7 ms·

The amount of tracking is mindboggling. With advertisers switching to 1st party cookies it will get harder to avoid tracking, unfortunately.

by Tepix 7y ago

Polylactic_acid 7y ago
The cat and mouse games will continue until legal action is taken. Before loading any tracking at all the user should be shown a Yes/no option.
- pndy 7y ago
  If legal action would be taken, shouldn't browser have the controls regarding tracking preference? Setting up each page (provided that 'No' would still load page in either full or stripped-down variant) on each devices owned and/or reapplying choices whenever browser cache is cleared would be frustrating. Maybe DNT should return as respected feature within browser and user choice shouldn't affect the access to the content but only its form.
  - toper-centage 7y ago
    Exactly. That's how we ended up with the terrible cookie warnings. The funny thing is that GDPR has language about respecting the DNT but no one cares.
    - tristador 7y ago
      Is there a good example of a large company that blatantly ignores DNT? I'd guess its hard to know as a lot of the tracking could be server side only.
  - kube-system 7y ago
    DNT is counterproductive from a technical perspective. The more bits of entropy you give trackers, the easier you are to track.
    - fauigerzigerk 7y ago
      If DNT was legally binding, they wouldn't be allowed to use that additional bit of entropy. But I would prefer a PTM (please track me) header with legally binding semantics.
      - kube-system 7y ago
        Those who abuse it the most will just move to a jurisdiction where it is allowed. Or they'll do it anyway, since many of the worst threats on the internet are already criminal. On the internet, technical solutions > legal solutions.
        fauigerzigerk 7y ago
        There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things. Tracking only pays if you can track a huge number of people and sell ads to a huge number of advertisers. The profit per tracked user is too small to pay for running a criminal enterprise. Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law.
        kube-system 7y ago
        > There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things. True, most illicit ads tend to be non-targeted. But some criminals do things like blackmail, fraud, espionage, etc. using tracking data. > Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law. That all depends on the specific business model, business partners, and their presence. Regardless, what I describe is not conjecture, many companies are shuffling around data to avoid GDPR rather than comply. https://www.theguardian.com/technology/2018/apr/19/facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law https://www.theguardian.com/technology/2018/apr/19/facebook-... A different company without a physical presence or business partner in the jurisdiction in question, might have little to no incentive to follow the law. In the end, even if companies are breaking the law, or even if they are fined, your data won't be protected unless they actually change their behavior as a result. Calculated non-compliance is a commonplace strategy for corporate legal compliance.
- adrianN 7y ago
  That didn't work out so well for the EU's cookie law. We need a different solution I think.
  - dmitriid 7y ago
    I think it worked wonders with GDPR which exposed all this pus. Unfortunately, there EU has been too slow acting on it. Only British Airways has been slapped with a significant fine so far.
    - taurath 7y ago
      GDPR opt out rate is well well under 1%.
      - kelnos 7y ago
        What does that even mean? GDPR requires companies to request that people opt in to information gathering.
        martin_a 7y ago
        And in reality, as long as no fear-mongering fines are handed out, companies will try to bypass it. There would be ways to get control over this, but law is slow.
        kevsim 7y ago
        IANAL, but this is not entirely true. Under GDPR data can be used by claiming "legitimate interest" [0]. In the case of legitimate interest, the user needs to opt-out rather than opt-in. 0: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ https://www.gdpreu.org/the-regulation/key-concepts/legitimat...
        leni536 7y ago
        I rarely see opt in GDPR popups, it's typically "accept tracking" or "more options...", the latter seemingly sending you down an infinite rabbit hole. Well, now that I think about it, this might count as opt in, but this is definitely a dark pattern.
- dmitriid 7y ago
  One acronym: GDPR It's also one of the reasons why people have become so acutely aware of the problem. When the umpteenth site asks you to consent to over 200 ad providers/trackers, there's clearly something wrong.
- ewidar 7y ago
  Actually from what I can see, checking US websites from Paris gives much less requests. Compare the request map for CNN from - Dulles, VA: 511 requests https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27dfdc2ad99109ede306579482 https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27df... - Paris, France: 77 requests https://requestmap.herokuapp.com/render/200123_87_39fdca38ac0919d45e5e950d816e29bc https://requestmap.herokuapp.com/render/200123_87_39fdca38ac... I don't know if it's for sure because of the cookies/gdpr law, but there is a clear difference, and that's a big win in my opinion.
BaitBlock 7y ago
I'm working on a browser extension called Baitblock: https://baitblock.app/ https://baitblock.app/ It also deals with 1st party cookie tracking. It clears cookie/storage on every page load as long as it detects that you're not logged in to the website (still buggy) using machine learning (NLP). The next minor version (under development) will also allow you to block websites/domains from appearing from google search results, facebook feed, twitter feed and basically the entire internet. It also blocks cookie/gdpr banners on websites. (Signup on mobile does not work for now) You can also add summaries/TL;DR for any link on the internet (right click) so others dont have to click.
- severine 7y ago
  Looks great, will try on Firefox when ready!
- contravariant 7y ago
  For people that are fine with a manual whitelist there's also Cookie Autodelete: https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://github.com/Cookie-AutoDelete/Cookie-AutoDelete. It removes all cookies when you navigate away from a website after a (customizeable) grace period. Usually this works fine, you just need to be careful when you tell it to erase cookies when the domain changes (rather than when the tab closes), some 2-step sign in procedures need the cookies from the original webpage to work.
  - Kaiyou 7y ago
    Which doesn't save you from banners stretching around 50% of a given site urging you to accept their cookie policy.
- wayoutthere 7y ago
  I want a browser that allows first-party cookies, but auto-expires them if I don't visit the domain for an hour. It should also only allow one level of requests (i.e. if a site requests a resource, that resource cannot request additional resources from other domains). The latter part won't prevent bad behavior, but it will force that behavior to be proxied -- which carries technical, financial and legal implications that will cause companies to be more careful about their downstream redirects.
pedro_hab 7y ago
I'm very curious on how 1st party cookies will be used for tracking. How can they connect one website's cookies to another's? All I can think of is fingerprinting, but afaik you can't really be sure "who's that" since fingerprinting filters people out, and isn't good enough to target a single individual. I guess they can improve it, but there are ways to work around it too, it will probably be easier to fix fingerprinting than blocking 3rd party cookies. Its seems that if 1st party cookies were as good they would have switched to it by now.
tbyehl 7y ago
PiHole and the browser-based blockers are working to apply filtering to CNAMEs. https://pi-hole.net/2020/01/19/announcing-a-beta-test-of-pi-hole-5-0/ https://pi-hole.net/2020/01/19/announcing-a-beta-test-of-pi-...

