebook and reddit when I'm not logged in to any of them. I don't even have a twitter account.
- allovernow 7y ago
  Cool concept but for me on Brave the site was pretty broken. Content didn't seem to be loading correctly and honestly the navigation takes up half the page and made whatever results did come up really annoying to read. Scrolling was not smooth and things would disappear before they were actually out of the viewport. Also incorrectly reported me as using chrome.
  - chrismmay 7y ago
    Yeah, privacy.net isn't that great. It was the first one I found. I found a few others that take different approaches. https://webbrowsertools.com/privacy-test/ https://webbrowsertools.com/privacy-test/ https://panopticlick.eff.org/ https://panopticlick.eff.org/ https://tenta.com/test/ https://tenta.com/test/ https://dnsleaktest.com/ https://dnsleaktest.com/ This page has lots good info on this topic. https://browserleaks.com/ https://browserleaks.com/
f2000 7y ago
tldr; Everything.
Traster 7y ago
>It’s a lot — I get it — but the net result is that you, dear reader, get to read our content without a paywall. I'd love to examine this. Podcasts for example, have almost none of this tracking (as enforced by Apple) and no pay wall. And frankly, since journalism costs pretty much however much you're paying your staff I'd love to see the argument for how much the CEO of vox gets paid when compared to the cumulative loss of privacy and self-determination that their readers have suffered.
- shostack 7y ago
  Podcast tracking is improving, but not super useful yet in many cases. It works best for advertisers with high LTV products that can be tracked via coupon codes or memorable vanity URLs. A lot of advertisers actually shy away from them because they try to charge high CPMs without great tracking, which is important when their reach is so low comparatively so other statistical methods aren't as useful for measurement.
tutfbhuf 7y ago
I can recommend https://www.freefullrss.com https://www.freefullrss.com where you can convert any rss feed into a full text rss feed. The websites get rendered for you and you can view them in the rss reader of your choice, so you don't have to visit the site at all, no JavaScript and no fingerprinting exposure at all. In the long run, I think this might be the future, to have a server to render websites into a readable format for you.

90 points by kohtatsu 7y ago

egdod 7y ago

JavaScript is cancer and should be disabled whenever possible.

cies 7y ago
In the browser it kinda is. Unless the web app/site is opensource and allows everyone to study it, then it is a benign cancer I guess :) Server-side JS is, well, just an inferior choice IMHO. But that's down to taste or the task at hand. But server-side it sure is no cancer.
- egdod 7y ago
  Oh I have no problem with it on the server. But 95% of the stuff that tries to run in my browser is garbage I don’t want. 90% of it is garbage no one wants.

et2o 7y ago

Seems like this would have been a good opportunity to actually show you the relevant data they’re collecting from your visit.

dylan604 7y ago
I would love to see a site provide a little pop-out window with all of the mined data displayed for the site users to see. I could see where the 3rd parties mining that data would not want all of the users to see that. I've never used GA or similar, but I seriously doubt that the 3rd parties provide the site owners/developers a method for being able to do this. They want to drive eyeballs back to their site to view the metrics.
- dmurray 7y ago
  Agreed, if Vox had actually done this it would have been underwhelming.
  - teekert 7y ago
    Something like this: [0]? [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/
    - dmurray 7y ago
      Yes exactly, that's really underwhelming to me. It doesn't tell me my age, gender, location or anything about my browser or purchasing history. I'm certain real advertisers can do better. I'm using stock Chrome on Android.
      - fingerlocks 7y ago
        I’m not sure they can. How would that work? It’s not at all obvious to me, unless you explicitly provide that information by creating an account and logging in. Tracking pixels are incapable of such feats. At best they have your IP address from the latest visit, and information about your behavior on that site. I don’t see how they can magically conjure information you haven’t provided.
        beatgammit 7y ago
        They just connect your browser to an account that has that data. If you have a Facebook account, a tracking pixel makes it easy. If you don't provide that data, they can guess based on browsing history (e.g. if you look up baby products, you're likely in the 20-30 age range). They can use AI to see how your online behavior matches up with other people in a known demographic. All of that data paints a surprisingly clear picture, even if you don't create an account (e.g. browsing data by IP is likely from the same person/family).
        7y ago
Traster 7y ago
The problem is that they can't do that to completion- they often can't know the data that their advertisers are collecting and they certainly can't share the data that they're collecting from 3rd parties using 'profiles'. An important fact from this article is your privacy is often the minimum of the privacy settings you have set. So it might be true that you've never authorized Vox to monitor your demographic data, but they know enough to get that information from other companies. Legally they can't share that information.