The amount of tracking is mindboggling. With advertisers switching to 1st party cookies it will get harder to avoid tracking, unfortunately.

by Tepix 7y ago

The amount of tracking is mindboggling. With advertisers switching to 1st party cookies it will get harder to avoid tracking, unfortunately.

Polylactic_acid 7y ago

The cat and mouse games will continue until legal action is taken. Before loading any tracking at all the user should be shown a Yes/no option.

pndy 7y ago
If legal action would be taken, shouldn't browser have the controls regarding tracking preference? Setting up each page (provided that 'No' would still load page in either full or stripped-down variant) on each devices owned and/or reapplying choices whenever browser cache is cleared would be frustrating. Maybe DNT should return as respected feature within browser and user choice shouldn't affect the access to the content but only its form.
- toper-centage 7y ago
  Exactly. That's how we ended up with the terrible cookie warnings. The funny thing is that GDPR has language about respecting the DNT but no one cares.
  - tristador 7y ago
    Is there a good example of a large company that blatantly ignores DNT? I'd guess its hard to know as a lot of the tracking could be server side only.
- kube-system 7y ago
  DNT is counterproductive from a technical perspective. The more bits of entropy you give trackers, the easier you are to track.
  - fauigerzigerk 7y ago
    If DNT was legally binding, they wouldn't be allowed to use that additional bit of entropy. But I would prefer a PTM (please track me) header with legally binding semantics.
    - kube-system 7y ago
      Those who abuse it the most will just move to a jurisdiction where it is allowed. Or they'll do it anyway, since many of the worst threats on the internet are already criminal. On the internet, technical solutions > legal solutions.
      - fauigerzigerk 7y ago
        There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things. Tracking only pays if you can track a huge number of people and sell ads to a huge number of advertisers. The profit per tracked user is too small to pay for running a criminal enterprise. Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law.
        kube-system 7y ago
        > There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things. True, most illicit ads tend to be non-targeted. But some criminals do things like blackmail, fraud, espionage, etc. using tracking data. > Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law. That all depends on the specific business model, business partners, and their presence. Regardless, what I describe is not conjecture, many companies are shuffling around data to avoid GDPR rather than comply. https://www.theguardian.com/technology/2018/apr/19/facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law https://www.theguardian.com/technology/2018/apr/19/facebook-... A different company without a physical presence or business partner in the jurisdiction in question, might have little to no incentive to follow the law. In the end, even if companies are breaking the law, or even if they are fined, your data won't be protected unless they actually change their behavior as a result. Calculated non-compliance is a commonplace strategy for corporate legal compliance.
adrianN 7y ago
That didn't work out so well for the EU's cookie law. We need a different solution I think.
- dmitriid 7y ago
  I think it worked wonders with GDPR which exposed all this pus. Unfortunately, there EU has been too slow acting on it. Only British Airways has been slapped with a significant fine so far.
  - taurath 7y ago
    GDPR opt out rate is well well under 1%.
    - kelnos 7y ago
      What does that even mean? GDPR requires companies to request that people opt in to information gathering.
      - martin_a 7y ago
        And in reality, as long as no fear-mongering fines are handed out, companies will try to bypass it. There would be ways to get control over this, but law is slow.
      - kevsim 7y ago
        IANAL, but this is not entirely true. Under GDPR data can be used by claiming "legitimate interest" [0]. In the case of legitimate interest, the user needs to opt-out rather than opt-in. 0: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ https://www.gdpreu.org/the-regulation/key-concepts/legitimat...
      - leni536 7y ago
        I rarely see opt in GDPR popups, it's typically "accept tracking" or "more options...", the latter seemingly sending you down an infinite rabbit hole. Well, now that I think about it, this might count as opt in, but this is definitely a dark pattern.
dmitriid 7y ago
One acronym: GDPR It's also one of the reasons why people have become so acutely aware of the problem. When the umpteenth site asks you to consent to over 200 ad providers/trackers, there's clearly something wrong.
ewidar 7y ago
Actually from what I can see, checking US websites from Paris gives much less requests. Compare the request map for CNN from - Dulles, VA: 511 requests https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27dfdc2ad99109ede306579482 https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27df... - Paris, France: 77 requests https://requestmap.herokuapp.com/render/200123_87_39fdca38ac0919d45e5e950d816e29bc https://requestmap.herokuapp.com/render/200123_87_39fdca38ac... I don't know if it's for sure because of the cookies/gdpr law, but there is a clear difference, and that's a big win in my opinion.

BaitBlock 7y ago

I'm working on a browser extension called Baitblock: https://baitblock.app/ https://baitblock.app/ It also deals with 1st party cookie tracking. It clears cookie/storage on every page load as long as it detects that you're not logged in to the website (still buggy) using machine learning (NLP). The next minor version (under development) will also allow you to block websites/domains from appearing from google search results, facebook feed, twitter feed and basically the entire internet. It also blocks cookie/gdpr banners on websites. (Signup on mobile does not work for now) You can also add summaries/TL;DR for any link on the internet (right click) so others dont have to click.

severine 7y ago
Looks great, will try on Firefox when ready!
contravariant 7y ago
For people that are fine with a manual whitelist there's also Cookie Autodelete: https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://github.com/Cookie-AutoDelete/Cookie-AutoDelete. It removes all cookies when you navigate away from a website after a (customizeable) grace period. Usually this works fine, you just need to be careful when you tell it to erase cookies when the domain changes (rather than when the tab closes), some 2-step sign in procedures need the cookies from the original webpage to work.
- Kaiyou 7y ago
  Which doesn't save you from banners stretching around 50% of a given site urging you to accept their cookie policy.
wayoutthere 7y ago
I want a browser that allows first-party cookies, but auto-expires them if I don't visit the domain for an hour. It should also only allow one level of requests (i.e. if a site requests a resource, that resource cannot request additional resources from other domains). The latter part won't prevent bad behavior, but it will force that behavior to be proxied -- which carries technical, financial and legal implications that will cause companies to be more careful about their downstream redirects.

pedro_hab 7y ago

I'm very curious on how 1st party cookies will be used for tracking. How can they connect one website's cookies to another's? All I can think of is fingerprinting, but afaik you can't really be sure "who's that" since fingerprinting filters people out, and isn't good enough to target a single individual. I guess they can improve it, but there are ways to work around it too, it will probably be easier to fix fingerprinting than blocking 3rd party cookies. Its seems that if 1st party cookies were as good they would have switched to it by now.

tbyehl 7y ago

PiHole and the browser-based blockers are working to apply filtering to CNAMEs. https://pi-hole.net/2020/01/19/announcing-a-beta-test-of-pi-hole-5-0/ https://pi-hole.net/2020/01/19/announcing-a-beta-test-of-pi-...