superkuh 7y ago

The simplest solution to all of this is to browse with javascript disabled and only temporarily whitelist certain first party domains when required. Like egdod said at the bottom of this comment thread, downvoted into oblivion: "Javascript is a cancer and should be disabled whenever possible."

chrismmay 7y ago
I think you would miss out on about 90% of what the web has to offer if you simply disable Javascript. A bit like saying you should never use a bank or credit cards and do everything with cash. Javascript is one of the most popular programming languages these days. This forum is full of programmers, so it's not surprising you get downvoted for recommending that people disable Javascript.
- edgyquant 7y ago
  I use noscript but I end up with most of the big sites whitelisted anyway (still prevents a lot of bloat.)
- amazing_stories 7y ago
  Downvotes or not, it is the way. I'm a programmer and I use uMatrix to whitelist only the JavaScript necessary to get the content I want. The Web is user adverse. I'll gladly miss out on that 90% of the Web, most of it is garbage. The average user generally only visits a few sites anyway.
  - chrismmay 7y ago
    The Web can be a dangerous place, much like the rest of the world. Never heard of uMatrix before. It looks interesting. Thanks.
  - mrspeaker 7y ago
    Yep - same: I'm one of the biggest JavaScript fans there are, and there's no way I'm letting any-old schmo run code on my computer just because I visited their web site! I use no script and Privacy Badger... these days it has to be something pretty exceptional to make me temporarily whitelist. If a page is blank, or just says "this app needs javascript to run", then it's insta-close: so not only am I not running javascript, I get a productivity boost too!

zwaps 7y ago

I love that I have to accept ALL tracking & cookies to even read that webpage

greenyoda 7y ago
I disabled all cookies, all JavaScript and all 3rd-party content on that page using uMatrix, and it loads just fine.
wildduck 7y ago
Or you can > document.getElementById('privacy-consent').style.display = 'none'

tsbinz 7y ago

“If you logged into our network through social media we also have access to portions of your public social profile, such as your name, email address, and photo.“ Obvious in hindsight, but the profile picture is probably a goldmine for targeted advertising. Not sure if anybody does that but using that for age estimation would probably be way more accurate than the guesses I’ve seen implicitly (lots of ads like “people in <age group> love this product”) and explicitly.

3pt14159 7y ago
Also profile photos are frequently reused between sites. Easy way of connecting handles, though they're not always real since some people create fake profiles on one network from real profiles on another.

chrismmay 7y ago

I use Brave and OpenVPN on a cloud server. I tested my privacy with this https://privacy.net/analyzer/ https://privacy.net/analyzer/ ... Strangely, it said I was logged in to twitter, facebook and reddit when I'm not logged in to any of them. I don't even have a twitter account.

allovernow 7y ago
Cool concept but for me on Brave the site was pretty broken. Content didn't seem to be loading correctly and honestly the navigation takes up half the page and made whatever results did come up really annoying to read. Scrolling was not smooth and things would disappear before they were actually out of the viewport. Also incorrectly reported me as using chrome.
- chrismmay 7y ago
  Yeah, privacy.net isn't that great. It was the first one I found. I found a few others that take different approaches. https://webbrowsertools.com/privacy-test/ https://webbrowsertools.com/privacy-test/ https://panopticlick.eff.org/ https://panopticlick.eff.org/ https://tenta.com/test/ https://tenta.com/test/ https://dnsleaktest.com/ https://dnsleaktest.com/ This page has lots good info on this topic. https://browserleaks.com/ https://browserleaks.com/

f2000 7y ago

tldr; Everything.

Traster 7y ago

>It’s a lot — I get it — but the net result is that you, dear reader, get to read our content without a paywall. I'd love to examine this. Podcasts for example, have almost none of this tracking (as enforced by Apple) and no pay wall. And frankly, since journalism costs pretty much however much you're paying your staff I'd love to see the argument for how much the CEO of vox gets paid when compared to the cumulative loss of privacy and self-determination that their readers have suffered.

shostack 7y ago
Podcast tracking is improving, but not super useful yet in many cases. It works best for advertisers with high LTV products that can be tracked via coupon codes or memorable vanity URLs. A lot of advertisers actually shy away from them because they try to charge high CPMs without great tracking, which is important when their reach is so low comparatively so other statistical methods aren't as useful for measurement.

tutfbhuf 7y ago

I can recommend https://www.freefullrss.com https://www.freefullrss.com where you can convert any rss feed into a full text rss feed. The websites get rendered for you and you can view them in the rss reader of your choice, so you don't have to visit the site at all, no JavaScript and no fingerprinting exposure at all. In the long run, I think this might be the future, to have a server to render websites into a readable format for you.